Skip to content

Node-mysql does not support auth-switch request from server. #1396

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
twocode opened this issue Apr 25, 2016 · 13 comments
Closed

Node-mysql does not support auth-switch request from server. #1396

twocode opened this issue Apr 25, 2016 · 13 comments
Labels
feature protocol_41

Comments

@twocode
Copy link

twocode commented Apr 25, 2016

Node-mysql does not support auth-switch request from server, and treats it as an error message.

It is not correct.
@sidorares
Copy link
Member

Are you talking about https://dev.mysql.com/doc/internals/en/connection-phase-packets.html#packet-Protocol::AuthSwitchRequest ?

Probably right solution right now would be not to set CLIENT_PLUGIN_AUTH flag ( not sure if it's currently set by default or not ). AuthSwitchRequest support would only make sense if the whole auth handshake sequence is pluggable ( right now client is always trying to connect with Authentication::Native41 )

@dougwilson
Copy link
Member

Probably right solution right now would be not to set CLIENT_PLUGIN_AUTH flag ( not sure if it's currently set by default or not ).

We not only do not set the flag, but we also prevent users from setting the flag as well (https://github.com/felixge/node-mysql/blob/master/lib/ConnectionConfig.js#L109).

@sidorares
Copy link
Member

If so then it's something wrong with @twocode server setup. Server must not send AuthSwitchRequest if client's CLIENT_PLUGIN_AUTH flag is not set.

@twocode , could you post what is your server version (and node-mysql version you are using as well)?

@twocode
Copy link
Author

twocode commented Apr 28, 2016

Thanks @sidorares and @dougwilson .

I am aware that CLIENT_PLUGIN_AUTH bit it not set in node-mysql's capability flags and that node-mysql forces to use Native41 authentication method (mysql_native_password) to do the authentication with servers.

However, this design/implementation is blocking something I am working on, which is some mysql proxy and leverages auth-swith flows to authenticate the user. I have tested other popular client drivers (php, java, perl, .Net, ...) and only node-mysql fails here.

I would like to make a patch that include following changes:

  1. Set the CLIENT_PLUGIN_AUTH bit in the client capability flags.
  2. Implement AuthSwitchRequest and AuthSwitchResponse packets.
  3. Still keeping the only authentication method of mysql_native_password,

In this way, if server would like to auth switch to mysql_native_password, node-mysql will send the token again with the new scramble; otherwise, if server auth swtiches to another authentication method, node-mysql will return error. This follows mysql protocol flow and complies to other mysql client drivers.

Please comment?

Thanks

@sidorares sidorares mentioned this issue May 2, 2016
Open
@twocode
Copy link
Author

twocode commented May 3, 2016

Hi @sidorares

Glad to see you have opened an issue for this in node-mysql2. Have you got any plans to fix it?

Thx

@sidorares
Copy link
Member

@twocode potentially, at least in a way that CLIENT_PLUGIN_AUTH flag is not set until we can understand auth-switch request ( and maybe add auth-switch request support later )

@twocode
Copy link
Author

twocode commented May 6, 2016

@sidorares I see. What do you say that I make the changes based on the propose above? It is vital that node-mysql/node-mysql2 support this mysql protocol feature for us.

@sidorares
Copy link
Member

@twocode it's relatively specific change that you need (and no one else requested), I'm afraid that the only reliable way for you to make this happen soon is to start implementing feature and submit PR :)

@dougwilson
Copy link
Member

Hi @twocode, yes, please feel free to implement a pull request as you described like @sidorares suggested :) We can probably get this added at some point ourselves, but of course that would not have any good timeline, so providing a pull request is the fastest method.

Please try to ensure that this new auth switch packets and mechanisms are accompanied with tests as well. This module has two types of tests: "unit" tests which run against a fake MySQL server using this module and "integration" tests that run against actual MySQL servers. You can put the tests in which ever you feel is the most appropriate.

@sidorares sidorares mentioned this issue May 7, 2016
Merged
@twocode
Copy link
Author

twocode commented May 11, 2016

Thanks both. Let me prepare a patch first.

@sidorares sidorares mentioned this issue Jun 21, 2016
Merged
@DJ-DJL
Copy link

DJ-DJL commented Jan 31, 2017

I'm still getting this error today on node-mysql2 version 1.1.2 installed via npm. Was the fix reverted? or maybe the same symptoms have a different cause?

@dougwilson
Copy link
Member

Hi @DJ-DJL the mysql2 module is separate from this one.

@sidorares
Copy link
Member

yes, @DJ-DJL please fill issue at mysql2 repo with as much context as you have. As far as I know AuthSwitch is only supported by mysql2, feel free to help it ported to mysqljs

@DJ-DJL DJ-DJL mentioned this issue Feb 1, 2017
Open
@dougwilson dougwilson mentioned this issue May 14, 2017
Closed
@dougwilson dougwilson mentioned this issue May 14, 2017
Closed
bgrainger added a commit to bgrainger/mysql that referenced this issue May 14, 2017
@bgrainger
Support authentication switch request. Fixes mysqljs#1396
02f00b7 
Rename UseOldPasswordPacket to AuthenticationMethodSwitchRequestPacket
and implement its two other fields: plugin name & data.

Support mysql_native_password and mysql_old_password as potential
authentication methods (but still require 'insecureAuth:true' for the
latter).
bgrainger added a commit to bgrainger/mysql that referenced this issue May 14, 2017
@bgrainger
Support authentication switch request. Fixes mysqljs#1396
b4fec1d 
Rename UseOldPasswordPacket to AuthenticationMethodSwitchRequestPacket
and implement its two other fields: plugin name & data.

Support mysql_native_password and mysql_old_password as potential
authentication methods (but still require 'insecureAuth:true' for the
latter).
bgrainger added a commit to bgrainger/mysql that referenced this issue May 14, 2017
@bgrainger
Support authentication switch request. Fixes mysqljs#1396
2ae97d5 
Rename UseOldPasswordPacket to AuthenticationMethodSwitchRequestPacket
and implement its two other fields: plugin name & data.

Support mysql_native_password and mysql_old_password as potential
authentication methods (but still require 'insecureAuth:true' for the
latter).
bgrainger added a commit to bgrainger/mysql that referenced this issue May 14, 2017
@bgrainger
Support authentication switch request. Fixes mysqljs#1396
41f7e56 
Add optional auth plugin name and data to UseOldPasswordPacket. Support
mysql_native_password and mysql_old_password as potential authentication
methods (but still require 'insecureAuth:true' for the latter).
bgrainger added a commit to bgrainger/mysql that referenced this issue May 15, 2017
@bgrainger
Support authentication switch request. Fixes mysqljs#1396
dcea87a 
Add optional auth plugin name and data to UseOldPasswordPacket. Support
mysql_native_password and mysql_old_password as potential authentication
methods (but still require 'insecureAuth:true' for the latter).
bgrainger added a commit to bgrainger/mysql that referenced this issue May 15, 2017
@bgrainger
Support authentication switch request. Fixes mysqljs#1396
e3e123e 
Add optional auth plugin name and data to UseOldPasswordPacket. Support
mysql_native_password and mysql_old_password as potential authentication
methods (but still require 'insecureAuth:true' for the latter).
@bgrainger bgrainger mentioned this issue Jun 28, 2017
Closed
3 tasks
@elemount elemount mentioned this issue Jul 20, 2017
Closed
dougwilson pushed a commit that referenced this issue Aug 10, 2017
@bgrainger @dougwilson
Support mysql_native_password auth switch request for Azure
0517aad 
fixes #1396
fixes #1729
closes #1730
@GuuBu GuuBu mentioned this issue Oct 20, 2020
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
feature protocol_41
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Support authentication switch request and basic auth plugin.
4 participants
@dougwilson @sidorares @twocode @DJ-DJL