sql/pgwire: treat system identity as string, not SQLUsername

[rafiss]

The external system identity may not be a SQLUsername -- that mapping is performed at a different phase of authentication. To make this more clear, we stop using the SQLUsername type for system identity.

Epic CRDB-33829
Release note: None

[blathers-crl]

It looks like your PR touches production code but doesn't add or edit any test code. Did you consider adding tests to your PR?

_{🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.}

[cockroach-teamcity]

This change is 

[souravcrl]

Reviewed 14 of 17 files at r1, 1 of 1 files at r2, 3 of 3 files at r3, all commit messages.
Reviewable status: complete! 0 of 0 LGTMs obtained (waiting on @pritesh-lahoti and @rafiss)

---

pkg/sql/pgwire/auth.go line 185 at r3 (raw file):

	// in. Now we can delegate to the selected AuthMethod implementation to
	// complete the authentication. We must pass in the systemIdentity here,
	// since the authenticator may use an external source to verify the

This makes it clear now. Thank you for pointing this out.

---

pkg/sql/pgwire/auth_methods.go line 920 at r3 (raw file):

	})
	b := &AuthBehaviors{}
	b.SetRoleMapper(UseSpecifiedIdentity(sessionUser))

This was tricky previously with UseProvidedIdentity. This would solve it when we want to use a different identity for behaviors.MapRole and behaviors.Authenticate.

---

pkg/sql/pgwire/auth_methods.go line 943 at r3 (raw file):

		// Verify that the systemIdentity is what we expect.
		if ldapUserDN.String() != systemIdentity {
			err := errors.New("LDAP user DN mismatch")

nit: we can log the ldapUserDN and systemIdentity here incase of mismatch

Suggestion:

	err := errors.Newf("LDAP user DN mismatch, expected user DN: %s, obtained systemIdentity: %s", ldapUserDN.String(), systemIdentity)

[rafiss]

TFTR!

bors r+

[rafiss]

Reviewable status: complete! 0 of 0 LGTMs obtained (waiting on @pritesh-lahoti and @souravcrl)

---

pkg/sql/pgwire/auth_methods.go line 943 at r3 (raw file):

Previously, souravcrl wrote…

nit: we can log the ldapUserDN and systemIdentity here incase of mismatch

done

[craig]

Build failed:

• acceptance

[rafiss]

bors retry

[craig]

Build failed (retrying...):

• acceptance

[craig]

Build failed (retrying...):

• acceptance

[craig]

Build failed:

• acceptance

[rafiss]

bors r+

[rafiss]

bors r+

[craig]

Already running a review

[craig]

Build succeeded:

• linux_arm64_build
• local_roachtest
• check_generated_code
• macos_arm64_build
• windows_build
• examples_orms
• local_roachtest_fips
• linux_amd64_build
• docker_image_amd64
• unit_tests
• linux_amd64_fips_build
• macos_amd64_build
• acceptance
• lint