Allow plugins to implement authentication backends

Design decisions:

* Config option specifies which of the registered backends is used
* Name conflicts (including with builtins) make the backend registration
  fail
* Builtin backends are not moved to plugins to avoid breaking existing
  setups confusion in general
* Builtin backends are exposed to plugins (and have been for some time);
  Important information and internal methods are hidden to prevent
  interference from malicious plugins

See doc/auth_backends.md and the related interface and function
documentation for details.

Closes #127.

1 files changed, 13 insertions, 2 deletions

diff --git a/cmd/mt-auth-convert/convert.go b/cmd/mt-auth-convert/convert.go
index 28e44e9..853336f 100644
--- a/cmd/mt-auth-convert/convert.go
+++ b/cmd/mt-auth-convert/convert.go
@@ -9,6 +9,9 @@ where from is the format to convert from
 and to is the format to convert to
 and inconn is the postgres connection string for the source database
 and outconn is the postgres connection string for the destination database.
+
+Other backend-specific configuration is provided by the respective plugin's
+configuration mechanism if needed.
 */
 package main
 
@@ -24,6 +27,8 @@ func main() {
 		log.Fatal("usage: mt-auth-convert from to inconn outconn")
 	}
 
+	proxy.LoadPlugins()
+
 	var inBackend proxy.AuthBackend
 	switch os.Args[1] {
 	case "files":
@@ -41,7 +46,10 @@ func main() {
 			log.Fatal(err)
 		}
 	default:
-		log.Fatal("invalid input auth backend")
+		var ok bool
+		if inBackend, ok = proxy.Auth(os.Args[1]); !ok {
+			log.Fatal("invalid input auth backend")
+		}
 	}
 
 	var outBackend proxy.AuthBackend
@@ -61,7 +69,10 @@ func main() {
 			log.Fatal(err)
 		}
 	default:
-		log.Fatal("invalid output auth backend")
+		var ok bool
+		if outBackend, ok = proxy.Auth(os.Args[2]); !ok {
+			log.Fatal("invalid output auth backend")
+		}
 	}
 
 	if err := convert(outBackend, inBackend); err != nil {