Authentication method 'caching_sha2_password' failed

[kevinHMS]

Issue:
Unable to connect to the mysql server, errorMsg: Authentication method 'caching_sha2_password' failed. Either use a secure connection, specify the server's RSA public key with ServerRSAPublicKeyFile, or set AllowPublicKeyRetrieval=True.

MySQL version: 8.0.40

More network trace information as below:

1. From the first MySQL protocol packet from client to server: the client Auth Plugin is: mysql_native_password

2. Then from server end, it sends following response: The server requests the client to use authentication as: caching_sha2_password.

3. And the client sent a response back and server started to do caching_sha2_password auth.

4. Then we can see the server responded error

In the older version which is connecting to the same My SQL server, after server sends the perform full authentication packet, we can see client sends the request_public_key request and then got the public key from server end.

Please help to check why the behavior is different.

[bgrainger]

Do you have AllowPublicKeyRetrieval=True in either of your connection strings?

It's hard to tell what's going on from the cropped screenshots. Can you email both traces to me?

[kevinHMS]

Hi @bgrainger ,
I have emailed the traces.

[bgrainger]

In the older version which is connecting to the same My SQL server

Is the older version using MySQL.Data? I don't believe it requires a secure connection in order to retrieve the server's public key, which leads to this possible security vulnerability: https://mysqlconnector.net/troubleshooting/retrieval-public-key/.

For MySqlConnector, you need to use one of the fixes in that article.

[bgrainger]

Your packet trace shows this inefficiency in MySqlConnector (which should be fixed as a separate bug): #1562

[kevinHMS]

Thank you for the update! Is there an ETA for the next release with the fix?

[bgrainger]

This issue has not identified any problems with MySqlConnector; as far as I can tell it's working as designed. Have you read the support article I linked earlier?