MySQL Bugs: #72514: mysqldump and mysqlbinlog do not support --enable-cleartext-plugin

Bug #72514	mysqldump and mysqlbinlog do not support --enable-cleartext-plugin
Submitted:	2 May 2014 12:26	Modified:	6 May 2014 12:40
Reporter:	Joshua Prunier	Email Updates:
Status:	Not a Bug	Impact on me:	None
Category:	MySQL Server: mysqldump Command-line Client	Severity:	S3 (Non-critical)
Version:	5.5.10+	OS:	Any
Assigned to:		CPU Architecture:	Any
Tags:	PAM clear text --enable-cleartext-plugin

Description:
Command line clients mysqldump, mysqlbinlog and possibly others do not support the --enable-cleartext-plugin option. Thus user accounts defined to authenticate with PAM can not use those commands.

How to repeat:
Attempt to use mysqldump or mysqlbinlog with a user defined to authenticate with PAM.

mysqldump -upamuser -p -B test > test.dmp
Enter password:
mysqldump: Got error: 2059: Authentication plugin 'mysql_clear_password' cannot be loaded: plugin not enabled when trying to connect

Suggested fix:
Add --enable-cleartext-plugin to command line clients that also have the --user login option.

Hello Joshua,

Thank you for the report.

Imho, you haven't set LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN environment variable, pls set the LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN environment variable to a 
value that begins with 1, Y, or y. This enables the plugin for all client connections. Please reference https://dev.mysql.com/doc/refman/5.5/en/cleartext-authentication-plugin.html

$ bin/mysql -uushastry -p
Enter password:
ERROR 2059 (HY000): Authentication plugin 'mysql_clear_password' cannot be loaded: plugin not enabled

$ export LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1

$ bin/mysql -uushastry -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 20
Server version: 5.5.38-debug-log Source distribution

Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>

export LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=0

## mysqldump

$ bin/mysqldump -uushastry -p --databases test
Enter password:
mysqldump: Got error: 2059: Authentication plugin 'mysql_clear_password' cannot be loaded: plugin not enabled when trying to connect
$ export LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1

$ bin/mysqldump -uushastry -p --databases test
Enter password:
-- MySQL dump 10.13  Distrib 5.5.38, for Linux (x86_64)
--
-- Host: localhost    Database: test
-- ------------------------------------------------------
-- Server version       5.5.38-debug-log

As much as I have looked at the cleartext and the PAM documentation I missed the  LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN environment variable. I confirm that setting the env variable allowed a PAM user to properly use mysqldump. Thank you very much Umesh!

Thank you for confirming.

Thanks,
Umesh

I think that's a bug, this option should be added to mysqldump and mysqlbinlog.

Tools like workbench fail for data export when cleartext is enabled because tries to use this option in mysqldump.

This parameter should be available on all clients that can make a connection with the server.

If mysql has this option I don't see why mysqldump and mysqlbinlog has to set an environment variable instead.

I tried using mysqlslap today on 5.7.28 with cleartext plugin and couldn't get it to work despite the --enable-cleartext-plugin option being enabled.

Found this bug report.   Indeed export LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1  works.
but why does mysqlslap need this and not mysql client ?  
Violates the element of least surprise.