{"action":"created","issue":{"url":"https://api.github.com/repos/mysql-net/MySqlConnector/issues/577","repository_url":"https://api.github.com/repos/mysql-net/MySqlConnector","labels_url":"https://api.github.com/repos/mysql-net/MySqlConnector/issues/577/labels{/name}","comments_url":"https://api.github.com/repos/mysql-net/MySqlConnector/issues/577/comments","events_url":"https://api.github.com/repos/mysql-net/MySqlConnector/issues/577/events","html_url":"https://github.com/mysql-net/MySqlConnector/pull/577","id":375743868,"node_id":"MDExOlB1bGxSZXF1ZXN0MjI3MTE5MjAy","number":577,"title":"Support auth_gssapi authentication.","user":{"login":"vaintroub","id":1708204,"node_id":"MDQ6VXNlcjE3MDgyMDQ=","avatar_url":"https://avatars2.githubusercontent.com/u/1708204?v=4","gravatar_id":"","url":"https://api.github.com/users/vaintroub","html_url":"https://github.com/vaintroub","followers_url":"https://api.github.com/users/vaintroub/followers","following_url":"https://api.github.com/users/vaintroub/following{/other_user}","gists_url":"https://api.github.com/users/vaintroub/gists{/gist_id}","starred_url":"https://api.github.com/users/vaintroub/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vaintroub/subscriptions","organizations_url":"https://api.github.com/users/vaintroub/orgs","repos_url":"https://api.github.com/users/vaintroub/repos","events_url":"https://api.github.com/users/vaintroub/events{/privacy}","received_events_url":"https://api.github.com/users/vaintroub/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-10-31T00:00:20Z","updated_at":"2018-11-03T21:18:19Z","closed_at":"2018-11-03T17:16:41Z","author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/mysql-net/MySqlConnector/pulls/577","html_url":"https://github.com/mysql-net/MySqlConnector/pull/577","diff_url":"https://github.com/mysql-net/MySqlConnector/pull/577.diff","patch_url":"https://github.com/mysql-net/MySqlConnector/pull/577.patch"},"body":"This patch adds support for MariaDB's gssapi authentication plugin, passwordless authentication on Windows (in both domain and standalone machine environments), as well as on Linux, in Kerberos realm environment.\r\n\r\nMore information on authentication plugin https://mariadb.com/kb/en/library/authentication-plugin-gssapi\r\n\r\nThe patch uses .NET NegotiateStream to authenticate. It uses an auxiliary stream to convert NegotiateStream framing for SPNEGO/NTLM payloads into MySQL packet framing with the same payloads.\r\n\r\n\r\nThings to note\r\n\r\n* Currently,  the client \"trusts\" service principal name that server sends, and passes it as targetName in NegotiateStream.AuthenticateAsClientAsync.  Ideally , to support mutual authentication between client and server , service principal name should be an optional connection parameter.  If set, driver would ignore the string sent by the server. I did not add this into the patch,  but, if we agree it is a good idea, I can be easily added later.\r\n\r\n*  On Linux, NegotiateStream implementation currently only works correctly with  service principle names (that's the dotnet implementation of it) . Most importantly , it  does not understand UPNs user principle names , like machine$@domain.com, which are typically in use by MariaDB servers running inside Windows AD.\r\n\r\nThus by default, connection from a Linux client to Windows server would fail (.NET runtime turns machine$@domain.com into funny name  machine$/domain.com, which KDC won't find).\r\n \r\nThere is however a  simple workaround on the server side, to allow Linux client to connect  Windows server, would be to set  server parameter --gssapi-principal-name=HOST/fqdn@DOMAIN.COM (host SPN, usually added whenever machine joins the domain). \r\n"},"comment":{"url":"https://api.github.com/repos/mysql-net/MySqlConnector/issues/comments/435621638","html_url":"https://github.com/mysql-net/MySqlConnector/pull/577#issuecomment-435621638","issue_url":"https://api.github.com/repos/mysql-net/MySqlConnector/issues/577","id":435621638,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNTYyMTYzOA==","user":{"login":"vaintroub","id":1708204,"node_id":"MDQ6VXNlcjE3MDgyMDQ=","avatar_url":"https://avatars2.githubusercontent.com/u/1708204?v=4","gravatar_id":"","url":"https://api.github.com/users/vaintroub","html_url":"https://github.com/vaintroub","followers_url":"https://api.github.com/users/vaintroub/followers","following_url":"https://api.github.com/users/vaintroub/following{/other_user}","gists_url":"https://api.github.com/users/vaintroub/gists{/gist_id}","starred_url":"https://api.github.com/users/vaintroub/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vaintroub/subscriptions","organizations_url":"https://api.github.com/users/vaintroub/orgs","repos_url":"https://api.github.com/users/vaintroub/repos","events_url":"https://api.github.com/users/vaintroub/events{/privacy}","received_events_url":"https://api.github.com/users/vaintroub/received_events","type":"User","site_admin":false},"created_at":"2018-11-03T21:18:19Z","updated_at":"2018-11-03T21:18:19Z","author_association":"CONTRIBUTOR","body":"Thank you!"}}
{"actor":{"display_login":"vaintroub"}}