feat: per-user authentication plugin framework #5290

rophy · 2026-01-11T10:35:53Z

Summary

Adds per-user auth plugin support via mysql_users.attributes:

INSERT INTO mysql_users (username, password, attributes, frontend, backend)
VALUES ('app_user', '', '{"auth_plugin": "static", "static_password": "secret"}', 1, 0);

New ProxySQL_Auth_Plugin interface
Plugin loading via auth_plugins config
AUTH_SWITCH flow for clear-text credentials
Backend user mapping via backend_username attribute

Included Plugins

static - validates against password in attributes (reference implementation)
k8s - validates Kubernetes ServiceAccount tokens via TokenReview API

Tests

Integration tests for static plugin
Unit tests for k8s plugin (mock-based)

Docs

doc/internal/MySQL_AuthPlugin.md

Adds a new per-user auth plugin system that allows different users to authenticate using different methods via the auth_plugin attribute in mysql_users.attributes. Includes: - ProxySQL_Auth_Plugin interface (include/MySQL_AuthPlugin.h) - Plugin loading via auth_plugins config (src/main.cpp) - AUTH_SWITCH flow for clear-text credential (lib/MySQL_Protocol.cpp) - Static auth plugin as reference implementation - Integration tests and documentation

Validates K8s ServiceAccount JWT tokens via TokenReview API. Username format: namespace/serviceaccount (must match token identity). Features: - Direct TokenReview API integration (no external validator) - Configurable timeout via K8S_TIMEOUT_MS env var - Dependency injection for testability - 24 unit tests with mock K8s client

gemini-code-assist · 2026-01-11T10:36:21Z

Summary of Changes

Hello @rophy, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a flexible and extensible per-user authentication plugin framework for ProxySQL. It allows administrators to configure diverse authentication mechanisms for individual users, moving beyond traditional password-based methods. This is particularly beneficial for integrating with modern identity providers and orchestrators like Kubernetes, enabling more secure and dynamic credential management without modifying ProxySQL's core logic.

Highlights

New Authentication Plugin Framework: Introduced a new ProxySQL_Auth_Plugin interface for extending authentication methods, allowing for highly customizable per-user authentication.
Dynamic Plugin Loading: Enabled dynamic loading of authentication plugins via a new auth_plugins configuration variable, supporting runtime extensibility.
AUTH_SWITCH Flow Integration: Implemented an AUTH_SWITCH flow within the MySQL protocol handler to securely obtain clear-text credentials (like tokens or passwords) for plugin validation.
Backend User Mapping: Added support for mapping frontend users, authenticated by plugins, to distinct backend users using the backend_username attribute in mysql_users.
Reference Plugins Included: Provided two reference plugins: a static password validator for simple cases and a k8s plugin for Kubernetes ServiceAccount token validation via the TokenReview API.
Comprehensive Testing: Included integration tests for the static plugin and unit tests for the Kubernetes plugin, ensuring the framework's reliability and correctness.
Detailed Documentation: Added new internal documentation (doc/internal/MySQL_AuthPlugin.md) detailing the design, configuration, and usage of the new authentication framework.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This PR introduces a powerful and flexible per-user authentication plugin framework. The design is well-thought-out, with a clear interface for plugins, good separation of concerns (e.g., using dependency injection for the Kubernetes client), and comprehensive documentation and tests. The inclusion of both a simple static plugin and a more complex k8s plugin serves as a great reference for future plugin developers.

I have one major concern regarding the connection counting logic when both this new plugin framework and the existing LDAP plugin are used concurrently. I've provided detailed comments and suggestions in lib/MySQL_Session.cpp to address this.

Overall, this is an excellent feature addition to ProxySQL.

lib/MySQL_Session.cpp

rophy · 2026-01-11T10:43:42Z

Hi, nowadays many apps and DBs are deployed inside Kubernetes.

I am exploring possibilities to leverage Kubernetes ServiceAccount - a form of system identity defined and managed by Kubernetes, to enable passwordless authentication of MariaDB: https://github.com/rophy/mariadb-auth-k8s

As a bonus, I think it might be useful for proxysql to support this as well, so I tried to mimic the concepts of existing proxysql LDAP auth support into a generic auth plugin framework. Wanted to know if proxysql team is interested in such idea.

Disclaimer: Code is AI generated. I as human oversee the design, reviewed the test cases, and made sure the test cases pass in local dev container and local kubernetes cluster (kind).

When both LDAP module and per-user auth plugins are configured, auth plugin users were incorrectly having their connections counted by LDAP's counter instead of GloMyAuth. Add use_auth_plugin flag to distinguish auth plugin users from LDAP users, ensuring correct connection counting regardless of whether LDAP module is loaded.

Replace strlen(s) == 0 with s[0] == '\0' to avoid potential issues with non-null-terminated strings and satisfy static analysis checks.

sonarqubecloud · 2026-01-11T15:14:16Z

Quality Gate failed

Failed conditions
2 Security Hotspots

See analysis details on SonarQube Cloud

mirostauder · 2026-01-11T18:59:04Z

retest this please

rophy · 2026-01-11T23:04:38Z

retest this please

The PR involves building plugins (.so) so your existing CI pipeline will definitely fail.

If OK, I'd also like to propose a common local-first build & test environment, to help external contributers have more consistent test results with proxysql team: #5292

rophy added 2 commits January 11, 2026 10:31

gemini-code-assist bot reviewed Jan 11, 2026

View reviewed changes

lib/MySQL_Session.cpp Show resolved Hide resolved

lib/MySQL_Session.cpp Outdated Show resolved Hide resolved

lib/MySQL_Session.cpp Show resolved Hide resolved

rophy added 2 commits January 11, 2026 13:43

fix: avoid strlen for empty string checks

b208f55

Replace strlen(s) == 0 with s[0] == '\0' to avoid potential issues with non-null-terminated strings and satisfy static analysis checks.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: per-user authentication plugin framework #5290

feat: per-user authentication plugin framework #5290

rophy commented Jan 11, 2026

Uh oh!

gemini-code-assist bot commented Jan 11, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rophy commented Jan 11, 2026 •

edited

Loading

Uh oh!

sonarqubecloud bot commented Jan 11, 2026

Uh oh!

mirostauder commented Jan 11, 2026

Uh oh!

rophy commented Jan 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

feat: per-user authentication plugin framework #5290

Are you sure you want to change the base?

feat: per-user authentication plugin framework #5290

Conversation

rophy commented Jan 11, 2026

Summary

Uh oh!

gemini-code-assist bot commented Jan 11, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rophy commented Jan 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud bot commented Jan 11, 2026

Quality Gate failed

Uh oh!

mirostauder commented Jan 11, 2026

Uh oh!

rophy commented Jan 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rophy commented Jan 11, 2026 •

edited

Loading