Merge #147272

147272: sql,security: add parsing and validation of PROVISIONSRC role option r=souravcrl a=souravcrl

See individual commits.

fixes #146060
Epic CRDB-21590

Release note (enterprise change): Added a new PROVISIONSRC role option.
This role option should be prefixed with the HBA auth method for provisioning,
i.e. `ldap` followed by the IDP uri, for example `ldap:ldap.example.com`. This
is intended to be used only internally while user provisioning and is supposed
to be view-only when checking set role options for a user.

Co-authored-by: souravcrl <[email protected]>

Author: craig[bot]

docs/generated/sql/bnf/stmt_block.bnf

@@ -1392,6 +1392,7 @@ unreserved_keyword ::=
 	| 'PRIVILEGES'
 	| 'PROCEDURE'
 	| 'PROCEDURES'
+	| 'PROVISIONSRC'
 	| 'PUBLIC'
 	| 'PUBLICATION'
 	| 'QUERIES'
@@ -3284,6 +3285,7 @@ role_option ::=
 	| password_clause
 	| valid_until_clause
 	| subject_clause
+	| provisionsrc_clause
 	| 'REPLICATION'
 	| 'NOREPLICATION'
 	| 'BYPASSRLS'
@@ -3786,6 +3788,10 @@ subject_clause ::=
 	'SUBJECT' string_or_placeholder
 	| 'SUBJECT' 'NULL'
 
+provisionsrc_clause ::=
+	'PROVISIONSRC' string_or_placeholder
+	| 'PROVISIONSRC' 'NULL'
+
 func_name_no_crdb_extra ::=
 	type_function_name_no_crdb_extra
 	| prefixed_column_path
@@ -4311,6 +4317,7 @@ bare_label_keywords ::=
 	| 'PRIVILEGES'
 	| 'PROCEDURE'
 	| 'PROCEDURES'
+	| 'PROVISIONSRC'
 	| 'PUBLIC'
 	| 'PUBLICATION'
 	| 'QUERIES'

pkg/BUILD.bazel

@@ -338,6 +338,7 @@ ALL_TESTS = [
     "//pkg/security/certmgr:certmgr_test",
     "//pkg/security/clientcert:clientcert_test",
     "//pkg/security/password:password_test",
+    "//pkg/security/provisioning:provisioning_test",
     "//pkg/security/sessionrevival:sessionrevival_test",
     "//pkg/security/username:username_disallowed_imports_test",
     "//pkg/security/username:username_test",
@@ -1718,6 +1719,8 @@ GO_TARGETS = [
     "//pkg/security/password:password",
     "//pkg/security/password:password_test",
     "//pkg/security/pprompt:pprompt",
+    "//pkg/security/provisioning:provisioning",
+    "//pkg/security/provisioning:provisioning_test",
     "//pkg/security/securityassets:securityassets",
     "//pkg/security/securitytest:securitytest",
     "//pkg/security/sessionrevival:sessionrevival",

pkg/ccl/logictestccl/testdata/logic_test/provisioning

@@ -0,0 +1,45 @@
+# LogicTest: !local-mixed-24.3 !local-mixed-25.1 !local-mixed-25.2
+# Tests for parsing/validation of the PROVISIONSRC role option.
+
+statement error role "root" cannot have a PROVISIONSRC
+ALTER ROLE root PROVISIONSRC 'ldap:ldap.example.com'
+
+statement error pq: PROVISIONSRC "ldap.example.com" was not prefixed with any valid auth methods \["ldap"\]
+CREATE ROLE role_with_provisioning PROVISIONSRC 'ldap.example.com'
+
+statement error pq: conflicting role options
+CREATE ROLE role_with_provisioning WITH PROVISIONSRC 'ldap:ldap.bar.com' NOSQLLOGIN
+
+statement ok
+CREATE ROLE role_with_provisioning PROVISIONSRC 'ldap:ldap.bar.com'
+
+query T
+SELECT value FROM system.role_options
+WHERE username = 'role_with_provisioning'
+AND option = 'PROVISIONSRC'
+----
+ldap:ldap.bar.com
+
+statement ok
+ALTER ROLE role_with_provisioning PROVISIONSRC 'ldap:ldap.example.com'
+
+query T
+SELECT value FROM system.role_options
+WHERE username = 'role_with_provisioning'
+AND option = 'PROVISIONSRC'
+----
+ldap:ldap.example.com
+
+statement error pq: provided IDP "\[\]!@#%#\^\$&\*" in PROVISIONSRC is non parseable: parse "\[\]!@#%#\^\$&\*": invalid URL escape "%#\^"
+ALTER ROLE role_with_provisioning PROVISIONSRC 'ldap:[]!@#%#^$&*'
+
+statement ok
+ALTER ROLE role_with_provisioning PROVISIONSRC 'ldap:foo.bar'
+
+query T
+SELECT value FROM system.role_options
+WHERE username = 'role_with_provisioning'
+AND option = 'PROVISIONSRC'
+----
+ldap:foo.bar
+

pkg/ccl/logictestccl/tests/3node-tenant/generated_test.go

@@ -12,7 +12,7 @@ go_test(
         "//build/toolchains:is_heavy": {"test.Pool": "heavy"},
         "//conditions:default": {"test.Pool": "large"},
     }),
-    shard_count = 35,
+    shard_count = 36,
     tags = ["cpu:2"],
     deps = [
         "//pkg/base",

pkg/ccl/logictestccl/tests/fakedist-disk/BUILD.bazel

@@ -12,7 +12,7 @@ go_test(
         "//build/toolchains:is_heavy": {"test.Pool": "heavy"},
         "//conditions:default": {"test.Pool": "large"},
     }),
-    shard_count = 35,
+    shard_count = 36,
     tags = ["cpu:2"],
     deps = [
         "//pkg/base",

pkg/ccl/logictestccl/tests/fakedist-disk/generated_test.go

@@ -12,7 +12,7 @@ go_test(
         "//build/toolchains:is_heavy": {"test.Pool": "heavy"},
         "//conditions:default": {"test.Pool": "large"},
     }),
-    shard_count = 36,
+    shard_count = 37,
     tags = ["cpu:2"],
     deps = [
         "//pkg/base",