Merge pull request dexidp#1485 from bonifaido/mysql-storage

MySQL storage - Take 2

.travis.yml

@@ -2,19 +2,39 @@ language: go
 
 sudo: required
 
+dist: xenial
+
 matrix:
   include:
     - go: '1.12.x'
 
 env:
-  global: DEX_POSTGRES_DATABASE=postgres DEX_POSTGRES_USER=postgres DEX_POSTGRES_HOST="localhost" DEX_ETCD_ENDPOINTS=http://localhost:2379 DEX_LDAP_TESTS=1 DEBIAN_FRONTEND=noninteractive DEX_KEYSTONE_URL=http://localhost:5000 DEX_KEYSTONE_ADMIN_URL=http://localhost:35357 DEX_KEYSTONE_ADMIN_USER=demo DEX_KEYSTONE_ADMIN_PASS=DEMO_PASS
+  global:
+    - DEX_MYSQL_DATABASE=dex
+    - DEX_MYSQL_USER=root
+    - DEX_MYSQL_HOST="localhost"
+    - DEX_MYSQL_PASSWORD=""
+    - DEX_POSTGRES_DATABASE=postgres
+    - DEX_POSTGRES_USER=postgres
+    - DEX_POSTGRES_HOST="localhost"
+    - DEX_ETCD_ENDPOINTS=http://localhost:2379
+    - DEX_LDAP_TESTS=1
+    - DEBIAN_FRONTEND=noninteractive
+    - DEX_KEYSTONE_URL=http://localhost:5000
+    - DEX_KEYSTONE_ADMIN_URL=http://localhost:35357
+    - DEX_KEYSTONE_ADMIN_USER=demo
+    - DEX_KEYSTONE_ADMIN_PASS=DEMO_PASS
 
 go_import_path: github.com/dexidp/dex
 
 services:
+  - mysql
   - postgresql
   - docker
 
+before_install:
+  - mysql -e 'CREATE DATABASE dex;'
+
 install:
   - sudo -E apt-get install -y --force-yes slapd time ldap-utils
   - sudo /etc/init.d/slapd stop

Documentation/storage.md

@@ -298,6 +298,35 @@ storage:
 
 The SSL "mode" corresponds to the `github.com/lib/pq` package [connection options][psql-conn-options]. If unspecified, dex defaults to the strictest mode "verify-full".
 
+### MySQL
+
+Dex requires MySQL 5.7 or later version. When using MySQL, admins may want to dedicate a database to dex for the following reasons:
+
+1. Dex requires privileged access to its database because it performs migrations.
+2. Dex's database table names are not configurable; when shared with other applications there may be table name clashes.
+
+```
+CREATE DATABASE dex_db;
+CREATE USER dex WITH PASSWORD '66964843358242dbaaa7778d8477c288';
+GRANT ALL PRIVILEGES ON DATABASE dex_db TO dex;
+```
+
+An example config for MySQL setup using these values:
+
+```
+storage:
+  type: mysql
+  config:
+    database: dex_db
+    user: dex
+    password: 66964843358242dbaaa7778d8477c288
+    ssl:
+      mode: custom
+      caFile: /etc/dex/mysql.ca
+```
+
+The SSL "mode" corresponds to the `github.com/go-sql-driver/mysql` package [connection options][mysql-conn-options]. If unspecified, dex defaults to the strictest mode "true".
+
 ## Adding a new storage options
 
 Each storage implementation bears a large ongoing maintenance cost and needs to be updated every time a feature requires storing a new type. Bugs often require in depth knowledge of the backing software, and much of this work will be done by developers who are not the original author. Changes to dex which add new storage implementations are not merged lightly.
@@ -320,4 +349,5 @@ Any proposal to add a new implementation must address the following:
 [issues-transaction-tests]: https://github.com/dexidp/dex/issues/600
 [k8s-api]: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/api-conventions.md#concurrency-control-and-consistency
 [psql-conn-options]: https://godoc.org/github.com/lib/pq#hdr-Connection_String_Parameters
+[mysql-conn-options]: https://github.com/go-sql-driver/mysql#tls
 [crd]: https://kubernetes.io/docs/tasks/access-kubernetes-api/extend-api-custom-resource-definitions/

cmd/dex/config.go

@@ -136,6 +136,7 @@ var storages = map[string]func() StorageConfig{
 	"memory":     func() StorageConfig { return new(memory.Config) },
 	"sqlite3":    func() StorageConfig { return new(sql.SQLite3) },
 	"postgres":   func() StorageConfig { return new(sql.Postgres) },
+	"mysql":      func() StorageConfig { return new(sql.MySQL) },
 }
 
 // UnmarshalJSON allows Storage to implement the unmarshaler interface to

cmd/dex/config_test.go

@@ -76,12 +76,14 @@ logger:
 		Storage: Storage{
 			Type: "postgres",
 			Config: &sql.Postgres{
-				Host:              "10.0.0.1",
-				Port:              65432,
-				MaxOpenConns:      5,
-				MaxIdleConns:      3,
-				ConnMaxLifetime:   30,
-				ConnectionTimeout: 3,
+				NetworkDB: sql.NetworkDB{
+					Host:              "10.0.0.1",
+					Port:              65432,
+					MaxOpenConns:      5,
+					MaxIdleConns:      3,
+					ConnMaxLifetime:   30,
+					ConnectionTimeout: 3,
+				},
 			},
 		},
 		Web: Web{

go.mod

@@ -5,6 +5,7 @@ require (
 	github.com/beorn7/perks v0.0.0-20160229213445-3ac7bf7a47d1 // indirect
 	github.com/boltdb/bolt v1.3.1 // indirect
 	github.com/cockroachdb/cmux v0.0.0-20170110192607-30d10be49292 // indirect
+	github.com/coreos/dex v2.13.0+incompatible // indirect
 	github.com/coreos/etcd v3.2.9+incompatible
 	github.com/coreos/go-oidc v2.0.0+incompatible
 	github.com/coreos/go-semver v0.2.0 // indirect
@@ -14,6 +15,7 @@ require (
 	github.com/dgrijalva/jwt-go v3.2.0+incompatible // indirect
 	github.com/felixge/httpsnoop v1.0.0
 	github.com/ghodss/yaml v0.0.0-20161020005002-bea76d6a4713
+	github.com/go-sql-driver/mysql v1.4.1
 	github.com/gogo/protobuf v1.1.1 // indirect
 	github.com/golang/groupcache v0.0.0-20181024230925-c65c006176ff // indirect
 	github.com/golang/protobuf v0.0.0-20171113180720-1e59b77b52bf

go.sum

@@ -6,6 +6,8 @@ github.com/boltdb/bolt v1.3.1 h1:JQmyP4ZBrce+ZQu0dY660FMfatumYDLun9hBCUVIkF4=
 github.com/boltdb/bolt v1.3.1/go.mod h1:clJnj/oiGkjum5o1McbSZDSLxVThjynRyGBgiAx27Ps=
 github.com/cockroachdb/cmux v0.0.0-20170110192607-30d10be49292 h1:dzj1/xcivGjNPwwifh/dWTczkwcuqsXXFHY1X/TZMtw=
 github.com/cockroachdb/cmux v0.0.0-20170110192607-30d10be49292/go.mod h1:qRiX68mZX1lGBkTWyp3CLcenw9I94W2dLeRvMzcn9N4=
+github.com/coreos/dex v2.13.0+incompatible h1:iwTFQFV7PnQ91+vSVhXGWdzEcF4I+U52DgEGDrwGWfk=
+github.com/coreos/dex v2.13.0+incompatible/go.mod h1:eWiVFa+I1sIRiwXi4bJMZvd90+H7EhRm/J1Y6Y18AOM=
 github.com/coreos/etcd v3.2.9+incompatible h1:3TbjfK5+aSRLTU/KgBC1xlgA2dn2ddYQngRqX6HFwlQ=
 github.com/coreos/etcd v3.2.9+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-oidc v2.0.0+incompatible h1:+RStIopZ8wooMx+Vs5Bt8zMXxV1ABl5LbakNExNmZIg=
@@ -24,6 +26,8 @@ github.com/felixge/httpsnoop v1.0.0 h1:gh8fMGz0rlOv/1WmRZm7OgncIOTsAj21iNJot48om
 github.com/felixge/httpsnoop v1.0.0/go.mod h1:3+D9sFq0ahK/JeJPhCBUV1xlf4/eIYrUQaxulT0VzX8=
 github.com/ghodss/yaml v0.0.0-20161020005002-bea76d6a4713 h1:ag3kFMoZZMrEBi4ySTdSWSPz8K7Slu++J9/QXzLBiLk=
 github.com/ghodss/yaml v0.0.0-20161020005002-bea76d6a4713/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-sql-driver/mysql v1.4.1 h1:g24URVg0OFbNUTx9qqY1IRZ9D9z3iPyi5zKhQZpNwpA=
+github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/gogo/protobuf v1.1.1 h1:72R+M5VuhED/KujmZVcIquuo8mBgX4oVda//DQb3PXo=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/golang/groupcache v0.0.0-20181024230925-c65c006176ff h1:kOkM9whyQYodu09SJ6W3NCsHG7crFaJILQ22Gozp3lg=

storage/sql/config.go

@@ -1,14 +1,18 @@
 package sql
 
 import (
+	"crypto/tls"
+	"crypto/x509"
 	"database/sql"
 	"fmt"
+	"io/ioutil"
 	"net"
 	"regexp"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/go-sql-driver/mysql"
 	"github.com/lib/pq"
 	sqlite3 "github.com/mattn/go-sqlite3"
 
@@ -21,6 +25,12 @@ const (
 	pgErrUniqueViolation = "23505" // unique_violation
 )
 
+const (
+	// MySQL error codes
+	mysqlErrDupEntry            = 1062
+	mysqlErrDupEntryWithKeyName = 1586
+)
+
 // SQLite3 options for creating an SQL db.
 type SQLite3 struct {
 	// File to
@@ -63,31 +73,29 @@ func (s *SQLite3) open(logger log.Logger) (*conn, error) {
 }
 
 const (
-	sslDisable    = "disable"
-	sslRequire    = "require"
-	sslVerifyCA   = "verify-ca"
-	sslVerifyFull = "verify-full"
+	// postgres SSL modes
+	pgSSLDisable    = "disable"
+	pgSSLRequire    = "require"
+	pgSSLVerifyCA   = "verify-ca"
+	pgSSLVerifyFull = "verify-full"
 )
 
-// PostgresSSL represents SSL options for Postgres databases.
-type PostgresSSL struct {
-	Mode   string
-	CAFile string
-	// Files for client auth.
-	KeyFile  string
-	CertFile string
-}
+const (
+	// MySQL SSL modes
+	mysqlSSLTrue       = "true"
+	mysqlSSLFalse      = "false"
+	mysqlSSLSkipVerify = "skip-verify"
+	mysqlSSLCustom     = "custom"
+)
 
-// Postgres options for creating an SQL db.
-type Postgres struct {
+// NetworkDB contains options common to SQL databases accessed over network.
+type NetworkDB struct {
 	Database string
 	User     string
 	Password string
 	Host     string
 	Port     uint16
 
-	SSL PostgresSSL `json:"ssl" yaml:"ssl"`
-
 	ConnectionTimeout int // Seconds
 
 	// database/sql tunables, see
@@ -98,9 +106,25 @@ type Postgres struct {
 	ConnMaxLifetime int // Seconds, default: not set
 }
 
+// SSL represents SSL options for network databases.
+type SSL struct {
+	Mode   string
+	CAFile string
+	// Files for client auth.
+	KeyFile  string
+	CertFile string
+}
+
+// Postgres options for creating an SQL db.
+type Postgres struct {
+	NetworkDB
+
+	SSL SSL `json:"ssl" yaml:"ssl"`
+}
+
 // Open creates a new storage implementation backed by Postgres.
 func (p *Postgres) Open(logger log.Logger) (storage.Storage, error) {
-	conn, err := p.open(logger, p.createDataSourceName())
+	conn, err := p.open(logger)
 	if err != nil {
 		return nil, err
 	}
@@ -159,7 +183,7 @@ func (p *Postgres) createDataSourceName() string {
 
 	if p.SSL.Mode == "" {
 		// Assume the strictest mode if unspecified.
-		addParam("sslmode", dataSourceStr(sslVerifyFull))
+		addParam("sslmode", dataSourceStr(pgSSLVerifyFull))
 	} else {
 		addParam("sslmode", dataSourceStr(p.SSL.Mode))
 	}
@@ -179,7 +203,9 @@ func (p *Postgres) createDataSourceName() string {
 	return strings.Join(parameters, " ")
 }
 
-func (p *Postgres) open(logger log.Logger, dataSourceName string) (*conn, error) {
+func (p *Postgres) open(logger log.Logger) (*conn, error) {
+	dataSourceName := p.createDataSourceName()
+
 	db, err := sql.Open("postgres", dataSourceName)
 	if err != nil {
 		return nil, err
@@ -216,3 +242,108 @@ func (p *Postgres) open(logger log.Logger, dataSourceName string) (*conn, error)
 	}
 	return c, nil
 }
+
+// MySQL options for creating a MySQL db.
+type MySQL struct {
+	NetworkDB
+
+	SSL SSL `json:"ssl" yaml:"ssl"`
+
+	// TODO(pborzenkov): used by tests to reduce lock wait timeout. Should
+	// we make it exported and allow users to provide arbitrary params?
+	params map[string]string
+}
+
+// Open creates a new storage implementation backed by MySQL.
+func (s *MySQL) Open(logger log.Logger) (storage.Storage, error) {
+	conn, err := s.open(logger)
+	if err != nil {
+		return nil, err
+	}
+	return conn, nil
+}
+
+func (s *MySQL) open(logger log.Logger) (*conn, error) {
+	cfg := mysql.Config{
+		User:                 s.User,
+		Passwd:               s.Password,
+		DBName:               s.Database,
+		AllowNativePasswords: true,
+
+		Timeout: time.Second * time.Duration(s.ConnectionTimeout),
+
+		ParseTime: true,
+		Params: map[string]string{
+			"transaction_isolation": "'SERIALIZABLE'",
+		},
+	}
+	if s.Host != "" {
+		if s.Host[0] != '/' {
+			cfg.Net = "tcp"
+			cfg.Addr = s.Host
+		} else {
+			cfg.Net = "unix"
+			cfg.Addr = s.Host
+		}
+	}
+	if s.SSL.CAFile != "" || s.SSL.CertFile != "" || s.SSL.KeyFile != "" {
+		if err := s.makeTLSConfig(); err != nil {
+			return nil, fmt.Errorf("failed to make TLS config: %v", err)
+		}
+		cfg.TLSConfig = mysqlSSLCustom
+	} else if s.SSL.Mode == "" {
+		cfg.TLSConfig = mysqlSSLTrue
+	} else {
+		cfg.TLSConfig = s.SSL.Mode
+	}
+	for k, v := range s.params {
+		cfg.Params[k] = v
+	}
+
+	db, err := sql.Open("mysql", cfg.FormatDSN())
+	if err != nil {
+		return nil, err
+	}
+
+	errCheck := func(err error) bool {
+		sqlErr, ok := err.(*mysql.MySQLError)
+		if !ok {
+			return false
+		}
+		return sqlErr.Number == mysqlErrDupEntry ||
+			sqlErr.Number == mysqlErrDupEntryWithKeyName
+	}
+
+	c := &conn{db, flavorMySQL, logger, errCheck}
+	if _, err := c.migrate(); err != nil {
+		return nil, fmt.Errorf("failed to perform migrations: %v", err)
+	}
+	return c, nil
+}
+
+func (s *MySQL) makeTLSConfig() error {
+	cfg := &tls.Config{}
+	if s.SSL.CAFile != "" {
+		rootCertPool := x509.NewCertPool()
+		pem, err := ioutil.ReadFile(s.SSL.CAFile)
+		if err != nil {
+			return err
+		}
+		if ok := rootCertPool.AppendCertsFromPEM(pem); !ok {
+			return fmt.Errorf("failed to append PEM")
+		}
+		cfg.RootCAs = rootCertPool
+	}
+	if s.SSL.CertFile != "" && s.SSL.KeyFile != "" {
+		clientCert := make([]tls.Certificate, 0, 1)
+		certs, err := tls.LoadX509KeyPair(s.SSL.CertFile, s.SSL.KeyFile)
+		if err != nil {
+			return err
+		}
+		clientCert = append(clientCert, certs)
+		cfg.Certificates = clientCert
+	}
+
+	mysql.RegisterTLSConfig(mysqlSSLCustom, cfg)
+	return nil
+}