Skip to content

When no password provided, the connector tries to connect as guest #165

Description

@Totktonada

Connector version: 0.3.3-0-ge67cb23.

Cited from #142 (comment):

It seems, if only username is passed (but no password) the client will silently connect as 'guest' user without a password. What a hell…

If I change the following && to ||:

if (obj->login != NULL && obj->passwd != NULL) {

Then I got TarantoolClientError: Invalid MsgPack - authentication request body.

That's all looks as a bug.

Reproducer

First console:

$ tarantool
tarantool> box.cfg{listen = '127.0.0.1:3301'}
tarantool> box.schema.user.grant('guest','read,write,execute,create,drop,alter','universe')
tarantool> box.schema.user.create('test', {password = '1234'})
tarantool> box.schema.user.grant('test','read,write,execute,create,drop,alter','universe')

Second console:

$ phpize
$ ./configure
$ make
$ php -a -d "extension=$(realpath modules/tarantool.so)"
php > $res = (new Tarantool('127.0.0.1', 3301, 'test'))->call('box.session.user');
php > var_dump($res);
array(1) {
  [0]=>
  array(1) {
    [0]=>
    string(5) "guest"
  }
}

The same for the empty password.

It is at least counter-intuitive. We should either try to connect without a password (with the empty password?) or give an error when a user is provided (and not guest), but a password is not.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions