Users, tokens and TLS

Access in ASQL is a signed credential that names tables, rights, an expiry and a row limit. Users and GRANT are built on these credentials.

The main login

MYSQL_USER and MYSQL_PASS_FILE in /etc/aios/asql.conf set the server's main login. Once set, its password is required from every client, local ones included. With no main login, the server listens on 127.0.0.1 only and any local client gets in, under any name, as admin. Anyone or anything that can reach 127.0.0.1 on the machine has full access, including other users on a shared host, a container using host networking and a local SSH tunnel. Set a main login before using ASQL anywhere other than a single-user machine.

Users

CREATE USER 'reporter' IDENTIFIED BY 'secret' TABLES 'store.*' RIGHTS 'read' TTL 86400 ROWS 10000;
ALTER USER 'reporter' RIGHTS 'read,write';
SHOW USERS;
DROP USER 'reporter';

ALTER USER changes only what it names. A user has one set of rights over all its tables. Changing a user's access ends its open sessions at their next statement.

GRANT and REVOKE work and edit the same thing: SELECT is read, INSERT and UPDATE are write, DELETE is delete, and DDL is admin. SHOW GRANTS shows a user in MySQL's form.

Users are kept in <root>/capability-users.

Capability tokens

A token gives a script or service limited access without a user:

CAPABILITY MINT 'store.items' RIGHTS 'read' TTL 3600 ROWS 5000;   -- returns the token
CAPABILITY REVOKE '<token>';

Log in with user name cap and the token as the password. Token logins are accepted from 127.0.0.1 only, unless the server is started with the mysql_cap_remote=1 option. The client must allow the mysql_clear_password plugin.

Anyone holding a token can make a narrower one without the server:

aios asqlcap attenuate <token> tables=store.items rights=read ttl=300 rows=100

A narrower token can never do more than the one it came from, and revoking the original revokes every token made from it.

Tokens are signed with <root>/capability.key. Servers that must accept each other's tokens need the same key.

TLS

Set MYSQL_TLS_CERT and MYSQL_TLS_KEY. With MYSQL_TLS_REQUIRE=1, remote clients must use TLS; 127.0.0.1 and the Unix socket stay open without it.

Secrets

CREATE SECRET name AS 'value' stores a value encrypted with AES-256-GCM, for use in Cells webhooks and SMTP mailers. SHOW SECRETS lists names only.

Grain programs

A Grain program running on the ASQL server that calls sql() has the engine's full authority. See Grain.