Skip to content

Add description about tidb_auth_token authentication #11119

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ti-chi-bot merged 3 commits into from
Nov 7, 2022
Merged

Add description about tidb_auth_token authentication #11119

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
fa30650
Add description about tidb_auth_token authentication
Oreoxmt Nov 1, 2022
9b90504
Apply suggestions from code review
Oreoxmt Nov 2, 2022
47b6ef8
Apply suggestions from code review
Oreoxmt Nov 2, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions keywords.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -606,6 +606,7 @@ The following list shows the keywords in TiDB. Reserved keywords are marked with
- TINYINT (R)
- TINYTEXT (R)
- TO (R)
- TOKEN_ISSUER
- TOPN (R)
- TRACE
- TRADITIONAL
Expand Down
5 changes: 3 additions & 2 deletions security-compatibility-with-mysql.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ TiDB supports similar security functionality to MySQL 5.7, with the following ex

TiDB supports multiple authentication methods. These methods can be specified on a per user basis using [`CREATE USER`](/sql-statements/sql-statement-create-user.md) and [`ALTER USER`](/sql-statements/sql-statement-create-user.md). These methods are compatible with the authentication methods of MySQL with the same names.

You can use one of the following supported authentication methods in the table. To specify a default method that the server advertises when the client-server connection is being established, set the [`default_authentication_plugin`](/system-variables.md#default_authentication_plugin) variable. `tidb_sm3_password` is the SM3 authentication method only supported in TiDB. Therefore, to authenticate using this method, you must connect to TiDB using [TiDB-JDBC](https://github.com/pingcap/mysql-connector-j/tree/release/8.0-sm3).
You can use one of the following supported authentication methods in the table. To specify a default method that the server advertises when the client-server connection is being established, set the [`default_authentication_plugin`](/system-variables.md#default_authentication_plugin) variable. `tidb_sm3_password` is the SM3 authentication method only supported in TiDB. Therefore, to authenticate using this method, you must connect to TiDB using [TiDB-JDBC](https://github.com/pingcap/mysql-connector-j/tree/release/8.0-sm3). `tidb_auth_token` is a JSON Web Token (JWT) based authentication method used only in TiDB Cloud.

<CustomContent platform="tidb">

Expand All @@ -38,7 +38,8 @@ The support for TLS authentication is configured differently. For detailed infor
| `caching_sha2_password` | Yes, since 5.2.0 |
| `auth_socket` | Yes, since 5.3.0 |
| `tidb_sm3_password` | Yes, since 6.3.0 |
| TLS Certificates | Yes |
| `tidb_auth_token` | Yes, since 6.4.0 |
| TLS Certificates | Yes |
| LDAP | No |
| PAM | No |
| ed25519 (MariaDB) | No |
Expand Down
3 changes: 2 additions & 1 deletion system-variables.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,7 +208,8 @@ mysql> SELECT * FROM t1;
- Persists to cluster: Yes
- Type: Enumeration
- Default value: `mysql_native_password`
- Possible values: `mysql_native_password`, `caching_sha2_password`, and `tidb_sm3_password`
- Possible values: `mysql_native_password`, `caching_sha2_password`, `tidb_sm3_password`, and `tidb_auth_token`
- The `tidb_auth_token` authentication method is used only for the internal operation of TiDB Cloud. **DO NOT** set the variable to this value.
- This variable sets the authentication method that the server advertises when the server-client connection is being established.
- To authenticate using the `tidb_sm3_password` method, you can connect to TiDB using [TiDB-JDBC](https://github.com/pingcap/mysql-connector-j/tree/release/8.0-sm3).

Expand Down
18 changes: 18 additions & 0 deletions tidb-configuration-file.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -327,6 +327,24 @@ Configuration items related to security.
- Default value: "", which allows TLSv1.1 or higher.
- Optional values: `"TLSv1.0"`, `"TLSv1.1"`, `"TLSv1.2"` and `"TLSv1.3"`

### `auth-token-jwks` <span class="version-mark">New in v6.4.0</span>

> **Warning:**
>
> The `tidb_auth_token` authentication method is used only for the internal operation of TiDB Cloud. **DO NOT** change the value of this configuration.

- Set the local file path of the JSON Web Key Sets (JWKS) for the `tidb_auth_token` authentication method.
- Default value: `""`

### `auth-token-refresh-interval` <span class="version-mark">New in v6.4.0</span>

> **Warning:**
>
> The `tidb_auth_token` authentication method is used only for the internal operation of TiDB Cloud. **DO NOT** change the value of this configuration.

- Set the JWKS refresh interval for the `tidb_auth_token` authentication method.
- Default value: `1h`

## Performance

Configuration items related to performance.
Expand Down