Percona Server for MySQL now ships with a fully open source
OpenID Connect (OIDC) authentication plugin, available starting
with Percona Server for MySQL 8.4.11-11 and
9.7.2-2 (not yet released as of this writing).
It allows a MySQL account to authenticate against any
standards-compliant Identity Provider (IdP) instead of relying on
a locally stored password, closing the gap with MySQL Enterprise
Edition, which has offered OIDC authentication since MySQL 9.1
and, in several respects, going beyond it.
Oracle offers the same category of functionality, but its
server-side plugin is part of the paid MySQL Enterprise Edition.
Percona’s implementation is open source and adds three
capabilities the Enterprise plugin does not provide: automatic
signing-key synchronization from a JWKS endpoint, IdP
group-to-role mapping, and proxy-user support. This article
explains how the plugin works and why those differences …
[Read more]