Authentication and authorization

[sanikolaev]

Proposal:

Umbrella issue for https://roadmap.mnt.cr/ about authentication and authorization.

Subtasks:

• Authentication and authorization: architecture #2748
• login and rejects via MySQL client with hardcoded user to daemon #2808
• login via HTTP with the basic auth #2834
• add buddy auth manticoresearch-buddy#418
• add login support for API #2846

Added current issues list as separate ticket #2844

Checklist:

^{To be completed by the assignee. Check off tasks that have been completed or are not applicable.}

• Implementation completed
• Tests developed
• Documentation updated
• Documentation reviewed
• Changelog updated
• OpenAPI YAML updated and issue created to rebuild clients

[tomatolog]

Auth SphinxQL interface.

Daemon uses check of the password from the mysql client compatible with the plugin mysql_native_password, ie

mysql -h 127.0.0.1 -P 9306 -u teston -p
Enter password: ****

should work the same was as with regular mysql server.

Added new test options to searchd section auth_user and auth_pass to set user and raw text password for testing like

searchd
{
...
    auth_user = admin
    auth_pass = test123

or use .htpasswd compatible file with the SHA-1 hash like

searchd
{
...
    auth_user_file = /home/user1/.htpasswd

the .htpasswd file should be created like

htpasswd -s -c ~/bin/.htpasswd new_user

and additional users should be added like

htpasswd -s ~/bin/.htpasswd user2

The auth_user and the raw auth_pass should be removed on release of the feature.

[tomatolog]

Basic auth HTTP interface.

If the user added into daemon client must use HTTP Basic access authentication schema, ie for the curl client it works like

curl -X POST "localhost:9312/search" -H "content-type: application/json" -d @gh1594.js  -u test_file:test

[tomatolog]

auth_user_file

daemon works with the auth_user_file as:

• lines with the errors are reported and skipped. At least one valid line is required for daemon to start or daemon fatal exit on startup
• daemon also fatal exit on startup if auth_user_file is set but the daemon failed to open the file
• daemon also fatal exit on startup if auth_user_file permission set to 777

That should prevent cases when the access authentication is required but no valid users loaded.