We would like to have clients connect to our MariaDB server, using client certificates from a trusted (internal) issuer and then log which user connected.
Unfortunately, the following limitations are preventing success:
- It's possible to trust everyone from the same issuer, but then they all have to be mapped to the same MariaDB user.
- It's possible to audit log user connections, but the logs only show the actual MariaDB user, not the subject of the certificate the client is using.
- It's not possible to dynamically create actual MariaDB users based on the client certificate.
Is there a solution to our dilemma, other than pre-populating a MariaDB user for each possible client certificate?