community.proxysql icon indicating copy to clipboard operation
community.proxysql copied to clipboard

Creating users with the caching_sha2_password plugin

Open srgtest opened this issue 1 year ago • 2 comments

SUMMARY

I couldn't find it in the documentation.
Is there any plan to support the caching_sha2_password plugin for users created with the caching_sha2_password plugin? We updated Percona XtraDB Cluster to 8.0.36, it already has caching_sha2_password by default. But we haven’t switched to it yet and are using the outdated mysql_native_password (already removed in MySQL 9.0). What's the current workaround for creating users with a plugin like this?

ISSUE TYPE
  • Feature Idea
  • encryption_method - caching_sha2_password
COMPONENT NAME
ADDITIONAL INFORMATION

srgtest avatar Jul 18 '24 13:07 srgtest

I completed the task using additional processing. First, I get a HEX from the authentication_string for a given user from the mysql.user table, then I get it UNHEX using ProxySQL and then substitute the required value in the next task. It works as it should and is universal, regardless of the plugin used: mysql_native_password or caching_sha2_password.

srgtest avatar Jul 19 '24 12:07 srgtest

Available since proxysql 2.6.0 https://github.com/sysown/proxysql/releases/tag/v2.6.0

  • https://proxysql.com/documentation/global-variables/mysql-variables/#mysql-default_authentication_plugin
    • set mysql-default_authentication_plugin = 'caching_sha2_password';

Add than a User with empty password '' and do

UPDATE mysql_users SET password=UNHEX('<authentication_string>') WHERE username='<USER>';

Basically the proxysql_mysql_users must checkout the current mysql-default_authentication_plugin value and do the UNHEX thing if the value is set to caching_sha2_password.

@srgtest do you have time to contribute this feature?

markuman avatar Oct 15 '24 10:10 markuman