risingwave_frontend/user/
user_authentication.rs

1// Copyright 2025 RisingWave Labs
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7//     http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15use std::collections::HashMap;
16
17use risingwave_pb::user::AuthInfo;
18use risingwave_pb::user::auth_info::EncryptionType;
19use risingwave_sqlparser::ast::SqlOption;
20use sha2::{Digest, Sha256};
21
22use crate::WithOptions;
23
24// SHA-256 is not supported in PostgreSQL protocol. We need to implement SCRAM-SHA-256 instead
25// if necessary.
26const SHA256_ENCRYPTED_PREFIX: &str = "SHA-256:";
27const MD5_ENCRYPTED_PREFIX: &str = "md5";
28
29const VALID_SHA256_ENCRYPTED_LEN: usize = SHA256_ENCRYPTED_PREFIX.len() + 64;
30const VALID_MD5_ENCRYPTED_LEN: usize = MD5_ENCRYPTED_PREFIX.len() + 32;
31
32pub const OAUTH_JWKS_URL_KEY: &str = "jwks_url";
33pub const OAUTH_ISSUER_KEY: &str = "issuer";
34
35/// Build `AuthInfo` for `OAuth`.
36#[inline(always)]
37pub fn build_oauth_info(options: &Vec<SqlOption>) -> Option<AuthInfo> {
38    let metadata: HashMap<String, String> = WithOptions::oauth_options_to_map(options.as_slice())
39        .ok()?
40        .into_iter()
41        .collect();
42    if !metadata.contains_key(OAUTH_JWKS_URL_KEY) || !metadata.contains_key(OAUTH_ISSUER_KEY) {
43        return None;
44    }
45    Some(AuthInfo {
46        encryption_type: EncryptionType::Oauth as i32,
47        encrypted_value: Vec::new(),
48        metadata,
49    })
50}
51
52/// Try to extract the encryption password from given password. The password is always stored
53/// encrypted in the system catalogs. The ENCRYPTED keyword has no effect, but is accepted for
54/// backwards compatibility. The method of encryption is by default SHA-256-encrypted. If the
55/// presented password string is already in MD5-encrypted or SHA-256-encrypted format, then it is
56/// stored as-is regardless of `password_encryption` (since the system cannot decrypt the specified
57/// encrypted password string, to encrypt it in a different format).
58///
59/// For an MD5 encrypted password, rolpassword column will begin with the string md5 followed by a
60/// 32-character hexadecimal MD5 hash. The MD5 hash will be of the user's password concatenated to
61/// their user name. For example, if user joe has password xyzzy, we will store the md5 hash of
62/// xyzzyjoe.
63///
64/// For an SHA-256 encrypted password, rolpassword column will begin with the string SHA-256:
65/// followed by a 64-character hexadecimal SHA-256 hash, which is the SHA-256 hash of the user's
66/// password concatenated to their user name. The SHA-256 will be the default hash algorithm for
67/// Risingwave.
68///
69/// A password that does not follow either of those formats is assumed to be unencrypted.
70#[inline(always)]
71pub fn encrypted_password(name: &str, password: &str) -> Option<AuthInfo> {
72    // Specifying an empty string will also set the auth info to null.
73    if password.is_empty() {
74        return None;
75    }
76
77    if valid_sha256_password(password) {
78        Some(AuthInfo {
79            encryption_type: EncryptionType::Sha256 as i32,
80            encrypted_value: password.trim_start_matches(SHA256_ENCRYPTED_PREFIX).into(),
81            metadata: HashMap::new(),
82        })
83    } else if valid_md5_password(password) {
84        Some(AuthInfo {
85            encryption_type: EncryptionType::Md5 as i32,
86            encrypted_value: password.trim_start_matches(MD5_ENCRYPTED_PREFIX).into(),
87            metadata: HashMap::new(),
88        })
89    } else {
90        Some(encrypt_default(name, password))
91    }
92}
93
94/// Encrypt the password with MD5 as default.
95#[inline(always)]
96fn encrypt_default(name: &str, password: &str) -> AuthInfo {
97    AuthInfo {
98        encryption_type: EncryptionType::Md5 as i32,
99        encrypted_value: md5_hash(name, password),
100        metadata: HashMap::new(),
101    }
102}
103
104/// Encrypted raw password from auth info.
105pub fn encrypted_raw_password(info: &AuthInfo) -> String {
106    let encrypted_pwd = String::from_utf8(info.encrypted_value.clone()).unwrap();
107    let prefix = match info.get_encryption_type().unwrap() {
108        EncryptionType::Unspecified => unreachable!(),
109        EncryptionType::Plaintext => "",
110        EncryptionType::Sha256 => SHA256_ENCRYPTED_PREFIX,
111        EncryptionType::Md5 => MD5_ENCRYPTED_PREFIX,
112        EncryptionType::Oauth => "",
113    };
114    format!("{}{}", prefix, encrypted_pwd)
115}
116
117/// Encrypt the stored password with given salt, used for user authentication.
118#[inline(always)]
119pub fn md5_hash_with_salt(encrypted_value: &[u8], salt: &[u8; 4]) -> Vec<u8> {
120    let mut ctx = md5::Context::new();
121    ctx.consume(encrypted_value);
122    ctx.consume(salt);
123    format!("md5{:x}", ctx.compute()).into_bytes()
124}
125
126#[inline(always)]
127fn valid_sha256_password(password: &str) -> bool {
128    password.starts_with(SHA256_ENCRYPTED_PREFIX) && password.len() == VALID_SHA256_ENCRYPTED_LEN
129}
130
131#[inline(always)]
132fn valid_md5_password(password: &str) -> bool {
133    password.starts_with(MD5_ENCRYPTED_PREFIX) && password.len() == VALID_MD5_ENCRYPTED_LEN
134}
135
136/// Encrypt "`password`+`name`" with SHA-256.
137#[cfg_attr(not(test), expect(dead_code))]
138#[inline(always)]
139pub fn sha256_hash(name: &str, password: &str) -> Vec<u8> {
140    let mut hasher = Sha256::new();
141    hasher.update(password.as_bytes());
142    hasher.update(name.as_bytes());
143    format!("{:x}", hasher.finalize()).into_bytes()
144}
145
146/// Encrypt "`password`+`name`" with MD5.
147#[inline(always)]
148pub fn md5_hash(name: &str, password: &str) -> Vec<u8> {
149    let mut ctx = md5::Context::new();
150    ctx.consume(password.as_bytes());
151    ctx.consume(name.as_bytes());
152    format!("{:x}", ctx.compute()).into_bytes()
153}
154
155#[cfg(test)]
156mod tests {
157    use super::*;
158
159    #[test]
160    fn test_encrypt_password() {
161        let (user_name, password) = ("foo", "bar");
162        assert_eq!(
163            b"96948aad3fcae80c08a35c9b5958cd89".to_vec(),
164            md5_hash(user_name, password)
165        );
166        assert_eq!(
167            b"md59f2fa6a30871a92249bdd2f1eeee4ef6".to_vec(),
168            md5_hash_with_salt(
169                b"96948aad3fcae80c08a35c9b5958cd89",
170                &[0x1a, 0x2b, 0x3d, 0x4e]
171            )
172        );
173        assert_eq!(
174            b"88ecde925da3c6f8ec3d140683da9d2a422f26c1ae1d9212da1e5a53416dcc88".to_vec(),
175            sha256_hash(user_name, password)
176        );
177
178        let input_passwords = [
179            "bar",
180            "",
181            "md596948aad3fcae80c08a35c9b5958cd89",
182            "SHA-256:88ecde925da3c6f8ec3d140683da9d2a422f26c1ae1d9212da1e5a53416dcc88",
183        ];
184        let expected_output_passwords = vec![
185            Some(AuthInfo {
186                encryption_type: EncryptionType::Md5 as i32,
187                encrypted_value: md5_hash(user_name, password),
188                metadata: HashMap::new(),
189            }),
190            None,
191            Some(AuthInfo {
192                encryption_type: EncryptionType::Md5 as i32,
193                encrypted_value: md5_hash(user_name, password),
194                metadata: HashMap::new(),
195            }),
196            Some(AuthInfo {
197                encryption_type: EncryptionType::Sha256 as i32,
198                encrypted_value: sha256_hash(user_name, password),
199                metadata: HashMap::new(),
200            }),
201        ];
202        let output_passwords = input_passwords
203            .iter()
204            .map(|&p| encrypted_password(user_name, p))
205            .collect::<Vec<_>>();
206        assert_eq!(output_passwords, expected_output_passwords);
207    }
208}
risingwave_frontend/user/user_authentication.rs

risingwave_frontend/user/
user_authentication.rs
