Merge lp:~sergei.glushchenko/percona-pam-for-mysql/two-plugins into lp:percona-pam-for-mysql

[Sergei Glushchenko]

Full-featured PAM auth server plugin was split into two parts.
First one is generic PAM conversation function, second one performs
client-specific message sending and receiving.
(auth_pam_common.c and auth_pam.c) modules. Oracle-compatible
server-side plugin was implemented (auth_pam_compat.c).
Both plugins use auth_pam_common.c. All client-specific behavior
localized in auth_pam.c and auth_pam_compat.c.

auth_pam_compat plugin do not support dialog with client and the only
way to specify password with *mysql* client is using -p option.

Example:
mysql -u test -p111

or
mysql -u test -p
Enter password:

Besides there is no visible difference between case when -p option
used and when it not. So password_used is always set to
PASSWORD_USED_NO_MENTION.

[Laurynas Biveinis (laurynas-biveinis)]

LGTM, thank you.

review: Approve

=== modified file 'CMakeLists.txt'
--- CMakeLists.txt	2012-02-09 16:25:22 +0000
+++ CMakeLists.txt	2012-02-13 06:42:18 +0000
@@ -19,9 +19,12 @@
 CHECK_SYMBOL_EXISTS(getpwnam_r "pwd.h" HAVE_GETPWNAM_R)
 CHECK_SYMBOL_EXISTS(getgrgid_r "grp.h" HAVE_GETGRGID_R)
 IF(HAVE_PAM AND HAVE_MYSQLCLIENT AND HAVE_GETPWNAM_R AND HAVE_GETGRGID_R)
-  SET(AUTH_PAM_SOURCES 
-    src/auth_pam.c src/lib_auth_pam_client.c src/lib_auth_pam_client.h
+  SET(AUTH_PAM_COMMON_SOURCES 
+    src/auth_pam_common.c src/lib_auth_pam_client.c src/lib_auth_pam_client.h
     src/auth_mapping.h src/auth_mapping.c)
+  SET(AUTH_PAM_SOURCES ${AUTH_PAM_COMMON_SOURCES} src/auth_pam.c)
+  SET(AUTH_PAM_COMPAT_SOURCES ${AUTH_PAM_COMMON_SOURCES} src/auth_pam_compat.c)
   MYSQL_ADD_PLUGIN(auth_pam ${AUTH_PAM_SOURCES} LINK_LIBRARIES pam)
+  MYSQL_ADD_PLUGIN(auth_pam_compat ${AUTH_PAM_COMPAT_SOURCES} LINK_LIBRARIES pam)
   MYSQL_ADD_PLUGIN(dialog src/dialog.c LINK_LIBRARIES mysqlclient)
 ENDIF(HAVE_PAM AND HAVE_MYSQLCLIENT AND HAVE_GETPWNAM_R AND HAVE_GETGRGID_R)
 
=== modified file 'src/Makefile.am'
--- src/Makefile.am	2012-02-10 04:21:32 +0000
+++ src/Makefile.am	2012-02-13 06:42:18 +0000
@@ -16,14 +16,18 @@
 
 plugindir = @PLUGINDIR@
 
-plugin_LTLIBRARIES = auth_pam.la test_auth_pam_client.la dialog.la
+plugin_LTLIBRARIES = auth_pam.la auth_pam_compat.la test_auth_pam_client.la dialog.la
 plugin_CPPFLAGS = -DMYSQL_DYNAMIC_PLUGIN
 plugin_LDFLAGS = -module -avoid-version -shared
 
-auth_pam_la_SOURCES = auth_pam.c lib_auth_pam_client.h lib_auth_pam_client.c auth_mapping.c
+auth_pam_la_SOURCES = auth_pam_common.c auth_pam.c lib_auth_pam_client.h lib_auth_pam_client.c auth_mapping.c
 auth_pam_la_CPPFLAGS = $(plugin_CPPFLAGS)
 auth_pam_la_LDFLAGS = $(plugin_LDFLAGS) $(AUTH_PAM_LIBS)
 
+auth_pam_compat_la_SOURCES = auth_pam_common.c auth_pam_compat.c lib_auth_pam_client.h lib_auth_pam_client.c auth_mapping.c
+auth_pam_compat_la_CPPFLAGS = $(plugin_CPPFLAGS)
+auth_pam_compat_la_LDFLAGS = $(plugin_LDFLAGS) $(AUTH_PAM_LIBS)
+
 test_auth_pam_client_la_SOURCES = test_auth_pam_client.c \
 	lib_auth_pam_client.h lib_auth_pam_client.c
 test_auth_pam_client_la_LDFLAGS = $(plugin_LDFLAGS)
 
=== modified file 'src/auth_mapping.h'
--- src/auth_mapping.h	2012-02-09 16:25:22 +0000
+++ src/auth_mapping.h	2012-02-13 06:42:18 +0000
@@ -20,9 +20,8 @@
 /**
  @file
 
- PAM authentication for MySQL, common definitions for side plugins.
+ PAM authentication for MySQL, interface for user mapping.
 
- For the general description, see the top comment in auth_pam.c.
 */
 
 #ifdef __cplusplus
 
=== added file 'src/auth_pam.c'
--- src/auth_pam.c	1970-01-01 00:00:00 +0000
+++ src/auth_pam.c	2012-02-13 06:42:18 +0000
@@ -0,0 +1,175 @@
+/*
+(C) 2012 Percona Inc.
+
+This program is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; version 2 of the License.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; if not, write to the Free Software
+Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+*/
+
+/**
+ @file
+
+ PAM authentication for MySQL, server-side plugin for the
+ production use.
+
+ A general-purpose PAM authentication plugin for MySQL.  Acts as a mediator
+ between the MySQL server, the MySQL client, and the PAM backend. Dialog plugin
+ used as client plugin.
+
+ The server plugin requests authentication from the PAM backend, forwards any
+ requests and messages from the PAM backend over the wire to the client (in
+ cleartext) and reads back any replies for the backend.
+
+ This plugin does not encrypt the communication channel in any way.  If this is
+ required, a SSL connection should be used.
+
+ To install this plugin, copy the .so file to the plugin directory and do
+
+ INSTALL PLUGIN auth_pam SONAME 'auth_pam.so';
+
+ To use this plugin for one particular user, specify it at user's creation time
+ (TODO: tested with localhost only):
+
+ CREATE USER 'username'@'hostname' IDENTIFIED WITH auth_pam;
+
+ Alternatively UPDATE the mysql.user table to set the plugin value for an
+ existing user.
+
+ Also it is possible to use this plugin to authenticate anonymous users:
+
+ CREATE USER ''@'hostname' IDENTIFIED WITH auth_pam;
+
+*/
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "auth_pam_common.h"
+
+/** The maximum length of buffered PAM messages, i.e. any messages up to the
+    next PAM reply-requiring message. 10K should be more than enough by order
+    of magnitude. */
+enum { max_pam_buffered_msg_len = 10240 };
+
+struct pam_msg_buf {
+    unsigned char buf[max_pam_buffered_msg_len];
+    unsigned char* ptr;
+};
+
+static char pam_msg_style_to_char (int pam_msg_style)
+{
+  /* Magic byte for the dialog plugin, '\2' is defined as ORDINARY_QUESTION
+     and '\4' as PASSWORD_QUESTION there. */
+  return (pam_msg_style == PAM_PROMPT_ECHO_ON) ? '\2' : '\4';
+}
+
+int auth_pam_client_talk_init(void **talk_data)
+{
+  struct pam_msg_buf *msg_buf= calloc(1, sizeof(struct pam_msg_buf));
+  *talk_data= (void*)msg_buf;
+  if (msg_buf != NULL)
+  {
+    msg_buf->ptr= msg_buf->buf + 1;
+    return PAM_SUCCESS;
+  }
+  return PAM_BUF_ERR;
+}
+
+void auth_pam_client_talk_finalize(void *talk_data)
+{
+  free(talk_data);
+}
+
+int auth_pam_talk_perform(const struct pam_message *msg,
+                          struct pam_response *resp,
+                          struct pam_conv_data *data,
+                          void *talk_data)
+{
+  struct pam_msg_buf *msg_buf= (struct pam_msg_buf*)talk_data;
+
+  /* Append the PAM message or prompt to the unsent message buffer */
+  if (msg->msg)
+  {
+    unsigned char *last_buf_pos = msg_buf->buf + max_pam_buffered_msg_len - 1;
+    if (msg_buf->ptr + strlen(msg->msg) >= last_buf_pos)
+    {
+      /* Cannot happen: the PAM message buffer too small. */
+      MY_ASSERT_UNREACHABLE();
+      return PAM_CONV_ERR;
+    }
+    memcpy(msg_buf->ptr, msg->msg, strlen(msg->msg));
+    msg_buf->ptr+= strlen(msg->msg);
+    *(msg_buf->ptr)++= '\n';
+  }
+
+  if (msg->msg_style == PAM_PROMPT_ECHO_OFF
+      || msg->msg_style == PAM_PROMPT_ECHO_ON)
+  {
+    int pkt_len;
+    unsigned char *pkt;
+
+    msg_buf->buf[0]= pam_msg_style_to_char(msg->msg_style);
+
+    /* Write the message.  */
+    if (data->vio->write_packet(data->vio, msg_buf->buf,
+                                msg_buf->ptr - msg_buf->buf - 1))
+      return PAM_CONV_ERR;
+
+    /* Read the answer */
+    if ((pkt_len= data->vio->read_packet(data->vio, &pkt))
+        < 0)
+      return PAM_CONV_ERR;
+
+    resp->resp= malloc(pkt_len + 1);
+    if (resp->resp == NULL)
+      return PAM_BUF_ERR;
+
+    strncpy(resp->resp, (char *)pkt, pkt_len);
+    resp->resp[pkt_len]= '\0';
+
+    if (msg->msg_style == PAM_PROMPT_ECHO_OFF)
+      data->info->password_used= PASSWORD_USED_YES;
+
+    msg_buf->ptr= msg_buf->buf + 1;
+  }
+
+  return PAM_SUCCESS;
+}
+
+static struct st_mysql_auth pam_auth_handler=
+{
+  MYSQL_AUTHENTICATION_INTERFACE_VERSION,
+  "dialog",
+  &authenticate_user_with_pam_server
+};
+
+mysql_declare_plugin(auth_pam)
+{
+  MYSQL_AUTHENTICATION_PLUGIN,
+  &pam_auth_handler,
+  "auth_pam",
+  "Percona, Inc.",
+  "PAM authentication plugin",
+  PLUGIN_LICENSE_GPL,
+  NULL,
+  NULL,
+  0x0001,
+  NULL,
+  NULL,
+  NULL
+#if MYSQL_PLUGIN_INTERFACE_VERSION >= 0x103
+  ,
+  0
+#endif
+}
+mysql_declare_plugin_end;
 
=== renamed file 'src/auth_pam.c' => 'src/auth_pam_common.c'
--- src/auth_pam.c	2012-02-09 16:25:22 +0000
+++ src/auth_pam_common.c	2012-02-13 06:42:18 +0000
@@ -15,69 +15,11 @@
 Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 */
 
-/**
- @file
-
- PAM authentication for MySQL, server- and client-side plugins for the
- production use.
-
- A general-purpose PAM authentication plugin for MySQL.  Acts as a mediator
- between the MySQL server, the MySQL client, and the PAM backend.  Consists of
- both the server and the client plugin.
-
- The server plugin requests authentication from the PAM backend, forwards any
- requests and messages from the PAM backend over the wire to the client (in
- cleartext) and reads back any replies for the backend.
-
- The client plugin inputs from the TTY any requested info/passwords as
- requested and sends them back over the wire to the server.
-
- This plugin does not encrypt the communication channel in any way.  If this is
- required, a SSL connection should be used.
-
- To install this plugin, copy the .so file to the plugin directory and do
-
- INSTALL PLUGIN auth_pam SONAME 'auth_pam.so';
-
- To use this plugin for one particular user, specify it at user's creation time
- (TODO: tested with localhost only):
-
- CREATE USER 'username'@'hostname' IDENTIFIED WITH auth_pam;
-
- Alternatively UPDATE the mysql.user table to set the plugin value for an
- existing user.
-
- Also it is possible to use this plugin to authenticate anonymous users:
-
- CREATE USER ''@'hostname' IDENTIFIED WITH auth_pam;
-
-*/
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 
-#include <assert.h>
-
-#include <security/pam_appl.h>
-#include <security/pam_modules.h>
-#include <security/pam_misc.h>
-
-/* Define these macros ourselves, so we don't have to include my_global.h and
-can compile against unconfigured MySQL source tree.  */
-#define STDCALL
-
-#define MY_ASSERT_UNREACHABLE() assert(0)
-
-#include <mysql/plugin.h>
-#include <mysql/plugin_auth.h>
-#include <mysql/client_plugin.h>
-
-#ifdef HAVE_GETPASS
-#include <unistd.h> /* getpass() */
-#else
-#error "Please add support for echo-less input for your platform"
-#endif
-
+#include "auth_pam_common.h"
 #include "auth_mapping.h"
 
 /* The server plugin */
@@ -99,37 +41,10 @@
   }
 }
 
-static char pam_msg_style_to_char (int pam_msg_style)
-{
-  /* Do not use any of MySQL client-server protocol reserved values, i.e. \0 */
-  switch (pam_msg_style)
-  {
-  case PAM_PROMPT_ECHO_OFF: return '\2';
-  case PAM_PROMPT_ECHO_ON:  return '\3';
-  case PAM_ERROR_MSG:       return '\4';
-  case PAM_TEXT_INFO:       return '\5';
-  default:
-    MY_ASSERT_UNREACHABLE();
-    return '\1';
-  }
-}
-
-/** The maximum length of buffered PAM messages, i.e. any messages up to the
-    next PAM reply-requiring message. 10K should be more than enough by order
-    of magnitude. */
-enum { max_pam_buffered_msg_len = 10240 };
-
 /** The maximum length of service name. It shouldn't be too long as it's
     filename in pam.d directory also */
 enum { max_pam_service_name_len = 64 };
 
-struct pam_conv_data {
-    MYSQL_PLUGIN_VIO *vio;
-    MYSQL_SERVER_AUTH_INFO *info;
-    unsigned char buf[max_pam_buffered_msg_len];
-    unsigned char* ptr;
-};
-
 static void free_pam_response (struct pam_response ** resp, int n)
 {
   int i;
@@ -145,6 +60,8 @@
                             struct pam_response ** resp, void *appdata_ptr)
 {
   int i;
+  int error;
+  void *talk_data;
   struct pam_conv_data *data= (struct pam_conv_data *)appdata_ptr;
 
   if (data == NULL)
@@ -157,80 +74,39 @@
   if (*resp == NULL)
     return PAM_BUF_ERR;
 
+  error= auth_pam_client_talk_init(&talk_data);
+  if (error != PAM_SUCCESS)
+  {
+    free_pam_response(resp, 0);
+    return error;
+  }
+
   for (i = 0; i < num_msg; i++)
   {
     if (!valid_pam_msg_style(msg[i]->msg_style))
     {
+      auth_pam_client_talk_finalize(talk_data);
       free_pam_response(resp, i);
       return PAM_CONV_ERR;
     }
 
-    /* Append the PAM message or prompt to the unsent message buffer */
-    if (msg[i]->msg)
-    {
-      unsigned char *last_buf_pos = data->buf + max_pam_buffered_msg_len - 1;
-      if (data->ptr + strlen(msg[i]->msg) >= last_buf_pos)
-      {
-        free_pam_response(resp, i);
-        /* Cannot happen: the PAM message buffer too small. */
-        MY_ASSERT_UNREACHABLE();
-        return PAM_CONV_ERR;
-      }
-      memcpy(data->ptr, msg[i]->msg, strlen(msg[i]->msg));
-      data->ptr+= strlen(msg[i]->msg);
-      *(data->ptr)++= '\n';
-    }
-
-    if (msg[i]->msg_style == PAM_PROMPT_ECHO_OFF
-        || msg[i]->msg_style == PAM_PROMPT_ECHO_ON)
-    {
-      int pkt_len;
-      unsigned char *pkt;
-
-      /* Magic byte for the dialog plugin, '\2' is defined as ORDINARY_QUESTION
-         and '\4' as PASSWORD_QUESTION there. */
-      data->buf[0]= (msg[i]->msg_style == PAM_PROMPT_ECHO_ON ? '\2' : '\4');
-
-      /* Write the message.  */
-      if (data->vio->write_packet(data->vio, data->buf,
-                                  data->ptr - data->buf - 1))
-      {
-        free_pam_response(resp, i);
-        return PAM_CONV_ERR;
-      }
-
-      /* Read the answer */
-      if ((pkt_len= data->vio->read_packet(data->vio, &pkt))
-          < 0)
-      {
-        free_pam_response(resp, i);
-        return PAM_CONV_ERR;
-      }
-
-      (*resp)[i].resp= malloc(pkt_len + 1);
-      if ((*resp)[i].resp == NULL)
-      {
-        free_pam_response(resp, i);
-        return PAM_BUF_ERR;
-      }
-
-      strncpy((*resp)[i].resp, (char *)pkt, pkt_len);
-      (*resp)[i].resp[pkt_len]= '\0';
-
-      if (msg[i]->msg_style == PAM_PROMPT_ECHO_OFF)
-        data->info->password_used= PASSWORD_USED_YES;
-
-      data->ptr= data->buf + 1;
+    error= auth_pam_talk_perform(msg[i], resp[i], data, talk_data);
+    if (error != PAM_SUCCESS)
+    {
+      auth_pam_client_talk_finalize(talk_data);
+      free_pam_response(resp, i);
+      return error;
     }
   }
+  auth_pam_client_talk_finalize(talk_data);
   return PAM_SUCCESS;
 }
 
-static int authenticate_user_with_pam_server (MYSQL_PLUGIN_VIO *vio,
-                                              MYSQL_SERVER_AUTH_INFO *info)
+int authenticate_user_with_pam_server (MYSQL_PLUGIN_VIO *vio,
+                                       MYSQL_SERVER_AUTH_INFO *info)
 {
   pam_handle_t *pam_handle;
-  struct pam_conv_data data= { vio, info, "", data.buf+1 };
+  struct pam_conv_data data= { vio, info };
   struct pam_conv conv_func_info= { &vio_server_conv, &data };
   int error;
   char *pam_mapped_user_name;
@@ -312,57 +188,3 @@
 
   return CR_OK;
 }
-
-static struct st_mysql_auth pam_auth_handler=
-{
-  MYSQL_AUTHENTICATION_INTERFACE_VERSION,
-  "dialog",
-  &authenticate_user_with_pam_server
-};
-
-static struct st_mysql_auth test_pam_auth_handler=
-{
-  MYSQL_AUTHENTICATION_INTERFACE_VERSION,
-  "auth_pam_test",
-  &authenticate_user_with_pam_server
-};
-
-mysql_declare_plugin(auth_pam)
-{
-  MYSQL_AUTHENTICATION_PLUGIN,
-  &pam_auth_handler,
-  "auth_pam",
-  "Percona, Inc.",
-  "PAM authentication plugin",
-  PLUGIN_LICENSE_GPL,
-  NULL,
-  NULL,
-  0x0001,
-  NULL,
-  NULL,
-  NULL
-#if MYSQL_PLUGIN_INTERFACE_VERSION >= 0x103
-  ,
-  0
-#endif
-},
-{
-  MYSQL_AUTHENTICATION_PLUGIN,
-  &test_pam_auth_handler,
-  "test_auth_pam_server",
-  "Percona, Inc.",
-  "PAM authentication plugin that requests the test version of the"
-  " client-side plugin. DO NOT USE IN PRODUCTION.",
-  PLUGIN_LICENSE_GPL,
-  NULL,
-  NULL,
-  0x0001,
-  NULL,
-  NULL,
-  NULL
-#if MYSQL_PLUGIN_INTERFACE_VERSION >= 0x103
-  ,
-  0
-#endif
-}
-mysql_declare_plugin_end;
 
=== added file 'src/auth_pam_common.h'
--- src/auth_pam_common.h	1970-01-01 00:00:00 +0000
+++ src/auth_pam_common.h	2012-02-13 06:42:18 +0000
@@ -0,0 +1,71 @@
+#ifndef AUTH_PAM_COMMON_INCLUDED
+#define AUTH_PAM_COMMON_INCLUDED
+/*
+  (C) 2012 Percona Inc.
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; version 2 of the License.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+*/
+
+/**
+ @file
+
+ PAM authentication for MySQL, common definitions for side plugins.
+
+ For the general description, see the top comment in auth_pam_common.c.
+*/
+
+/* Define these macros ourselves, so we don't have to include my_global.h and
+can compile against unconfigured MySQL source tree.  */
+#define STDCALL
+
+#include <security/pam_appl.h>
+#include <security/pam_modules.h>
+#include <security/pam_misc.h>
+
+#include <mysql/plugin.h>
+#include <mysql/plugin_auth.h>
+#include <mysql/client_plugin.h>
+
+#include <assert.h>
+
+#define MY_ASSERT_UNREACHABLE() assert(0)
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct pam_conv_data {
+    MYSQL_PLUGIN_VIO *vio;
+    MYSQL_SERVER_AUTH_INFO *info;
+};
+
+/** Define following three functions for your specific client plugin */
+
+int auth_pam_client_talk_init(void **talk_data);
+
+int auth_pam_talk_perform(const struct pam_message *msg,
+                          struct pam_response *resp,
+                          struct pam_conv_data *data,
+                          void *talk_data);
+
+void auth_pam_client_talk_finalize(void *talk_data);
+
+int authenticate_user_with_pam_server (MYSQL_PLUGIN_VIO *vio,
+                                       MYSQL_SERVER_AUTH_INFO *info);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
 
=== added file 'src/auth_pam_compat.c'
--- src/auth_pam_compat.c	1970-01-01 00:00:00 +0000
+++ src/auth_pam_compat.c	2012-02-13 06:42:18 +0000
@@ -0,0 +1,131 @@
+/*
+(C) 2012 Percona Inc.
+
+This program is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; version 2 of the License.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; if not, write to the Free Software
+Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+*/
+
+/**
+ @file
+
+ PAM authentication for MySQL, server-side plugin for the
+ production use.
+
+ Oracle MySQL-compatible plugin.  Acts as a mediator
+ between the MySQL server, the MySQL client, and the PAM backend.
+
+ The server plugin requests authentication from the PAM backend, and reads one
+ phrase from client plugin. mysql_clear_password plugin used as client plugin.
+
+ This plugin does not encrypt the communication channel in any way.  If this is
+ required, a SSL connection should be used.
+
+ To install this plugin, copy the .so file to the plugin directory and do
+
+ INSTALL PLUGIN auth_pam SONAME 'auth_pam_compat.so';
+
+ To use this plugin for one particular user, specify it at user's creation time
+ (TODO: tested with localhost only):
+
+ CREATE USER 'username'@'hostname' IDENTIFIED WITH auth_pam_compat;
+
+ Alternatively UPDATE the mysql.user table to set the plugin value for an
+ existing user.
+
+ Also it is possible to use this plugin to authenticate anonymous users:
+
+ CREATE USER ''@'hostname' IDENTIFIED WITH auth_pam_compat;
+
+*/
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "auth_pam_common.h"
+
+int auth_pam_client_talk_init(void **talk_data)
+{
+  int *num_talks= calloc(1, sizeof(int));
+  *talk_data= (void*)num_talks;
+  return (num_talks != NULL) ? PAM_SUCCESS : PAM_BUF_ERR;
+}
+
+void auth_pam_client_talk_finalize(void *talk_data)
+{
+  free(talk_data);
+}
+
+int auth_pam_talk_perform(const struct pam_message *msg,
+                          struct pam_response *resp,
+                          struct pam_conv_data *data,
+                          void *talk_data)
+{
+  int pkt_len;
+  unsigned char *pkt;
+  int *num_talks= (int*)talk_data;
+
+  if (msg->msg_style == PAM_PROMPT_ECHO_OFF
+      || msg->msg_style == PAM_PROMPT_ECHO_ON)
+  {
+    /* mysql_clear_password plugin has support for only single phrase */
+    if (*num_talks > 1)
+      return PAM_CONV_ERR;
+
+    /* Read the answer */
+    if ((pkt_len= data->vio->read_packet(data->vio, &pkt))
+        < 0)
+      return PAM_CONV_ERR;
+
+    resp->resp= malloc(pkt_len + 1);
+    if (resp->resp == NULL)
+      return PAM_BUF_ERR;
+
+    strncpy(resp->resp, (char *)pkt, pkt_len);
+    resp->resp[pkt_len]= '\0';
+
+    /* we could only guess whether password was used or not */
+    data->info->password_used= PASSWORD_USED_NO_MENTION;
+    ++(*num_talks);
+  }
+
+  return PAM_SUCCESS;
+}
+
+static struct st_mysql_auth pam_auth_handler=
+{
+  MYSQL_AUTHENTICATION_INTERFACE_VERSION,
+  "mysql_clear_password",
+  &authenticate_user_with_pam_server
+};
+
+mysql_declare_plugin(auth_pam)
+{
+  MYSQL_AUTHENTICATION_PLUGIN,
+  &pam_auth_handler,
+  "auth_pam_compat",
+  "Percona, Inc.",
+  "PAM authentication plugin",
+  PLUGIN_LICENSE_GPL,
+  NULL,
+  NULL,
+  0x0001,
+  NULL,
+  NULL,
+  NULL
+#if MYSQL_PLUGIN_INTERFACE_VERSION >= 0x103
+  ,
+  0
+#endif
+}
+mysql_declare_plugin_end;