Repository navigation
Support caching_sha2_password authentication plugin with Proxy in Unix Socket mode #2317
Description
Activity
- changed the title
[-]Support `cachine_sha2_password` authentication plugin with Proxy in Unix Socket mode[/-][+]Support `caching_sha2_password` authentication plugin with Proxy in Unix Socket mode[/+]on Oct 30, 2024 Hi @jackwotherspoon is there an ETA on a fix for this? We're looking to update our MySQL 5.7 databases to 8.4 but are being blocked by this bug because it's affecting App Engine connections to Cloud SQL. We use PHP so can't use the connector workaround.
Reacted by Vitaliy Demidov, UZHS, Arvind Subramanian and Kenny Leungis there an ETA on a fix for this? We're looking to update our MySQL 5.7 databases to 8.4 but are being blocked by this bug because it's affecting App Engine connections to Cloud SQL. We use PHP so can't use the connector workaround.
@simon-peek-poke I know the MySQL team is actively working on the fix to this.
Let me reach out and see if they can provide me with an ETA. Will report back 😄
As a workaround connect once with tcp, and then you can connect with sockets.
Another workaround is to connect once with GCP consoles new "Cloud SQL Studio"daniel@legski:~$ mysql -h 127.0.0.1 --port 3307 -u dantest2 -p Enter password: ERROR 2061 (HY000): Authentication plugin 'caching_sha2_password' reported error: Authentication requires secure connection. daniel@legski:~$ mysql -h 127.0.0.1 --port 3307 -u dantest2 -p --get-server-public-key Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 47942 Server version: 8.4.3-google (Google) Copyright (c) 2000, 2025, Oracle and/or its affiliates. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. mysql> exit Bye $ mysql -S ~/cloudsql/xxxx\:australia-southeast1\:store-dev2-0-a18cc097 -u dantest2 -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 49911 Server version: 8.4.3-google (Google) Copyright (c) 2000, 2025, Oracle and/or its affiliates. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. mysql>Reacted by UZHS, Arvind Subramanian, jnoguera-bc, sshoff-wzc and Kenny LeungFrom further research it seems that workaround is only temporary due to some server caching mecahanism.
From further research it seems that workaround is only temporary due to some server caching mechanism.
@dantheperson Yes the
caching_sha2_passwordauthentication plugin will cache secure connections for a given period, which is why your workaround works temporarily. However, as you mentioned once the cache entry expires then the full authentication would be required on the next connection attempt.I have escalated this issue internally to the MySQL team and they are hoping to get the fix out for it ASAP.
Reacted by Simon MorrisDoes this issue affect accounts with access via IAM Group authentication, or does it only affect native/built-in database users?
Does this issue affect accounts with access via IAM Group authentication, or does it only affect native/built-in database users?
@dantheperson I believe this issue should only affect native/built-in database users.
IAM database users (IAM user, service account, groups etc.) all go through their own different authentication flow.
Reacted by danthepersonHi there! I'm wondering if there is a timeline for resolving this issue?
Hi there! I'm wondering if there is a timeline for resolving this issue?
@copyrighthero Yes, although I can't provide a specific date but I can detail the plans.
For
caching_sha2_passwordsupport over unix sockets we require changes to the Cloud SQL Proxy client (this repo), the Cloud SQL Proxy Server (runs on the Cloud SQL VM alongside the database engine), and the Cloud SQL for MySQL database engine.Due to these changes they require several rollouts which will take some time, the tentative completion based on this would be some time in Q3.
Reacted by UZHS, Norbert Egger, Marcelo Clavel, Juuso Turunen, SBNTT and syossan27Reacted by UZHS and Inada Naoki9 remaining items
- added a commit that references this issue
on Oct 29, 2025 - added a commit that references this issue
on Oct 29, 2025 - added a commit that references this issue
on Oct 29, 2025 Since the issue is closed, I assume that it is not in testing anymore but has been released in the
2.19.0versionHowever I am having an issue still :
mysql -u <user> -P 3306 -h 127.0.0.1 -p
Output :
ERROR 2061 (HY000): Authentication plugin 'caching_sha2_password' reported error: Authentication requires secure connection.My
cloud-sql-proxyversion :cloud-sql-proxy --versionOutput :
cloud-sql-proxy version 2.20.0cloud-sql-proxy with the
--debug-logsflag :2025/12/22 10:56:02 [instance] Cert is valid = true 2025/12/22 10:56:02 [instance] Dialing xx.xx.xx.xxx:3307 2025/12/22 10:56:02 dial successful 2025/12/22 10:56:02 [instance] Reading MDX response... 2025/12/22 10:56:02 MDX Read: No MDX response, first 1 bytes do not match MDX signature. %!v(MISSING) 2025/12/22 10:56:02 [instance] Writing MDX request, protocol:TCP... 2025/12/22 10:56:02 [instance] MDX request sent successfully. 2025/12/22 10:56:02 [instance] IO Error on Read or Write: read tcp xx.x.x.x:xxxxxx->xx.xx.xx.xxx:3307: use of closed network connectionWe recently updated to MySQL 8.4 on our dev servers and are still seeing this as well. With the added problem of Google now warning for added charges on maintaining MySQL 8.0 instances, this is a serious problem for us.
(1045, "Access denied for user 'my-user'@'cloudsqlproxy~34.56.zzz.xxx' (using password: YES)")
Has this been rolled out? If so, is there a reason an App Engine Flex deployment using the proxy would still be running into it?
- you've got a year yet until GCP start charging extended support on mysql 8.0 https://docs.cloud.google.com/sql/docs/db-versions#database-version-support…On Thu, 26 Feb 2026 at 08:19, S. Paquette ***@***.***> wrote: *s-paquette* left a comment (GoogleCloudPlatform/cloud-sql-proxy#2317) <#2317 (comment)> We recently updated to MySQL 8.4 on our dev servers and are still seeing this as well. With the added problem of Google now warning for added charges on maintaining MySQL 8.0 instances, this is a serious problem for us. (1045, "Access denied for user 'my-user'@'cloudsqlproxy~34.56.zzz.xxx' (using password: YES)") Has this been rolled out? If so, is there a reason an App Engine Flex deployment using the proxy would still be running into it? — Reply to this email directly, view it on GitHub <#2317 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGIY6ZTUHAHJ5SCSLKIH7T4NXYTRAVCNFSM6AAAAABQ2BCKRSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTSNRRGQ2TMOBXHE> . You are receiving this because you were mentioned.Message ID: ***@***.***>-- Sent from my computer
Although it's a year out, I prefer not to cut things close. As mentioned above we already upgraded one database and now have to roll it back due to inability to use it in 8.4 on App Engine Flex, unless we want to write our own custom solution to get Django to connect to it (Django doesn't officially support PyMySQL, which is what the CloudSQL Python Connector supports, so we can't use the connector unless we want to implement our own engine as a workaround).
What is the status of this issue? We're having issues connecting from Cloud Run to MySQL 8.4 instances from .NET over Unix sockets (no cloud connector available) with users using
caching_sha2_password.Reacted by jnoguera-bcI think the idea is to not migrate to 8.4 yet, stay on 8.0 to maintain functionality.
Not ideal of course but Google is not seeing this as a priority.More discussions have been had at google discuss:
https://discuss.google.dev/t/cloud-run-cant-connect-to-mysql-after-google-cloud-sql-maintenance/187391/5
At that time october 2025 was the expected (hopeful?) timeline for a fix. There might perhaps be some miscommunication around this issue that keeps it in limbo.Very odd that Google is pushing us to upgrade to MySQL 8.4 (since 8.0 is moving to extended support next year) while this bug is not getting fixed.
Reacted by jnoguera-bc, S. Paquette, jgolwala-xumo and Daniel MolendaApp Engine Flex has been upgraded to the new proxy (2.0) as of a couple of weeks ago so it's been taken care of; this might? have fixed App Engine Standard as well, though I have no deployment in standard which uses MySQL with which I can confirm that.
If you're still seeing the error in Cloud Run then they've not yet migrated that to the 2.0 proxy, is my guess (you can often confirm this by looking in the logs for the deprecation warning when the deployment first goes live).
Hi all, thank you for bringing this to our attention.
@s-paquette: Just to make sure I understand, are you able to successfully connect using a Unix socket with Proxy v2? I am curious, which version of the Auth Proxy are you currently using?
@karlmacklin: Hi Karl. To help us investigate this further, could you clarify your specific application environment and how the Auth Proxy/client is being used in your setup? Thanks!
@panavenue Yes, we've been able to use UNIX sockets with auth proxy v2 on App Engine Flex to connect to a MySQL 8.4 CloudSQL instance. (In our specific case we can't use the Python Connector because it doesn't support Django.) We use the default Auth Proxy provided in AppEngine Flex, which has been v1 (and was showing a deprecation warning for some time now upon deployment) until recently. It seems to have been updated to v2, at least for our orgs and projects; it's possible this hasn't been a wide release yet and you may need to contact Google to get it done, if they're still testing it before full availability.
@panavenue
It's just Wordpress running as Cloud Run function.So it's PHP. I believe Wordpress uses php mysqli to initiate mysql connection. Just the basic standard way of connecting to a mysql server from PHP.
The connection "host" string looks like this, anonymized:
:/cloudsql/${projectname}:europe-north1:${mysqlservername}Works fine until the server gets maintenance/restarts. Then all connections are impossible to initiate. Until you manually connect via the gui in google cloud or - IIRC - using a mysql client like HeidiSQL/similar. That revives the connection and it works until next maintenance.
The Cloud SQL Proxy currently does not support the
caching_sha2_passwordauthentication plugin when listening over a unix socket.This is an issue as in MySQL 8.4,
caching_sha2_passwordhas now become the default authentication plugin. Any new database users created with thecaching_sha2_passwordwill be unable to log in via the Proxy over unix socket.Failed logins are not always clear that the authentication plugin is the root cause of the issue:
Some Cloud SQL Language Connectors are a viable alternative and workaround at the moment as they work with MySQL 8.4 and the
caching_sha2_passwordplugin:Unfortunately, the Java connector does not work with MySQL 8.4. We are actively working on a fix for the Java connector also.