PS 10999 8.4 OIDC authentication by jankowsk · Pull Request #5941 · percona/percona-server

jankowsk · 2026-05-11T09:15:24Z

No description provided.

catalinbp

.

When OpenID Connect authentication maps external roles during login, acl_authenticate() called grant_role() with mpvio->acl_user. That ACL_USER is a copy allocated on the connection's mem_root and is freed when dispatch_command() ends. grant_role() stores ACL_USER by value in the role graph, including the raw user/host pointers. Later DROP USER walks that graph and reads those pointers after the mem_root was cleared, causing a heap-use-after-free (ASAN failure in auth_openid_connect.idp cleanup). Fix: lookup the durable ACL cache entry with find_acl_user() and pass that to grant_role() instead of the mem_root copy. The same problem probably would occur with any other plugin granting roles.

Upstream added OIDC authentication in 9.x, by this commit the client side plugin is backported to 8.4. Follow up of WL#16269 OpenID Connect (Oauth2 - JWT) Authentication Support Change-Id in upstream: I11944643d4a6098312edd16550c0160e86905063 The upstream commit introduces client side OpenID Connect authentication plugin to MySQL 9.x. Here we port it to 8.4 as part of work on Percona OpenID Connect authentication.

OpenID Connect pluggable authentication is a parity feature with MySQL Enterprise Edition. It allows users to authenticate to Percona MySQL Server using OpenID Connect. The user connecting to the server must identify itself with ID Token previously obtained from an Identity Provider. The server verifies if the token was signed by user’s Identity Provider (IDP) and if token’s subject matches user’s name in the Identity Provider domain. The plugin supports group-role mapping and proxy accounts. This commit gathers the following tasks: PS-10849: OpenID Connect Pluggable Authentication PS-11017: MTR tests PS-11018: Add proxy support to OIDC authentication

jankowsk requested a review from lukin-oleksiy May 11, 2026 09:15

jankowsk force-pushed the PS-10999-8.4-OIDC_Authentication branch 3 times, most recently from f8b2007 to 9df8db7 Compare May 20, 2026 07:52

jankowsk force-pushed the PS-10999-8.4-OIDC_Authentication branch 8 times, most recently from 1b4c342 to b10ec38 Compare May 21, 2026 07:51

jankowsk requested a review from catalinbp May 21, 2026 09:48

jankowsk force-pushed the PS-10999-8.4-OIDC_Authentication branch 6 times, most recently from f373aeb to fdaa978 Compare May 27, 2026 14:57