Is allowPublicKeyRetrieval property supported?

[tjlee]

Question

In DataGrip project we've received a request https://youtrack.jetbrains.com/issue/DBE-22097/DataGrip-MySQLCloud-SQL-proxy-driver-does-not-respect-the-allowPublicKeyRetrieval-advanced-configuration-option .

So, I'm interested is allowPublicKeyRetrieval either supported or not for JDBC connections?

Code

No response

Additional Details

No response

[jackwotherspoon]

Hi @tjlee thanks for raising an issue on the Java Connector 😄

Let me take a look into this for you and report back as I believe caching sha2 support with this lib should work...

[hessjcg]

Hi @tjlee I'm tested out allowPublicKeyRetrieval with the Java connector and it did not immediately work. I'm going to continue to investigate.

[hessjcg]

The mysql sha2 password protocol sends passwords in plain text when the connection uses an SSLSocket. The Cloud SQL Java Connector always creates SSLSocket. So the mysql-connector-j plugin will always send a plain-text password when used together with the Cloud SQL Java Connector. See CachingSha2PasswordPlugin.java:106

There is a bug in the server-side of the Cloud SQL implementation that breaks the caching_sha2_password authentication plugin for all of the Cloud SQL Connectors and Cloud SQL Auth Proxy. The caching_sha2_password plugin is default authentication plugin in Mysql 8.4 and higher.

We are working on a fix. See also GoogleCloudPlatform/cloud-sql-proxy#2317

[yodeyer]

Hi,
We are trying to connect our Spring Boot application (with spring-cloud-gcp, that uses cloud-sql-jdbc-socket-factory library) and CloudSQL MySQL 8.4.
We have the same issue (the connection fails, except if we connect with mysql-client linux cli before).

This issue says that the library doesn't support caching_sha2_password authentication, but this comment says it should work :

The Cloud SQL Language Connectors are a viable alternative and workaround at the moment as they work with MySQL 8.4 and the caching_sha2_password plugin

What is the actual status ? Should this connector work or not with caching_sha2_password ? If no, is there a workaround ?

EDIT : We managed to connect to the database using an IAM Service Account.

[hessjcg]

Hi @yodeyer,

Please accept our apologies for the confusion. The comment on cloud-sql-proxy #2317 is misleading. I have updated it.

Right now, the Java Connector does not work with Mysql 8.4 when using a caching_sha2_password. We are actively working on a fix.