We would like to have clients connect to our MariaDB server, using client certificates from a trusted (internal) issuer and then log which user connected.
Unfortunately, the following limitations are preventing success:
- It's possible to trust everyone from the same issuer, but then they all have to be mapped to the same MariaDB user.
- It's possible to audit log user connections, but the logs only show the actual MariaDB user, not the subject of the certificate the client is using.
- It's not possible to dynamically create actual MariaDB users based on the client certificate.
Is there a solution to our dilemma, other than pre-populating a MariaDB user for each possible client certificate?
Yep, you're doomed to creating a MariaDB user for each user you wish to connect to the server, with a
REQUIRE SUBJECT '/CN=foo/[email protected]/'. It's a hideous, error-prone syntax. MySQL's user management is fairly pants in a great many ways.