4.5.3 Overview of Connector/NET Authentication

4.5.3.1 Using the Windows Native Authentication Plugin

4.5.3.2 Writing a Custom Authentication Plugin

MySQL Connector/NET implements a variety of authentication plugins that MySQL Server can invoke to authenticate a user. Pluggable authentication enables the server to determine which plugin applies, based on the user name and host name that your application passes to the server when making a connection. For a complete description of the authentication process, see Pluggable Authentication.

Connector/NET provides the following authentication plugins and methods:

• mysql_native_password

  Supported for all versions of Connector/NET.

• sha256_password

  Minimum version: Connector/NET 8.0.11

  Supported for both classic MySQL protocol and X Protocol connections. For additional information on using the MYSQL41 mechanism with X Protocol, see the Auth connection option.

• caching_sha2_password

  Minimum version: Connector/NET 8.0.11 for classic MySQL protocol connections only.

• authentication_windows_client

  Supported for all versions of Connector/NET.

• authentication_ldap_sasl_client

  SASL-based LDAP authentication for Connector/NET requires the Enterprise Edition of MySQL and the authentication protocol applies to clients running on Windows and Linux, but not macOS.

  Minimum version:

  • Connector/NET 8.0.22 (SCRAM-SHA-1)

  • Connector/NET 8.0.23 (SCRAM-SHA-256) for classic MySQL protocol only

  • Connector/NET 8.0.24 (GSSAPI) for classic MySQL protocol only

    MIT Kerberos must be installed on each client system to enable authentication of request tickets for Connector/NET by a MySQL server when the user is identified as follows:

    IDENTIFIED WITH authentication_ldap_sasl

    and the authentication_ldap_sasl plugin is configured to use the GSSAPI mechanism.

    The required libraries are:

    • gssapi32.dll / gssapi64.dll for Windows

    • libgssapi_krb5.so.2 for Linux

• mysql_clear_password

  Minimum version: Connector/NET 8.0.22 for classic MySQL protocol only.

  Requires a secure connection to the server, which is satisfied by either condition at the client:

  • The SslMode connection option has a value other than None (Preferred by default).

  • The ConnectionProtocol connection option is set to unix for Unix domain sockets.