Skip to content

Commit fdf9b38

Browse files
oscpacheoscpache
committed
WL#16127: Remove the FIDO authentication mechanism
This work log removes support for `authentication_fido`. Change-Id: Ieda896dc02955acfaa71bb47f3babb930c6a8ef2
1 parent 89e4974 commit fdf9b38

File tree

11 files changed

+22
-122
lines changed

11 files changed

+22
-122
lines changed

‎CHANGES.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ v8.4.0
1414
- WL#16203: GPL License Exception Update
1515
- WL#16173: Update allowed cipher and cipher-suite lists
1616
- WL#16164: Implement support for new vector data type
17+
- WL#16127: Remove the FIDO authentication mechanism
1718
- WL#16053: Support GSSAPI/Kerberos authentication on Windows using authentication_ldap_sasl_client plug-in for C-extension
1819

1920
v8.3.0

‎mysql-connector-python/cpydist/__init__.py

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -310,7 +310,6 @@ def _copy_vendor_libraries(self):
310310
("LDAP", f"authentication_ldap_sasl_client.{plugin_ext}"),
311311
("Kerberos", f"authentication_kerberos_client.{plugin_ext}"),
312312
("OCI IAM", f"authentication_oci_client.{plugin_ext}"),
313-
("FIDO", f"authentication_fido_client.{plugin_ext}"),
314313
("WebAuthn", f"authentication_webauthn_client.{plugin_ext}"),
315314
]
316315

‎mysql-connector-python/lib/mysql/connector/abstracts.py

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@
3434

3535
import os
3636
import re
37-
import warnings
3837
import weakref
3938

4039
from abc import ABC, abstractmethod
@@ -203,7 +202,6 @@ def __init__(self) -> None:
203202
self._force_ipv6: bool = False
204203
self._oci_config_file: Optional[str] = None
205204
self._oci_config_profile: Optional[str] = None
206-
self._fido_callback: Optional[Union[str, Callable[[str], None]]] = None
207205
self._webauthn_callback: Optional[Union[str, Callable[[str], None]]] = None
208206
self._krb_service_principal: Optional[str] = None
209207

@@ -826,15 +824,6 @@ def config(self, **kwargs: Any) -> None:
826824
KRB_SERVICE_PINCIPAL_ERROR.format(error="is incorrectly formatted")
827825
)
828826

829-
if self._fido_callback:
830-
warn_msg = (
831-
"The `fido_callback` connection argument is deprecated and it will be "
832-
"removed in a future release of MySQL Connector/Python. "
833-
"Use `webauth_callback` instead"
834-
)
835-
warnings.warn(warn_msg, DeprecationWarning)
836-
self._validate_callable("fido_callback", self._fido_callback, 1)
837-
838827
if self._webauthn_callback:
839828
self._validate_callable("webauth_callback", self._webauthn_callback, 1)
840829

‎mysql-connector-python/lib/mysql/connector/aio/abstracts.py

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@
3838
import asyncio
3939
import os
4040
import re
41-
import warnings
4241
import weakref
4342

4443
from abc import ABC, abstractmethod
@@ -182,7 +181,6 @@ def __init__(
182181
raw: bool = False,
183182
kerberos_auth_mode: Optional[str] = None,
184183
krb_service_principal: Optional[str] = None,
185-
fido_callback: Optional[Union[str, Callable[[str], None]]] = None,
186184
webauthn_callback: Optional[Union[str, Callable[[str], None]]] = None,
187185
allow_local_infile: bool = DEFAULT_CONFIGURATION["allow_local_infile"],
188186
allow_local_infile_in_path: Optional[str] = DEFAULT_CONFIGURATION[
@@ -262,7 +260,6 @@ def __init__(
262260
self._in_transaction: bool = False
263261
self._oci_config_file: Optional[str] = None
264262
self._oci_config_profile: Optional[str] = None
265-
self._fido_callback: Optional[Union[str, Callable[[str], None]]] = fido_callback
266263
self._webauthn_callback: Optional[
267264
Union[str, Callable[[str], None]]
268265
] = webauthn_callback
@@ -418,15 +415,6 @@ def _validate_connection_options(self) -> None:
418415
KRB_SERVICE_PINCIPAL_ERROR.format(error="is incorrectly formatted")
419416
)
420417

421-
if self._fido_callback:
422-
warn_msg = (
423-
"The `fido_callback` connection argument is deprecated and it will be "
424-
"removed in a future release of MySQL Connector/Python. "
425-
"Use `webauth_callback` instead"
426-
)
427-
warnings.warn(warn_msg, DeprecationWarning)
428-
self._validate_callable("fido_callback", self._fido_callback, 1)
429-
430418
if self._webauthn_callback:
431419
self._validate_callable("webauth_callback", self._webauthn_callback, 1)
432420

‎mysql-connector-python/lib/mysql/connector/aio/connection.py

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -341,7 +341,6 @@ async def _do_auth(self) -> None:
341341
oci_config_file=self._oci_config_file,
342342
oci_config_profile=self._oci_config_profile,
343343
webauthn_callback=self._webauthn_callback,
344-
fido_callback=self._fido_callback,
345344
)
346345
self._handle_ok(ok_pkt)
347346

‎mysql-connector-python/lib/mysql/connector/connection.py

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -313,7 +313,6 @@ def _do_auth(
313313
oci_config_file=self._oci_config_file,
314314
oci_config_profile=self._oci_config_profile,
315315
webauthn_callback=self._webauthn_callback,
316-
fido_callback=self._fido_callback,
317316
)
318317
self._handle_ok(ok_pkt)
319318

@@ -1087,7 +1086,6 @@ def cmd_change_user(
10871086
oci_config_file=self._oci_config_file,
10881087
oci_config_profile=self._oci_config_profile,
10891088
webauthn_callback=self._webauthn_callback,
1090-
fido_callback=self._fido_callback,
10911089
)
10921090

10931091
if not (self._client_flags & ClientFlag.CONNECT_WITH_DB) and database:

‎mysql-connector-python/lib/mysql/connector/connection_cext.py

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@ def _open_connection(self) -> None:
259259
# pylint: enable=c-extension-no-member
260260
if not self.isset_client_flag(ClientFlag.CONNECT_ARGS):
261261
self._conn_attrs = {}
262-
fido_callback = self._webauthn_callback or self._fido_callback
262+
263263
cnx_kwargs = {
264264
"host": self._host,
265265
"user": self._user,
@@ -278,10 +278,10 @@ def _open_connection(self) -> None:
278278
"load_data_local_dir": self._allow_local_infile_in_path,
279279
"oci_config_file": self._oci_config_file,
280280
"oci_config_profile": self._oci_config_profile,
281-
"fido_callback": (
282-
import_object(fido_callback)
283-
if isinstance(fido_callback, str)
284-
else fido_callback
281+
"webauthn_callback": (
282+
import_object(self._webauthn_callback)
283+
if isinstance(self._webauthn_callback, str)
284+
else self._webauthn_callback
285285
),
286286
}
287287

‎mysql-connector-python/lib/mysql/connector/constants.py

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,6 @@
9595
"krb_service_principal": None,
9696
"oci_config_file": None,
9797
"oci_config_profile": None,
98-
"fido_callback": None,
9998
"webauthn_callback": None,
10099
"kerberos_auth_mode": None,
101100
"init_command": None,

‎mysql-connector-python/src/mysql_capi.c

Lines changed: 16 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -78,16 +78,17 @@ MySQL_connected(MySQL *self);
7878
#define MYSQL_TYPE_VECTOR 242
7979
#endif
8080

81-
// Python FIDO messages callback
82-
static PyObject *fido_callback = NULL;
81+
82+
// Python webauthn messages callback
83+
static PyObject *webauthn_callback = NULL;
8384

8485
void
85-
fido_messages_callback(const char *msg)
86+
webauthn_messages_callback(const char *msg)
8687
{
87-
if (fido_callback && fido_callback != Py_None) {
88+
if (webauthn_callback && webauthn_callback != Py_None) {
8889
PyGILState_STATE state = PyGILState_Ensure();
8990
PyObject *args = Py_BuildValue("(z)", msg);
90-
PyObject *result = PyObject_Call(fido_callback, args, NULL);
91+
PyObject *result = PyObject_Call(webauthn_callback, args, NULL);
9192
Py_DECREF(args);
9293
if (result) {
9394
Py_DECREF(result);
@@ -1159,7 +1160,7 @@ MySQL_connect(MySQL *self, PyObject *args, PyObject *kwds)
11591160
"load_data_local_dir",
11601161
"oci_config_file",
11611162
"oci_config_profile",
1162-
"fido_callback",
1163+
"webauthn_callback",
11631164
"use_kerberos_gssapi",
11641165
NULL};
11651166

@@ -1170,7 +1171,7 @@ MySQL_connect(MySQL *self, PyObject *args, PyObject *kwds)
11701171
&tls_cipher_suites, &PyBool_Type, &ssl_verify_cert, &PyBool_Type,
11711172
&ssl_verify_identity, &PyBool_Type, &ssl_disabled, &PyBool_Type, &compress,
11721173
&PyDict_Type, &conn_attrs, &local_infile, &load_data_local_dir, &oci_config_file,
1173-
&oci_config_profile, &fido_callback, &use_kerberos_gssapi)) {
1174+
&oci_config_profile, &webauthn_callback, &use_kerberos_gssapi)) {
11741175
return NULL;
11751176
}
11761177

@@ -1403,19 +1404,19 @@ MySQL_connect(MySQL *self, PyObject *args, PyObject *kwds)
14031404
}
14041405
#endif
14051406

1406-
if (fido_callback && fido_callback != Py_None) {
1407-
/* verify if the `fido_callback` is a proper callable */
1408-
if (!PyCallable_Check(fido_callback)) {
1409-
PyErr_SetString(PyExc_TypeError, "Expected a callable for 'fido_callback'");
1407+
if (webauthn_callback && webauthn_callback != Py_None) {
1408+
/* verify if the `webauthn_callback` is a proper callable */
1409+
if (!PyCallable_Check(webauthn_callback)) {
1410+
PyErr_SetString(PyExc_TypeError, "Expected a callable for 'webauthn_callback'");
14101411
return NULL;
14111412
}
14121413

14131414
#if MYSQL_VERSION_ID >= 80200
14141415
/* load WebAuthn client authentication plugin if required */
1415-
struct st_mysql_client_plugin *fido_plugin = mysql_client_find_plugin(
1416+
struct st_mysql_client_plugin *webauthn_plugin = mysql_client_find_plugin(
14161417
&self->session, "authentication_webauthn_client",
14171418
MYSQL_CLIENT_AUTHENTICATION_PLUGIN);
1418-
if (!fido_plugin) {
1419+
if (!webauthn_plugin) {
14191420
raise_with_string(
14201421
PyUnicode_FromString(
14211422
"The WebAuthn authentication plugin could not be loaded"),
@@ -1424,23 +1425,9 @@ MySQL_connect(MySQL *self, PyObject *args, PyObject *kwds)
14241425
}
14251426

14261427
/* register callback */
1427-
mysql_plugin_options(fido_plugin,
1428+
mysql_plugin_options(webauthn_plugin,
14281429
"plugin_authentication_webauthn_client_messages_callback",
1429-
(const void *)(&fido_messages_callback));
1430-
#else
1431-
/* load FIDO client authentication plugin if required */
1432-
struct st_mysql_client_plugin *fido_plugin = mysql_client_find_plugin(
1433-
&self->session, "authentication_fido_client", MYSQL_CLIENT_AUTHENTICATION_PLUGIN);
1434-
if (!fido_plugin) {
1435-
raise_with_string(
1436-
PyUnicode_FromString("The FIDO authentication plugin could not be loaded"),
1437-
NULL);
1438-
return NULL;
1439-
}
1440-
1441-
/* register callback */
1442-
mysql_plugin_options(fido_plugin, "fido_messages_callback",
1443-
(const void *)(&fido_messages_callback));
1430+
(const void *)(&webauthn_messages_callback));
14441431
#endif
14451432
}
14461433

‎mysql-connector-python/tests/test_aio_authentication.py

Lines changed: 0 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1373,37 +1373,6 @@ async def test_user_3f(self):
13731373
# self._test_change_user(self.cnx.__class__, permutations, self.user_2f)
13741374

13751375

1376-
@unittest.skipIf(
1377-
tests.MYSQL_VERSION < (8, 0, 29), "Authentication with FIDO not supported"
1378-
)
1379-
@unittest.skipUnless(HAVE_CMYSQL, "C Extension not available")
1380-
class MySQLFIDOAuthPluginTests(tests.MySQLConnectorTests):
1381-
"""Test authentication.MySQLFIDOAuthPlugin.
1382-
1383-
Implemented by WL#14860: Support FIDO authentication (c-ext)
1384-
"""
1385-
1386-
@foreach_cnx_aio(CMySQLConnection)
1387-
async def test_invalid_fido_callback(self):
1388-
"""Test invalid 'fido_callback' option."""
1389-
1390-
def my_callback():
1391-
...
1392-
1393-
test_cases = (
1394-
"abc", # No callable named 'abc'
1395-
"abc.abc", # module 'abc' has no attribute 'abc'
1396-
my_callback, # 1 positional argument required
1397-
)
1398-
config = tests.get_mysql_config()
1399-
config["auth_plugin"] = "authentication_fido_client"
1400-
for case in test_cases:
1401-
config["fido_callback"] = case
1402-
with self.assertRaises(ProgrammingError):
1403-
cnx = self.cnx.__class__(**config)
1404-
await cnx.connect()
1405-
1406-
14071376
@unittest.skipIf(
14081377
tests.MYSQL_VERSION < (8, 2, 0), "Authentication with WebAuthn not supported"
14091378
)

‎mysql-connector-python/tests/test_authentication.py

Lines changed: 0 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1334,35 +1334,6 @@ def test_user_3f(self):
13341334
# self._test_change_user(self.cnx.__class__, permutations, self.user_2f)
13351335

13361336

1337-
@unittest.skipIf(
1338-
tests.MYSQL_VERSION < (8, 0, 29), "Authentication with FIDO not supported"
1339-
)
1340-
@unittest.skipUnless(HAVE_CMYSQL, "C Extension not available")
1341-
class MySQLFIDOAuthPluginTests(tests.MySQLConnectorTests):
1342-
"""Test authentication.MySQLFIDOAuthPlugin.
1343-
1344-
Implemented by WL#14860: Support FIDO authentication (c-ext)
1345-
"""
1346-
1347-
@tests.foreach_cnx(CMySQLConnection)
1348-
def test_invalid_fido_callback(self):
1349-
"""Test invalid 'fido_callback' option."""
1350-
1351-
def my_callback():
1352-
...
1353-
1354-
test_cases = (
1355-
"abc", # No callable named 'abc'
1356-
"abc.abc", # module 'abc' has no attribute 'abc'
1357-
my_callback, # 1 positional argument required
1358-
)
1359-
config = tests.get_mysql_config()
1360-
config["auth_plugin"] = "authentication_fido_client"
1361-
for case in test_cases:
1362-
config["fido_callback"] = case
1363-
self.assertRaises(ProgrammingError, self.cnx.__class__, **config)
1364-
1365-
13661337
@unittest.skipIf(
13671338
tests.MYSQL_VERSION < (8, 2, 0), "Authentication with WebAuthn not supported"
13681339
)

0 commit comments

Comments
 (0)