Feat/support authentication plugins like ldap simple

[alereca]

Description of your changes

Fixes #125

I have:

• Read and followed Crossplane's contribution process.
• Run make reviewable to ensure this PR is ready for review.

How has this code been tested

Added unit test for user controller create and update methods

• UserWithAnAuthPluginThatNotRequiresPassword (for both)

[Duologic]

Would you mind rebasing?

[mcanevet]

@alereca are you still interested in this feature? I'd like to see this merged, I can rebase and open a new PR crediting your work if you want.

[alereca]

@alereca are you still interested in this feature? I'd like to see this merged, I can rebase and open a new PR crediting your work if you want.

@mcanevet I would greatly appreciate it. Currently, I'm quite busy working on some quarterly job tasks and finishing my studies. Please let me know if you have any questions about anything here.

[alereca]

Would you mind rebasing?

@Duologic Sorry I didn't answer before

[mcanevet]

@alereca I think I underestimated the complexity of the conflicts.
I'm not sure how to fix the one on reconciler.go: https://gist.github.com/mcanevet/24b2fde49eab35c4ed717a4ebb5badf2

[chlunde]

As MariaDB does not support mysql_native_password, and mysql_native_password has been removed in later MySQL releases, I think we should support not managing the auth. plugin too. So either nil or "" should mean the default plugin.

The mysql_native_password authentication plugin is deprecated as of MySQL 8.0.34, disabled by default in MySQL 8.4, and removed as of MySQL 9.0.0.

Additionally, there are syntax differences here:

Context	MySQL Syntax	MariaDB Syntax	Unified?
Password, default auth	IDENTIFIED BY 'password'	IDENTIFIED BY 'password'	✅ Yes
Password, specific plugin	IDENTIFIED WITH plugin BY/AS 'password'	IDENTIFIED WITH/VIA plugin USING/AS 'password'	❌ No

So AS 'password' is the common syntax support by both, but only when using plugins.

https://mariadb.com/kb/en/create-user/
https://dev.mysql.com/doc/refman/8.4/en/create-user.html

Unless there are license issues I think this means we should run mysql in CI to catch issues like this, or at least enable running that locally.

WIP fix of compatibility issues + rebase: https://github.com/crossplane-contrib/provider-sql/compare/master...chlunde:provider-sql:feat/support-authentication-plugins-like-ldap-simple?expand=1

[matheus-guedes-movile]

Is there any chance of this being merged in the near future? It would really help us out, we have a case where we need to setup IAM Auth for RDS and #186 would solve our issues but it seems it was dropped in favour of this solution.

[alereca]

#133 (comment)

@chlunde Thank you for your detailed analysis on the MySQL/MariaDB compatibility issues! Your comment helped me tremendously to understand the correct approach for handling auth plugins. I've now implemented the solution using empty string/nil for default plugins as you suggested e71cc6e

[alereca]

#133 (comment)

@mcanevet Thank you for trying to help with the rebase. I was swamped at the time, but I've now managed to rebase it onto the current master and address all the issues. Hopefully it's in better shape now!

[alereca]

I've now rebased this PR onto the current master and addressed all the compatibility issues that were raised. The PR now:

• ✅ Uses empty string/nil for default auth plugins (avoiding deprecated mysql_native_password)
• ✅ Supports both MySQL and MariaDB syntax
• ✅ Includes unit tests for both cluster and namespaced controllers

@Duologic When you have a moment, would you mind taking a look? I believe this is now ready for review. Thanks!

[mlubanski]

@Duologic @chlunde
Could we merge @alereca PR?

[Copilot]

Pull request overview

This PR adds support for configuring MySQL users to authenticate via a specified authentication plugin (e.g., authentication_ldap_simple), including an option to avoid setting / managing a password for plugins that don’t require one. This addresses crossplane-contrib/provider-sql issue #125 by extending the MySQL User APIs and reconcilers to manage the IDENTIFIED WITH <plugin> clause.

Changes:

• Add authPlugin and usePassword fields to the MySQL User APIs (cluster + namespaced), CRDs, and generated deepcopy code.
• Update MySQL User reconcilers to observe the mysql.user.plugin value, create users with IDENTIFIED WITH ... when configured, and skip password management when usePassword=false.
• Add unit tests and examples covering plugin-based auth users (including a “no password” scenario).

Reviewed changes

Copilot reviewed 10 out of 12 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
pkg/controller/namespaced/mysql/user/reconciler.go	Implements auth plugin observation and CREATE/ALTER USER logic with optional password handling.
pkg/controller/namespaced/mysql/user/reconciler_test.go	Adds/adjusts tests for observing and reconciling auth plugin + no-password users.
pkg/controller/cluster/mysql/user/reconciler.go	Implements cluster-scoped auth plugin reconciliation and optional password behavior.
pkg/controller/cluster/mysql/user/reconciler_test.go	Adds/adjusts cluster-scoped tests for auth plugin and no-password flows.
package/crds/mysql.sql.m.crossplane.io_users.yaml	Exposes authPlugin/usePassword in the namespaced CRD schema.
package/crds/mysql.sql.crossplane.io_users.yaml	Exposes authPlugin/usePassword in the cluster CRD schema.
examples/namespaced/mysql/user_with_auth_plugin.yaml	Namespaced examples for LDAP plugin, password-based plugin, and server-default plugin usage.
examples/cluster/mysql/user_with_auth_plugin.yaml	Cluster examples for LDAP plugin, password-based plugin, and server-default plugin usage.
apis/namespaced/mysql/v1alpha1/zz_generated.deepcopy.go	Adds deepcopy support for new fields.
apis/namespaced/mysql/v1alpha1/user_types.go	Adds API fields + kubebuilder validation for authPlugin/usePassword.
apis/cluster/mysql/v1alpha1/zz_generated.deepcopy.go	Adds deepcopy support for new fields.
apis/cluster/mysql/v1alpha1/user_types.go	Adds API fields + kubebuilder validation for authPlugin/usePassword.

Files not reviewed (2)

• apis/cluster/mysql/v1alpha1/zz_generated.deepcopy.go: Generated file
• apis/namespaced/mysql/v1alpha1/zz_generated.deepcopy.go: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.