WL#15440 MySQL REST Service (MRS) - Umbrella WL

Bug#37581032 MRS while doing authentication uses secondary ID in case of scram

Secondary ID in SCRAM authentication is now checked for uniquness among
the existing sessions. If it is not unique a new one is randomly picked
and checked.

Change-Id: Id7a8f30d3da11aa69053be6d0d08dc54d0fd6597

Author: Andrzej Religa

router/src/mysql_rest_service/include/mrs/interface/auth_handler_factory.h

@@ -42,6 +42,7 @@ class AuthHandlerFactory {
   using AuthApp = mrs::database::entry::AuthApp;
   using AuthHandlerPtr = std::shared_ptr<AuthorizeHandler>;
   using AuthorizeHandlerCallbakcs = helper::AuthorizeHandlerCallbakcs;
+  using SessionManager = http::SessionManager;
 
  public:
   virtual ~AuthHandlerFactory() = default;
@@ -57,7 +58,7 @@ class AuthHandlerFactory {
       AuthorizeHandlerCallbakcs *cb, const AuthApp &entry) const = 0;
   virtual AuthHandlerPtr create_scram_auth_handler(
       AuthorizeHandlerCallbakcs *cb, const AuthApp &entry,
-      const std::string &rd) const = 0;
+      const std::string &rd, SessionManager *session_manager) const = 0;
 };
 
 }  // namespace interface

router/src/mysql_rest_service/src/mrs/authentication/auth_handler_factory.cc

@@ -68,10 +68,10 @@ AuthHandlerPtr AuthHandlerFactory::create_oidc_auth_handler(
 }
 
 AuthHandlerPtr AuthHandlerFactory::create_scram_auth_handler(
-    AuthorizeHandlerCallbakcs *cb, const AuthApp &entry,
-    const std::string &rd) const {
+    AuthorizeHandlerCallbakcs *cb, const AuthApp &entry, const std::string &rd,
+    SessionManager *session_manager) const {
   using Obj = TrackAuthorizeHandler<AuthorizeHandlerCallbakcs, ScramHandler>;
-  return std::make_shared<Obj>(cb, entry, rd, qf_);
+  return std::make_shared<Obj>(cb, entry, rd, qf_, session_manager);
 }
 
 }  // namespace authentication

router/src/mysql_rest_service/src/mrs/authentication/auth_handler_factory.h

@@ -40,6 +40,7 @@ class AuthHandlerFactory : public interface::AuthHandlerFactory {
  public:
   using MysqlCacheManager = collector::MysqlCacheManager;
   using QueryFactory = mrs::interface::QueryFactory;
+  using SessionManager = http::SessionManager;
 
  public:
   AuthHandlerFactory(QueryFactory *qf);
@@ -55,7 +56,7 @@ class AuthHandlerFactory : public interface::AuthHandlerFactory {
                                           const AuthApp &entry) const override;
   AuthHandlerPtr create_scram_auth_handler(
       AuthorizeHandlerCallbakcs *cb, const AuthApp &entry,
-      const std::string &rd) const override;
+      const std::string &rd, SessionManager *session_manager) const override;
 
  private:
   QueryFactory *qf_;

router/src/mysql_rest_service/src/mrs/authentication/authorize_manager.cc

@@ -333,7 +333,8 @@ AuthorizeHandlerPtr AuthorizeManager::create_authentication_application(
   } else if (entry.vendor_id == k_vendor_google) {
     return factory_->create_google_auth_handler(this, entry);
   } else if (entry.vendor_id == k_vendor_mrs) {
-    return factory_->create_scram_auth_handler(this, entry, random_data_);
+    return factory_->create_scram_auth_handler(this, entry, random_data_,
+                                               &session_manager_);
   } else if (entry.vendor_id == k_vendor_oidc) {
     if (entry.url.empty()) {
       log_error(

router/src/mysql_rest_service/src/mrs/authentication/scram_handler.cc

@@ -115,8 +115,10 @@ inline AuthApp limit_users(const AuthApp &a) {
 }
 
 ScramHandler::ScramHandler(const AuthApp &entry, const std::string &random_data,
-                           QueryFactory *qf)
-    : SaslHandler{limit_users(entry), qf}, random_data_{random_data} {
+                           QueryFactory *qf, SessionManager *session_manager)
+    : SaslHandler{limit_users(entry), qf},
+      random_data_{random_data},
+      session_manager_{session_manager} {
   log_debug("ScramHandler for service %s", to_string(entry_).c_str());
 }
 
@@ -187,9 +189,15 @@ SaslResult ScramHandler::client_initial_response(RequestContext &ctxt,
   } else {
     session_data->ksi = UserOptionsParser(session->user.auth_string).decode();
   }
-  session_data->nonce +=
-      helper::generate_string<kServerNonceLength, GeneratorNonceCharacters>();
-  session->handler_secondary_id = session_data->nonce;
+
+  session_manager_->set_unique_session_secondary_id(
+      session, [&session_data]() -> auto{
+        return session_data->nonce +
+               helper::generate_string<kServerNonceLength,
+                                       GeneratorNonceCharacters>();
+      });
+
+  session_data->nonce = session->handler_secondary_id;
 
   if (!session_data->ksi.is_valid)
     return SaslResult(get_problem_description(HttpStatusCode::Unauthorized,

router/src/mysql_rest_service/src/mrs/authentication/scram_handler.h

@@ -35,7 +35,7 @@ namespace authentication {
 class ScramHandler : public SaslHandler {
  public:
   ScramHandler(const AuthApp &entry, const std::string &random_data,
-               QueryFactory *qf);
+               QueryFactory *qf, SessionManager *session_manager);
 
   const std::string &get_handler_name() const override;
   bool redirects(RequestContext &ctxt) const override;
@@ -57,6 +57,7 @@ class ScramHandler : public SaslHandler {
  private:
   std::string get_salt_for_the_user(const std::string &user_name) const;
   const std::string random_data_;
+  SessionManager *session_manager_;
 };
 
 }  // namespace authentication

router/src/mysql_rest_service/src/mrs/http/session_manager.h

@@ -153,6 +153,17 @@ class SessionManager {
                          const std::string &holder_name);
   SessionPtr new_session(const SessionId &session_id);
 
+  template <class Generator>
+  void set_unique_session_secondary_id(Session *session, const Generator &g) {
+    std::lock_guard<std::mutex> lck{mutex_};
+    std::string id;
+    do {
+      id = g();
+    } while (get_session_handler_specific_id_impl(id));
+
+    session->handler_secondary_id = id;
+  }
+
   void remove_session(const Session::SessionData *session_data);
   bool remove_session(const SessionPtr &session);
   bool remove_session(const SessionId session);

router/src/mysql_rest_service/tests/mock/mock_auth_handler_factory.h

@@ -45,7 +45,7 @@ class MockAuthHandlerFactory : public mrs::interface::AuthHandlerFactory {
               (const, override));
   MOCK_METHOD(AuthHandlerPtr, create_scram_auth_handler,
               (AuthorizeHandlerCallbakcs * cb, const AuthApp &entry,
-               const std::string &rd),
+               const std::string &rd, SessionManager *session_manager),
               (const, override));
 };