Support for caching_sha2_password plugin

[Pio82]

Running MySQL 8.0 on Linux Ubuntu 18.04 unable to login with RMariaDB package on RStudio. User password plugin uses caching_sha2_password on MySQL 8.0. Is this something RMariaDB will support? I'd rather not have to change the plugin to the less secure mysql_native_password system.

[krlmlr]

Thanks for raising this.

I don't have MySQL 8.0 to test this, but I guess I can compose one using the instructions on the Docker site.

Could you please share the code and the output?

[J-Benitez]

This is an issue which I am also experiencing as I connect to a MySQL v8.0. More information about the issue can be found at https://mariadb.com/kb/en/library/authentication-plugin-sha-256/. MySQL 8 changed the default authentication from mysql_native_password to caching_sha2_password. The standard con<-dbConnect(RMariaDB:MariaDB(),dbname="schema",host="xxx.xxx.xxx.xxx", port=3306,user="username",password = "password") throws the

Error in connection_create(host, username, password, dbname, as.integer(port), :

Failed to connect: Plugin caching_sha2_password could not be loaded: The specified module could not be found.

[Rhydderch]

Did anyone found a solution for this ?
When I use the other method of authentication, which isn't supported anymore by MySQL v8.0, I get this error : Failed to connect: Plugin sha256_password could not be loaded

[Rhydderch]

Apparently both (sha526 and caching_sha2) are not longer supported in MySQL 8 and in mariaDB.
https://mariadb.com/kb/en/authentication-plugin-sha-256/

Apparently this is the new plugin to connect:
https://mariadb.com/kb/en/authentication-plugin-ed25519/
Is it implemented in the package ?

EDIT:
I can connect fine with:
user_data_db<-dbConnect(RMariaDB::MariaDB(), user='3c_admin', password=localuserpassword, dbname='3c_dashboard', host='localhost')

However, the plugin errors appear as soon as I try to use the config file this way
user_data_db<-dbConnect(RMariaDB::MariaDB(),group=rmariadb.db)

[krlmlr]

Plugins are part of a server's configuration. I don't understand how this is relevant for the client library?

[arencambre]

@Rhydderch can you verify your "not longer supported" statement? https://dev.mysql.com/doc/refman/8.0/en/caching-sha2-pluggable-authentication.html says that "caching_sha2_password is the default authentication plugin" for MySQL 8.0.

[krlmlr]

On Ubuntu 18.04 I see:

$ apt-file search caching_sha2_password
# no output
$ apt-file search client_ed25519
libmariadbclient18: /usr/lib/x86_64-linux-gnu/mariadb18/plugin/client_ed25519.so

So the newer client_ed25519 plugin seems to be available in the libmariadbclient18 package, but caching_sha2_password can't be found anywhere. The development package for the client library doesn't contain any trace of plugins, as shown by apt-file show libmariadbclient-dev. This makes me think that we need somehow to include caching_sha2_password.so in the libmariadbclient18 package.

I'm having a hard time tracking down the source of this package. I see:

$ apt show libmariadbclient18
Package: libmariadbclient18
Version: 1:10.4.17+maria~bionic
Priority: optional
Section: libs
Source: mariadb-10.4
Maintainer: MariaDB Developers <maria-developers@lists.launchpad.net>
Installed-Size: 13.3 kB
Provides: libmariadbclient18
Depends: libmariadb3 (= 1:10.4.17+maria~bionic)
Replaces: libmariadbclient18
Homepage: http://mariadb.org/
Download-Size: 3'224 B
APT-Sources: http://mirrors.tuna.tsinghua.edu.cn/mariadb/repo/10.4/ubuntu bionic/main amd64 Packages
Description: Virtual package to satisfy external libmariadbclient18 depends
 MariaDB is a fast, stable and true multi-user, multi-threaded SQL database
 server. SQL (Structured Query Language) is the most popular database query
 language in the world. The main goals of MariaDB are speed, robustness and
 ease of use.
 .
 This package provides compatibility symlinks for binaries that expect to find
 libmariadbclient.so.18 will automatically use libmariadb.so.3 instead.

N: There are 4 additional records. Please use the '-a' switch to see them.

Many blog posts and bug reports mentioning caching_sha2_password really recommend downgrading to insecure auth. I wish we could do better here, I'm not sure how. Has this been discussed in the MariaDB issue tracker?

[jeroen]

Would it be possible to test this again with the latest CRAN version of RMariaDB and see what error you get this time?

[grooverdan]

I suspect this is purely packaging and not RMariaDB's fault.

https://mariadb.com/kb/en/authentication-plugin-sha-256/ shows the continued support of caching_sha2_password in the client libraries that RMariaDB uses.

@krlmlr is on the right track with the libmariadbclient18 which was based on MariaDB-10.0 and didn't have caching_sha2_password.so.

This package is renamed to libmariadb3 in later Debian/Ubuntu versions but is essentially the same.
The debian bug 962597 is the root cause of this issue where other users of connection libraries cannot access caching_sha2_password due to it not being packages.

This was fixed in Debian bullseye but not buster. Likewise fixed in Ubuntu groovy but not focal.

Even MariaDB didn't fix this in their Debian packaging until 10.5 (I've just created MDEV-24728 - and will get this into an upstream release).

Every packaged version based on MariaDB-10.1 onwards does have caching_sha2_password source code in its original.

I recommend following this up with a Ubuntu focal bug (bionic has older connector C version), and (another) Debian buster bug. Along with every distro MariaDB-10.1+/MariaDB-connector-c-3.0.8+ based package that fails to install caching_sha2_password.so.

Include links to issues back here to save duplication of bug reporting effort.

[krlmlr]

Thanks @grooverdan for your detailed analysis.

I don't have the resources to take this upstream to Debian Buster and Ubuntu Focal and to other distros. Leaving this open for now, please post links to relevant upstream issues here.