percona · jankowsk · May 30, 2026 · Jun 5, 2026 · Jul 14, 2026
diff --git a/.gitmodules b/.gitmodules
@@ -7,3 +7,6 @@
 [submodule "extra/libkmip"]
 	path = extra/libkmip
 	url = https://github.com/Percona-Lab/libkmip.git
+[submodule "extra/jwt-cpp"]
+	path = extra/jwt-cpp
+	url = https://github.com/Thalhammer/jwt-cpp
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -164,6 +164,8 @@ ENDIF()
 # PAM build Handling
 OPTION(WITH_PAM "Build with Percona PAM plugin" OFF)
 
+OPTION(WITH_AUTH_OPENID_CONNECT "Build with Percona OpenID Connect authentication plugin" ON)
+
 # We choose to provide WITH_DEBUG as alias to standard CMAKE_BUILD_TYPE=Debug
 # which turns out to be not trivial, as this involves synchronization 
 # between CMAKE_BUILD_TYPE and WITH_DEBUG. Besides, we have to deal with cases

diff --git a/components/percona_telemetry/telemetry_status_allowlist.h b/components/percona_telemetry/telemetry_status_allowlist.h
@@ -39,6 +39,13 @@
 inline constexpr std::string_view kStatusAllowlistCsv =
     "'Aborted_clients',"
     "'Aborted_connects',"
+    "'auth_openid_connect_users_authenticated',"
+    "'auth_openid_connect_users_denied',"
+    "'auth_openid_connect_users_proxied',"
+    "'auth_openid_connect_users_with_roles',"
+    "'auth_openid_connect_configured_idps',"
+    "'auth_openid_connect_configured_idps_using_jwks',"
+    "'auth_openid_connect_configured_group_role_maps',"
     "'Acl_cache_items_count',"
     "'Binlog_cache_disk_use',"
     "'Binlog_cache_use',"

diff --git a/extra/jwt-cpp b/extra/jwt-cpp
diff --git a/mysql-test/include/plugin.defs b/mysql-test/include/plugin.defs
@@ -244,3 +244,4 @@ component_encryption_udf            plugin_output_directory  no  ENCRYPTION_UDF_
 component_masking_functions         plugin_output_directory  no  MASKING_FUNCTIONS_COMPONENT
 component_percona_udf               plugin_output_directory  no  PERCONA_UDF_COMPONENT
 component_js_lang                   plugin_output_directory  no  JS_LANG_COMPONENT
+auth_openid_connect                 plugin_output_directory  no  AUTH_OIDC             auth_openid_connect
diff --git a/mysql-test/mysql-test-run.pl b/mysql-test/mysql-test-run.pl
@@ -399,6 +399,7 @@ sub set_term_args {
 our $exe_mysql_migrate_keyring;
 our $exe_mysql_keyring_encryption_test;
 our $exe_mysql_test_jwt_generator;
+our $exe_create_id_token;
 our $exe_mysqladmin;
 our $exe_mysqltest;
 our $exe_mysql_test_event_tracking;
@@ -3002,6 +3003,7 @@ ()
   $exe_mysql_keyring_encryption_test =
     mtr_exe_exists("$path_client_bindir/mysql_keyring_encryption_test");
   $exe_mysql_test_jwt_generator = mtr_exe_maybe_exists("$path_client_bindir/mysql_test_jwt_generator");
+  $exe_create_id_token = mtr_exe_maybe_exists("$path_client_bindir/create_id_token");
   # Look for mysql_test_event_tracking binary
   $exe_mysql_test_event_tracking = my_find_bin($bindir,
                 [ "runtime_output_directory", "bin" ],
@@ -3629,6 +3631,7 @@ sub environment_setup {
     "$path_client_bindir/mysql_secure_installation";
   $ENV{'OPENSSL_EXECUTABLE'} = $exe_openssl;
   $ENV{'MYSQL_TEST_JWT_GENERATOR'} = $exe_mysql_test_jwt_generator;
+  $ENV{'CREATE_ID_TOKEN'} = $exe_create_id_token;
   my $exe_mysqld = find_mysqld($basedir);
   $ENV{'MYSQLD'} = $exe_mysqld;
 

diff --git a/mysql-test/std_data/oidc/dummy_oidc_conf.json b/mysql-test/std_data/oidc/dummy_oidc_conf.json
@@ -0,0 +1,55 @@
+{
+  "oidc-idp": {
+    "issuer-name": "https://idp-test.com/realms/dummy",
+    "keys": [
+      {
+        "kid": "rsa-key-1",
+        "kty": "RSA",
+        "n": "ptR4YxjdrF2RrYiY9XYH3KcXKzlS6b2foGAeHN9dViAs5yKStKAucUf81kszq6LkzkOOPX5SbToLBRv5wwOtrBLKVkqhw4i5kS0b-7jpR9g7lER3qfDVYfe0nneaJzc-1Iz6id0oVj4ay8lGmWg5JX5Z8nBs52_7rfDIBtyAsyIQ2dF2tW4e72cypvskw_TwdbsqelY5ZezzTmKx8Ra4-o9Pu5_Vxe1Hhlkx1K_tfbGH9ZUsbFy90b0Vcw5w6EKPEkM9mZTUoj8TMeHTHaiOREK4llIJ6hokXbEG8BsKJuMuYrzx98e23JkaWaWQY27LUGK5sx-lsX_n8DO2kEASRw",
+        "e": "AQAB",
+        "use": "sig",
+        "alg": "RS256"
+      },
+      {
+        "kty": "EC",
+        "kid": "ec-key-1",
+        "use": "sig",
+        "alg": "ES256",
+        "crv": "P-256",
+        "x": "bjQTXrTcw_1HKiiZm2Hqv41w7Vd44M9koyY_-VsP-SA",
+        "y": "XqAzBfS0uQQwoemIKhNw4x8FsJxChCN1qT3_IsxMda0"
+      }
+    ],
+    "audiences": [
+      "ee2811b9-10b8",
+      "https://api.example.com"
+    ],
+    "group-claim": "groups",
+    "group-role": [
+      {
+        "acc": "accounting"
+      },
+      {
+        "eng": "engineering"
+      }
+    ]
+  },
+
+  "oidc-idp2": {
+    "issuer-name": "https://idp-test2.com/realms/dummy",
+    "keys": [
+      {
+        "kid": "key-1",
+        "kty": "RSA",
+        "n": "ptR4YxjdrF2RrYiY9XYH3KcXKzlS6b2foGAeHN9dViAs5yKStKAucUf81kszq6LkzkOOPX5SbToLBRv5wwOtrBLKVkqhw4i5kS0b-7jpR9g7lER3qfDVYfe0nneaJzc-1Iz6id0oVj4ay8lGmWg5JX5Z8nBs52_7rfDIBtyAsyIQ2dF2tW4e72cypvskw_TwdbsqelY5ZezzTmKx8Ra4-o9Pu5_Vxe1Hhlkx1K_tfbGH9ZUsbFy90b0Vcw5w6EKPEkM9mZTUoj8TMeHTHaiOREK4llIJ6hokXbEG8BsKJuMuYrzx98e23JkaWaWQY27LUGK5sx-lsX_n8DO2kEASRw",
+        "e": "AQAB",
+        "use": "sig",
+        "alg": "RS256"
+      }
+    ],
+    "audiences": [
+      "ee2811b9-10b8"
+    ]
+  }
+}
+
diff --git a/mysql-test/std_data/oidc/idp_private.pem b/mysql-test/std_data/oidc/idp_private.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCm1HhjGN2sXZGt
+iJj1dgfcpxcrOVLpvZ+gYB4c311WICznIpK0oC5xR/zWSzOrouTOQ449flJtOgsF
+G/nDA62sEspWSqHDiLmRLRv7uOlH2DuURHep8NVh97Sed5onNz7UjPqJ3ShWPhrL
+yUaZaDklflnycGznb/ut8MgG3ICzIhDZ0Xa1bh7vZzKm+yTD9PB1uyp6Vjll7PNO
+YrHxFrj6j0+7n9XF7UeGWTHUr+19sYf1lSxsXL3RvRVzDnDoQo8SQz2ZlNSiPxMx
+4dMdqI5EQriWUgnqGiRdsQbwGwom4y5ivPH3x7bcmRpZpZBjbstQYrmzH6Wxf+fw
+M7aQQBJHAgMBAAECggEATOmLjvQ5zmtc7Aobqp59xWZrMgw9g3FelEt71ofLuhcf
+XHf99rQadTNhB1KoQarZnZZbj1IboiuuRO6+2P9rI/eNvPavWTxBgQKw8f4v3mV8
+IkDmgjx7w6y1YpF1SjsYBlnwb3q8S/ZZ2DW1DKiWIAj+Yt0d+B0ShQCK1071Lp/5
+TGcVr+G2Opve2kVFLLWh2vXEeoQMreelk1thoACA629VsHjvFMuc8P0BXqDlTI7F
+00t+RMrkREuXhbmku29svcODa3z+eSyylXaOwaUN4ncPUogVN/XqkmtKa1/touxd
+uC3Y7U6w5xdgEMlf2s1001esrKPJF1jgSwctpK2v8QKBgQDVF1w1x9xCdU0X4QO4
+NJs+9I59jMMbrsIlZsM+K0KMUISeI9ZFI7bAozJE3KoQUEGPWZPpaFAuwsuB4qvP
+bzsEbDg+EzFQdnLOgjBH+MugF4q51ouYFe5sTJbI1pZaBovDu1pjCnBBkFx0MmbG
+BqfSvlqwId6e1YAqHd4z8KtzOwKBgQDIbGMamvspUslye8bctRTwhV0Cd8wG33p8
+4OMkcBUAUU+8/8LtDuoR2sgCX91L3ztilngsj2sXI9Jy1J23gpXm0thwV22vIJHk
+Yc0PxuZ1OEA1B6oLreFw7PD9SxlG62/L0P2WACvwi92xJlW/IDgE/CRE11IpSJrV
+FshURyEUZQKBgQCFpRwJAutKpyUN1+ssSZogduMzLOhlYUqUiInlYN5hAFLcl99Y
+B5kj4naxp6/lgWBM1sKkve6kFTnroU1eUQWztWfkzsa8Dz3b9NzxFsInCvzPpxZv
+8TlSpQpgte0gU0CvJr7+pNpY1ICXw9CfXCc/TnG0S9nCxmaWg5sL+mKdZwKBgFOj
+T5Qpusha4PAikTFHbA6XSOIfxgfUONRmMMPi9hCk3ga8IMc2ox2CVFcRVFM2PBz/
+N/U4gHMuosMC0TJkj1O9B0+SXJZpnBhXa/C6iy+9oqW+pgqrrFmot0Ssk0bSN1wx
+wbFYLv36EDC+E6hntJj389a6mHHb96kXEdCBwl81AoGBAIwt2Ani0rMl3KhS/JGq
+UhFZfneLbzeb5Oz8O/ZphJyG9sPtdXq56Z1xezMaZUWjjZRJuLMq86d4jGdpKTmX
+LOQDHYtLJxrTLGpED42zHEW/51P+q0F7EeS0ge09lvMjqoU+FCsOTqKlZH/H7DAI
+Xk/3ehQ3WrVVM7QkLw4jk8P3
+-----END PRIVATE KEY-----
diff --git a/mysql-test/std_data/oidc/idp_public.pem b/mysql-test/std_data/oidc/idp_public.pem
@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAptR4YxjdrF2RrYiY9XYH
+3KcXKzlS6b2foGAeHN9dViAs5yKStKAucUf81kszq6LkzkOOPX5SbToLBRv5wwOt
+rBLKVkqhw4i5kS0b+7jpR9g7lER3qfDVYfe0nneaJzc+1Iz6id0oVj4ay8lGmWg5
+JX5Z8nBs52/7rfDIBtyAsyIQ2dF2tW4e72cypvskw/TwdbsqelY5ZezzTmKx8Ra4
++o9Pu5/Vxe1Hhlkx1K/tfbGH9ZUsbFy90b0Vcw5w6EKPEkM9mZTUoj8TMeHTHaiO
+REK4llIJ6hokXbEG8BsKJuMuYrzx98e23JkaWaWQY27LUGK5sx+lsX/n8DO2kEAS
+RwIDAQAB
+-----END PUBLIC KEY-----
diff --git a/mysql-test/suite/auth_openid_connect/inc/keycloak_oidc_conf.inc b/mysql-test/suite/auth_openid_connect/inc/keycloak_oidc_conf.inc
@@ -0,0 +1,63 @@
+let $KEYCLOAK_OIDC_CONF =
+JSON://
+{
+  \"oidc-idp\": {
+    \"issuer-name\": \"https://idp-test.com/realms/dummy\",
+    \"keys\": [
+      {
+        \"kid\": \"rsa-key-1\",
+        \"kty\": \"RSA\",
+        \"n\": \"ptR4YxjdrF2RrYiY9XYH3KcXKzlS6b2foGAeHN9dViAs5yKStKAucUf81kszq6LkzkOOPX5SbToLBRv5wwOtrBLKVkqhw4i5kS0b-7jpR9g7lER3qfDVYfe0nneaJzc-1Iz6id0oVj4ay8lGmWg5JX5Z8nBs52_7rfDIBtyAsyIQ2dF2tW4e72cypvskw_TwdbsqelY5ZezzTmKx8Ra4-o9Pu5_Vxe1Hhlkx1K_tfbGH9ZUsbFy90b0Vcw5w6EKPEkM9mZTUoj8TMeHTHaiOREK4llIJ6hokXbEG8BsKJuMuYrzx98e23JkaWaWQY27LUGK5sx-lsX_n8DO2kEASRw\",
+        \"e\": \"AQAB\",
+        \"use\": \"sig\",
+        \"alg\": \"RS256\"
+      },
+      {
+        \"kty\": \"EC\",
+        \"kid\": \"ec-key-1\",
+        \"use\": \"sig\",
+        \"alg\": \"ES256\",
+        \"crv\": \"P-256\",
+        \"x\": \"bjQTXrTcw_1HKiiZm2Hqv41w7Vd44M9koyY_-VsP-SA\",
+        \"y\": \"XqAzBfS0uQQwoemIKhNw4x8FsJxChCN1qT3_IsxMda0\"
+      }
+    ],
+    \"audiences\": [
+      \"ee2811b9-10b8\",
+      \"https://api.example.com\"
+    ],
+    \"group-claim\": \"groups\",
+    \"group-role\": [
+      {
+        \"acc\": \"accounting\"
+      },
+      {
+        \"eng\": \"engineering\"
+      }
+    ]
+  },
+  \"my-keycloak\": {
+    \"issuer-name\": \"$IDP_HOST/realms/master\",
+    \"jwks-url\": \"$IDP_HOST/realms/master/protocol/openid-connect/certs\",
+    \"audiences\": [
+      \"myclient\"
+    ],
+    \"group-claim\": \"groups\",
+    \"group-role\": [
+      {
+        \"/accounting\": \"accounting\"
+      },
+      {
+        \"/marketing\": \"marketing\"
+      }
+    ]
+  },
+  \"unaccessible-idp\": {
+    \"issuer-name\": \"https://dummy-host/realms/master\",
+    \"jwks-url\": \"https://dummy-host/realms/master/protocol/openid-connect/certs\",
+    \"audiences\": [
+      \"account\"
+    ]
+  }
+};
+
diff --git a/mysql-test/suite/auth_openid_connect/inc/set_idp_vars.inc b/mysql-test/suite/auth_openid_connect/inc/set_idp_vars.inc
@@ -0,0 +1,19 @@
+if ($MTR_OIDC_IDP_HOST)
+{
+  --let $IDP_HOST = $MTR_OIDC_IDP_HOST
+}
+
+if (!$IDP_HOST)
+{
+  --let $IDP_HOST = https://keycloak.int.percona.com
+}
+
+if ($MTR_OIDC_USER_ID)
+{
+  --let $IDP_USER_ID = $MTR_USER_ID
+}
+
+if (!$IDP_USER_ID)
+{
+  --let $IDP_USER_ID = e3039939-719c-4ba7-99d9-d9efecf5caeb
+}
diff --git a/mysql-test/suite/auth_openid_connect/r/auth.result b/mysql-test/suite/auth_openid_connect/r/auth.result
@@ -0,0 +1,70 @@
+### INITIALIZE TESTS
+CALL mtr.add_suppression("Plugin auth_openid_connect reported: 'auth_openid_connect_configuration not set");
+INSTALL PLUGIN auth_openid_connect SONAME 'auth_openid_connect.so';;
+CREATE USER mysql_oidc_user IDENTIFIED WITH 'auth_openid_connect' AS '{"identity_provider" : "oidc-idp", "user" : "oidc-user"}';
+
+### Validate system variable checks for auth_openid_connect_configuration
+
+## VALID CASES
+SET GLOBAL auth_openid_connect_configuration = 'JSON://{"oidc-idp": {"issuer-name": "https://idp-test.com/realms/dummy", "keys": [{"kid": "rsa-key-1", "kty": "RSA", "n": "ptR4YxjdrF2RrYiY9XYH3KcXKzlS6b2foGAeHN9dViAs5yKStKAucUf81kszq6LkzkOOPX5SbToLBRv5wwOtrBLKVkqhw4i5kS0b-7jpR9g7lER3qfDVYfe0nneaJzc-1Iz6id0oVj4ay8lGmWg5JX5Z8nBs52_7rfDIBtyAsyIQ2dF2tW4e72cypvskw_TwdbsqelY5ZezzTmKx8Ra4-o9Pu5_Vxe1Hhlkx1K_tfbGH9ZUsbFy90b0Vcw5w6EKPEkM9mZTUoj8TMeHTHaiOREK4llIJ6hokXbEG8BsKJuMuYrzx98e23JkaWaWQY27LUGK5sx-lsX_n8DO2kEASRw", "e": "AQAB", "use": "sig", "alg": "RS256"}], "audiences": ["ee2811b9-10b8","https://api.example.com"]}}';
+user()	current_user()
+mysql_oidc_user@localhost	mysql_oidc_user@%
+SET GLOBAL auth_openid_connect_configuration = 'FILE://<MYSQL_TEST_DIR>/std_data/oidc/dummy_oidc_conf.json';
+user()	current_user()
+mysql_oidc_user@localhost	mysql_oidc_user@%
+
+## INVALID CASES
+CALL mtr.add_suppression("Plugin auth_openid_connect reported: 'invalid sysvar prefix");
+CALL mtr.add_suppression("Plugin auth_openid_connect reported: 'invalid value for system variable'");
+CALL mtr.add_suppression("Plugin auth_openid_connect reported: 'cannot open config file:");
+CALL mtr.add_suppression("Plugin auth_openid_connect reported: 'extra content after correct JSON document'");
+CALL mtr.add_suppression("Plugin auth_openid_connect reported: 'syntax error");
+SET GLOBAL auth_openid_connect_configuration = 'INVD://';
+ERROR 42000: Variable 'auth_openid_connect_configuration' can't be set to the value of 'INVD://'
+SET GLOBAL auth_openid_connect_configuration = 'JSON://{"invalid"[}';
+ERROR 42000: Variable 'auth_openid_connect_configuration' can't be set to the value of 'JSON://{"invalid"[}'
+SET GLOBAL auth_openid_connect_configuration = 'FILE://nonexistent_path/nonexistent_file.json';
+ERROR 42000: Variable 'auth_openid_connect_configuration' can't be set to the value of 'FILE://nonexistent_path/nonexistent_file.json'
+SET GLOBAL auth_openid_connect_configuration = 'JSON://{"oidc-idp": {"issuer-name": "https://idp-test.com/realms/dummy", "keys": [{"kid": "rsa-key-1", "kty": "RSA", "n": "ptR4YxjdrF2RrYiY9XYH3KcXKzlS6b2foGAeHN9dViAs5yKStKAucUf81kszq6LkzkOOPX5SbToLBRv5wwOtrBLKVkqhw4i5kS0b-7jpR9g7lER3qfDVYfe0nneaJzc-1Iz6id0oVj4ay8lGmWg5JX5Z8nBs52_7rfDIBtyAsyIQ2dF2tW4e72cypvskw_TwdbsqelY5ZezzTmKx8Ra4-o9Pu5_Vxe1Hhlkx1K_tfbGH9ZUsbFy90b0Vcw5w6EKPEkM9mZTUoj8TMeHTHaiOREK4llIJ6hokXbEG8BsKJuMuYrzx98e23JkaWaWQY27LUGK5sx-lsX_n8DO2kEASRw", "e": "AQAB", "use": "sig", "alg": "RS256"}], "audiences": ["ee2811b9-10b8","https://api.example.com"]}} , {"oidc-idp": {"issuer-name":"name"}}';
+ERROR 42000: Variable 'auth_openid_connect_configuration' can't be set to the value of 'JSON://{"oidc-idp": {"issuer-name": "https://idp-test.com/realms/dummy", "keys": [{"kid": "rsa-key-1", "kty": "RSA", "n": "ptR4YxjdrF2RrYiY9XYH3KcXKzlS6b2foGAeHN9dViAs5yKStKAucUf81kszq6LkzkOOPX5SbToLB'
+SET GLOBAL auth_openid_connect_configuration = 'JSON://{}';
+
+### Client side validations (FR.5)
+SET GLOBAL auth_openid_connect_configuration = 'FILE://<MYSQL_TEST_DIR>/std_data/oidc/dummy_oidc_conf.json';
+
+### CREATE USER with incorrect AS clause
+CREATE USER invalid_user IDENTIFIED WITH 'auth_openid_connect' AS '{"identity_provider" : "oidc-idp"}';
+DROP USER invalid_user;
+CREATE USER invalid_user IDENTIFIED WITH 'auth_openid_connect' AS '{"user" : "oidc-user"}';
+DROP USER invalid_user;
+CREATE USER invalid_user IDENTIFIED WITH 'auth_openid_connect';
+DROP USER invalid_user;
+
+### Verifying token (FR.7, FR.8, FR.9)
+CREATE USER invalid_user IDENTIFIED WITH 'auth_openid_connect' AS '{"user" : "oidc-user", "identity_provider" : "nonexistent-idp"}';
+DROP USER invalid_user;
+SET GLOBAL auth_openid_connect_configuration = 'JSON://{"oidc-idp": {"issuer-name": "https://idp-test.com/realms/dummy", "keys": [{"kid": "rsa-key-1", "kty": "RSA", "n": "ptR4YxjdrF2RrYiY9XYH3KcXKzlS6b2foGAeHN9dViAs5yKStKAucUf81kszq6LkzkOOPX5SbToLBRv5wwOtrBLKVkqhw4i5kS0b-7jpR9g7lER3qfDVYfe0nneaJzc-1Iz6id0oVj4ay8lGmWg5JX5Z8nBs52_7rfDIBtyAsyIQ2dF2tW4e72cypvskw_TwdbsqelY5ZezzTmKx8Ra4-o9Pu5_Vxe1Hhlkx1K_tfbGH9ZUsbFy90b0Vcw5w6EKPEkM9mZTUoj8TMeHTHaiOREK4llIJ6hokXbEG8BsKJuMuYrzx98e23JkaWaWQY27LUGK5sx-lsX_n8DO2kEASRw", "e": "AQAB", "use": "sig", "alg": "RS256"}], "audiences": ["ee2811b9-10b8","https://api.example.com"]}}';
+user()	current_user()
+mysql_oidc_user@localhost	mysql_oidc_user@%
+SET GLOBAL auth_openid_connect_configuration = 'FILE://<MYSQL_TEST_DIR>/std_data/oidc/dummy_oidc_conf.json';
+user()	current_user()
+mysql_oidc_user@localhost	mysql_oidc_user@%
+SET GLOBAL auth_openid_connect_configuration = 'JSON://{"oidc-idp": {"issuer-name": "https://idp-test.com/realms/dummy", "keys": [{"kid": "rsa-key-1", "kty": "RSA", "n": "ptR4YxjdrF2RrYiY9XYH3KcXKzlS6b2foGAeHN9dViAs5yKStKAucUf81kszq6LkzkOOPX5SbToLBRv5wwOtrBLKVkqhw4i5kS0b-7jpR9g7lER3qfDVYfe0nneaJzc-1Iz6id0oVj4ay8lGmWg5JX5Z8nBs52_7rfDIBtyAsyIQ2dF2tW4e72cypvskw_TwdbsqelY5ZezzTmKx8Ra4-o9Pu5_Vxe1Hhlkx1K_tfbGH9ZUsbFy90b0Vcw5w6EKPEkM9mZTUoj8TMeHTHaiOREK4llIJ6hokXbEG8BsKJuMuYrzx98e23JkaWaWQY27LUGK5sx-lsX_n8DO2kEASRw", "e": "AQAB", "use": "sig", "alg": "RS256"}]}}';
+user()	current_user()
+mysql_oidc_user@localhost	mysql_oidc_user@%
+SHOW GLOBAL STATUS LIKE 'auth_openid_connect%';
+Variable_name	Value
+auth_openid_connect_configured_group_role_maps	0
+auth_openid_connect_configured_idps	1
+auth_openid_connect_configured_idps_using_jwks	0
+auth_openid_connect_users_authenticated	5
+auth_openid_connect_users_denied	16
+auth_openid_connect_users_proxied	0
+auth_openid_connect_users_with_roles	0
+SELECT COUNT_ALLOC>0, SUM_NUMBER_OF_BYTES_ALLOC>0, CURRENT_NUMBER_OF_BYTES_USED>0 FROM performance_schema.memory_summary_global_by_event_name WHERE EVENT_NAME LIKE 'memory/auth_openid_connect/%';
+COUNT_ALLOC>0	SUM_NUMBER_OF_BYTES_ALLOC>0	CURRENT_NUMBER_OF_BYTES_USED>0
+1	1	1
+
+### CLEANUP
+DROP USER 'mysql_oidc_user'@'%';
+UNINSTALL PLUGIN auth_openid_connect;
diff --git a/mysql-test/suite/auth_openid_connect/r/group_role.result b/mysql-test/suite/auth_openid_connect/r/group_role.result
@@ -0,0 +1,27 @@
+### INITIALIZE TESTS
+INSTALL PLUGIN auth_openid_connect SONAME 'auth_openid_connect.so';;
+SET GLOBAL auth_openid_connect_configuration = 'FILE://<MYSQL_TEST_DIR>/std_data/oidc/dummy_oidc_conf.json';
+CREATE USER mysql_oidc_user IDENTIFIED WITH 'auth_openid_connect' AS '{"identity_provider" : "oidc-idp", "user" : "oidc-user"}';
+CREATE ROLE accounting;
+CREATE ROLE sales;
+
+### Connect user without dynamically added role, fails to set the role
+### Connect user with dynamically added role
+#   - acc from token maps to accounting role according to the config
+#   - hr is unmapped
+### Connect user without dynamically added role, verify the roles were revoked
+SHOW GLOBAL STATUS LIKE 'auth_openid_connect%';
+Variable_name	Value
+auth_openid_connect_configured_group_role_maps	2
+auth_openid_connect_configured_idps	2
+auth_openid_connect_configured_idps_using_jwks	0
+auth_openid_connect_users_authenticated	5
+auth_openid_connect_users_denied	0
+auth_openid_connect_users_proxied	0
+auth_openid_connect_users_with_roles	3
+
+### CLEANUP
+DROP USER mysql_oidc_user;
+DROP USER accounting;
+DROP USER sales;
+UNINSTALL PLUGIN auth_openid_connect;
diff --git a/mysql-test/suite/auth_openid_connect/r/idp.result b/mysql-test/suite/auth_openid_connect/r/idp.result
@@ -0,0 +1,53 @@
+### INITIALIZE TESTS
+CALL mtr.add_suppression("Plugin auth_openid_connect reported: 'JWKS configuration is insecure");
+CALL mtr.add_suppression("Plugin auth_openid_connect reported: 'IDP not found");
+CALL mtr.add_suppression("Plugin auth_openid_connect reported: 'JWKS: HTTP GET from https://dummy-host");
+CALL mtr.add_suppression("Plugin auth_openid_connect reported: 'configuration of unaccessible-idp");
+INSTALL PLUGIN auth_openid_connect SONAME 'auth_openid_connect.so';
+SET GLOBAL auth_openid_connect_configuration = 'JSON://';
+CREATE USER mysql_oidc_user IDENTIFIED WITH 'auth_openid_connect' AS '{"identity_provider" : "my-keycloak", "user" : "<IDP_USER_ID>"}';;
+CREATE USER mysql_other_user IDENTIFIED WITH 'auth_openid_connect' AS '{"identity_provider" : "my-keycloak", "user" : "other-user-id"}';
+
+## Login tests
+user()	current_user()
+mysql_oidc_user@localhost	mysql_oidc_user@%
+
+## role mapping tests
+CREATE ROLE accounting;
+CREATE ROLE marketing;
+
+## Tests of update_jwks() UDF
+CREATE FUNCTION update_jwks RETURNS INTEGER SONAME 'auth_openid_connect.so';
+SELECT update_jwks();
+update_jwks()
+1
+SELECT update_jwks('my-keycloak');
+update_jwks('my-keycloak')
+1
+SELECT update_jwks('unaccessible-idp');
+update_jwks('unaccessible-idp')
+0
+SELECT update_jwks('dummy');
+update_jwks('dummy')
+NULL
+SELECT update_jwks('arg1', 'arg2');
+ERROR HY000: Can't initialize function 'update_jwks'; function requires 0 or 1 argument
+SELECT update_jwks(123);
+ERROR HY000: Can't initialize function 'update_jwks'; first argument of the function must be string
+SHOW GLOBAL STATUS LIKE 'auth_openid_connect%';
+Variable_name	Value
+auth_openid_connect_configured_group_role_maps	4
+auth_openid_connect_configured_idps	3
+auth_openid_connect_configured_idps_using_jwks	2
+auth_openid_connect_users_authenticated	3
+auth_openid_connect_users_denied	1
+auth_openid_connect_users_proxied	0
+auth_openid_connect_users_with_roles	3
+
+### CLEANUP
+DROP USER mysql_oidc_user;
+DROP USER mysql_other_user;
+DROP ROLE accounting;
+DROP ROLE marketing;
+DROP FUNCTION update_jwks;
+UNINSTALL PLUGIN auth_openid_connect;