Ps 11392 8.4 backport pbkdf2

include/crypt_genhash_impl.h

@@ -27,9 +27,17 @@
 
 #ifndef CRYPT_HASHGEN_IMPL_H
 #define CRYPT_HASHGEN_IMPL_H
+
+// sha256 rounds
 #define ROUNDS_DEFAULT 5000
 #define ROUNDS_MIN ROUNDS_DEFAULT
 #define ROUNDS_MAX (0xFFF * 1000)
+
+// caching_sha2 rounds
+#define SHA2_ROUNDS_DEFAULT 10000
+#define SHA2_ROUNDS_MIN 5000
+#define SHA2_ROUNDS_MAX (0xFFF * 1000)
+
 #define MIXCHARS 32
 #define CRYPT_SALT_LENGTH 20
 #define CRYPT_MAGIC_LENGTH 3

include/mysql/plugin_auth_common.h

@@ -105,6 +105,12 @@
   authentication with very limited operations ALTER USER to do registration.
 */
 #define CR_OK_AUTH_IN_SANDBOX_MODE -3
+/**
+  Authentication was successful with limited operations.
+  User should change the password.
+*/
+#define CR_OK_FORCE_PASSWORD_CHANGE -4
+
 /**
 Flag to be passed back to server from authentication plugins via
 authenticated_as when proxy mapping should be done by the server.

mysql-test/r/mysqld--help-notwin.result

@@ -252,12 +252,28 @@ The following options may be given as the first argument:
  --caching-sha2-password-digest-rounds=# 
  Number of SHA2 rounds to be done when storing a password
  hash onto disk.
+ --caching-sha2-password-enforce-storage-format 
+ Enforce storage format for credentials. If set to TRUE,
+ then accounts that are using caching_sha2_password and
+ have password transformation stored in format other than
+ what is specified by
+ --caching_sha2_password_storage_format, will be forced to
+ change their password upon login.
  --caching-sha2-password-private-key-path=name 
  A fully qualified path to the private RSA key used for
  authentication.
+ --caching-sha2-password-proxy-users 
+ If set to FALSE (the default), then the caching_sha2
+ authentication plugin will not signal for authenticated
+ users to be checked for mapping to proxy users. If set to
+ TRUE, the plugin will flag associated authenticated
+ accounts to be mapped to proxy users when the server
+ option check_proxy_users is enabled.
  --caching-sha2-password-public-key-path=name 
  A fully qualified path to the public RSA key used for
  authentication.
+ --caching-sha2-password-storage-format=name 
+ Storage format for credentials.
  --character-set-filesystem=name 
  Set the filesystem character set.
  -C, --character-set-server=name 
@@ -1808,8 +1824,11 @@ buffered-error-log-filename
 buffered-error-log-size 0
 bulk-insert-buffer-size 8388608
 caching-sha2-password-digest-rounds 5000
+caching-sha2-password-enforce-storage-format FALSE
 caching-sha2-password-private-key-path private_key.pem
+caching-sha2-password-proxy-users FALSE
 caching-sha2-password-public-key-path public_key.pem
+caching-sha2-password-storage-format CRYPT5
 character-set-filesystem binary
 character-set-server utf8mb4
 character-sets-dir MYSQL_CHARSETSDIR/

mysql-test/r/mysqld--help-win.result

@@ -239,13 +239,29 @@ The following options may be given as the first argument:
  --caching-sha2-password-digest-rounds=# 
  Number of SHA2 rounds to be done when storing a password
  hash onto disk.
- --caching-sha2-password-private-key-path=name 
+ --caching-sha2-password-enforce-storage-format
+ Enforce storage format for credentials. If set to TRUE,
+ then accounts that are using caching_sha2_password and
+ have password transformation stored in format other than
+ what is specified by
+ --caching_sha2_password_storage_format, will be forced to
+ change their password upon login.
+ --caching-sha2-password-private-key-path=name
  A fully qualified path to the private RSA key used for
  authentication.
+ --caching-sha2-password-proxy-users
+ If set to FALSE (the default), then the caching_sha2
+ authentication plugin will not signal for authenticated
+ users to be checked for mapping to proxy users. If set to
+ TRUE, the plugin will flag associated authenticated
+ accounts to be mapped to proxy users when the server
+ option check_proxy_users is enabled.
  --caching-sha2-password-public-key-path=name 
  A fully qualified path to the public RSA key used for
  authentication.
- --character-set-filesystem=name 
+ --caching-sha2-password-storage-format=name
+ Storage format for credentials.
+ --character-set-filesystem=name
  Set the filesystem character set.
  -C, --character-set-server=name 
  Set the default character set.
@@ -721,11 +737,11 @@ The following options may be given as the first argument:
  NULLS_UNEQUAL (default behavior for 4.1 and later),
  NULLS_EQUAL (emulate 4.0 behavior), and NULLS_IGNORED
  --myisam-use-mmap   Use memory mapping for reading and writing MyISAM tables
- --mysql-native-password[=name] 
+ --mysql-native-password[=name]
  Enable or disable mysql_native_password plugin. Possible
  values are ON, OFF, FORCE (don't start if the plugin
  fails to load).
- --mysql-native-password-proxy-users 
+ --mysql-native-password-proxy-users
  If set to FALSE (the default), then the
  mysql_native_password plugin will not signal for
  authenticated users to be checked for mapping to proxy
@@ -1144,15 +1160,15 @@ The following options may be given as the first argument:
  --replica-net-timeout=# 
  Number of seconds to wait for more data from a
  replication connection before aborting the read.
- --replica-parallel-type=name 
+ --replica-parallel-type=name
  The method used by the replication applier to parallelize
  transactions. DATABASE, indicates that it may apply
  transactions in parallel in case they update different
  databases. LOGICAL_CLOCK, which is the default, indicates
  that it decides whether two transactions can be applied
  in parallel using the logical timestamps computed by the
  source.
- --replica-parallel-workers=# 
+ --replica-parallel-workers=#
  Number of worker threads for executing events in parallel
  --replica-pending-jobs-size-max=# 
  Soft limit on the size, in bytes, of per-worker queues of
@@ -1410,10 +1426,10 @@ The following options may be given as the first argument:
  --slave-net-timeout=# 
  This option is deprecated. Use replica_net_timeout
  instead.
- --slave-parallel-type=name 
+ --slave-parallel-type=name
  This option is deprecated. Use replica_parallel_type
  instead.
- --slave-parallel-workers=# 
+ --slave-parallel-workers=#
  This option is deprecated. Use replica_parallel_workers
  instead.
  --slave-pending-jobs-size-max=# 
@@ -1534,10 +1550,10 @@ The following options may be given as the first argument:
  Maximum amount of memory (in bytes) the TempTable storage
  engine is allowed to allocate from the main memory (RAM)
  before starting to store data on disk.
- --temptable-use-mmap 
+ --temptable-use-mmap
  Use mmap files for temptables. This variable is
  deprecated and will be removed in a future release.
- --terminology-use-previous=name 
+ --terminology-use-previous=name
  Make monitoring tables and statements use the identifiers
  that were in use before they were changed in a given
  release. That includes names for mutexes, read/write
@@ -1629,6 +1645,7 @@ The following options may be given as the first argument:
 
 Variables (--variable-name=value)
 activate-all-roles-on-login FALSE
+activate-mandatory-roles TRUE
 admin-address (No default value)
 admin-port 33062
 admin-ssl-ca (No default value)
@@ -1673,9 +1690,12 @@ binlog-transaction-compression-level-zstd 3
 binlog-transaction-dependency-history-size 25000
 block-encryption-mode aes-128-ecb
 bulk-insert-buffer-size 8388608
-caching-sha2-password-digest-rounds 5000
+caching-sha2-password-digest-rounds 10000
+caching-sha2-password-enforce-storage-format FALSE
 caching-sha2-password-private-key-path private_key.pem
+caching-sha2-password-proxy-users FALSE
 caching-sha2-password-public-key-path public_key.pem
+caching-sha2-password-storage-format CRYPT5
 character-set-filesystem binary
 character-set-server utf8mb4
 character-sets-dir MYSQL_CHARSETSDIR/