feat(security): add password verifier formats

[killme2008]

I hereby agree to the terms of the GreptimeDB CLA.

What's changed and what's your intention?

Stop requiring plaintext passwords at rest in the static/watch file user provider.

A credential password now accepts an explicit verifier format:

• plain:<password> — plaintext (the default when no prefix is given)
• pbkdf2_sha256:<iterations>:<hex_salt>:<hex_hash> — at-rest hash, used by cleartext-capable paths (HTTP/gRPC Basic, PostgreSQL cleartext, MySQL clear password)
• mysql_native_password:<hex_sha1_sha1_password> — at-rest verifier that still serves the MySQL mysql_native_password handshake

Parsing is hardened:

• PBKDF2 iterations are bounded.
• PBKDF2 salt length is bounded.
• PBKDF2 hashes must be exactly 32 bytes.
• Password verification uses constant-time comparison.
• Verifier bytes are redacted from debug output.
• Non-plain verifiers are not exported through get_one_user_pwd().

Capability note

A single verifier format does not serve every wire protocol:

Verifier	HTTP/gRPC Basic	PostgreSQL cleartext	MySQL clear password	MySQL mysql_native_password
plain:<password> or legacy user=password	yes	yes	yes	yes
pbkdf2_sha256:<iterations>:<hex_salt>:<hex_hash>	yes	yes	yes	no
mysql_native_password:<hex_sha1_sha1_password>	no	no	no	yes

pbkdf2_sha256 protects passwords at rest. It does not change wire security; cleartext-capable protocols still need TLS in production.

Breaking change

Passwords are now prefix-parsed. A legacy plaintext password that literally starts with plain:, pbkdf2_sha256:, or mysql_native_password: changes meaning.

Use plain: to make that intent explicit. For example, the literal password plain:secret should be configured as:

user=plain:plain:secret

PR Checklist

• I have written the necessary rustdoc comments.
• I have added the necessary unit tests and integration tests.
• This PR requires documentation updates.
• API changes are backward compatible.
• Schema or data changes are backward compatible.

[gemini-code-assist]

Code Review

This pull request introduces support for secure password verifiers, including PBKDF2-SHA256 and MySQL Native Password, to protect credentials at rest. It also adds a frontend_auth configuration option for flownodes to authenticate internal gRPC requests to the frontend. The review feedback suggests enforcing a strict 32-byte length check on decoded PBKDF2-SHA256 hashes to prevent truncation issues, and optimizing the verification path by using a stack-allocated array instead of a heap-allocated vector.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[Copilot]

Pull request overview

This PR extends GreptimeDB authentication configuration by introducing explicit password verifier formats (e.g., plain:, pbkdf2_sha256:..., mysql_native_password:...) for the static user provider, and adds a dedicated frontend_auth config for flownode-to-frontend internal gRPC authentication to avoid reusing user_provider credentials.

Changes:

• Add PasswordVerifier parsing/verification to support plain, pbkdf2_sha256, and mysql_native_password verifier strings in static credentials.
• Add frontend_auth (basic auth) to flownode options and prefer it for internal requests, keeping user_provider as a fallback.
• Update example configs and add tests for new verifier formats and frontend_auth behavior.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/flow/src/server.rs	Prefer frontend_auth for internal auth header construction; add validation + tests.
src/flow/src/engine.rs	Add from_basic() constructor (and keep from_user_pwd() via delegation).
src/flow/src/adapter.rs	Add frontend_auth options struct with password-redacting Debug.
src/cmd/tests/load_config_test.rs	Update expected FlownodeOptions to include frontend_auth.
src/auth/src/user_provider/static_user_provider.rs	Support non-plain verifiers in auth flow; reject exporting non-plain verifier as plaintext; add tests.
src/auth/src/user_provider.rs	Introduce PasswordVerifier parsing/verification and extend credential parsing + tests.
src/auth/src/common.rs	Factor MySQL native password auth to allow verifying against a precomputed stage-2 hash.
src/auth/Cargo.toml	Add dependencies needed for verifier parsing/verification (pbkdf2, sha2, subtle, hex).
config/standalone.example.toml	Document supported password verifier formats.
config/frontend.example.toml	Document supported password verifier formats.
config/flownode.example.toml	Document verifier formats and add frontend_auth example.
Cargo.lock	Lockfile updates for new dependencies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sunng87]

I suggest to keep this file provider simple. It's not designed for security or any production usage. Users with this concern should switch to the enterprise edition.

[killme2008]

I suggest to keep this file provider simple. It's not designed for security or any production usage. Users with this concern should switch to the enterprise edition.

This seems more like a baseline security improvement than a commercial-only feature. Support for non-plaintext password verifiers and separation of internal auth from user credential handling should be part of the open-source core, while enterprise editions can differentiate with SSO, LDAP, audit logs, and advanced access control, which we already have.

[MichaelScofield]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c6e3b9f806

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[shuiyisong]

mysql_native_password:<hex_sha1_sha1_password>
One nit question is, for normal users, how can they get the correct shaed hex string 🤔

[killme2008]

mysql_native_password:<hex_sha1_sha1_password> One nit question is, for normal users, how can they get the correct shaed hex string 🤔

I'll implement a command like greptime password mysql_native_password <password> to generate the hashed password.

[shuiyisong]

LGTM

[evenyag]

Is it a breaking change?

[killme2008]

Is it a breaking change?

Yes, but it won't break anything actually unless your password starts with plain: or mysql_native_password.