MySQL Bugs: #108158: mysqlsh --passwords-from-stdin not working

Bug #108158	mysqlsh --passwords-from-stdin not working
Submitted:	16 Aug 2022 18:09	Modified:	26 Aug 2022 17:15
Reporter:	Jay Janssen	Email Updates:
Status:	Closed	Impact on me:	None
Category:	Shell General / Core Client	Severity:	S3 (Non-critical)
Version:	5.0.30	OS:	Any
Assigned to:		CPU Architecture:	Any

Description:
mysqlsh prompts me for my password even when using --passwords-from-stdin properly (I think).

I am passing the password in with the bash '<<<' like this:

mysqlsh -u tester --passwords-from-stdin --nw 10.160.132.63 <<< "testpassworD1$"

I have tried various things like single quotes, double quotes, no quotes, adding a new line, adding a '\n', the --nw flag, etc.  I always get the password prompt.  You can see in repeat steps below I can use the password to login with the standard mysql client.  

How to repeat:
 MySQL  localhost:33060+ ssl  SQL > create user 'tester'@'%' identified by 'testpassworD1$';
Query OK, 0 rows affected (0.0063 sec)

[root@ip-10-160-132-63 ~]# mysql -u tester -ptestpassworD1$ -h 10.160.132.63
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 7271
Server version: 8.0.30 MySQL Community Server - GPL

Copyright (c) 2000, 2022, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> ^DBye
[root@ip-10-160-132-63 ~]#  mysqlsh -u tester --passwords-from-stdin --nw 10.160.132.63 <<< 'testpassworD1$'
MySQL Error 1045: Access denied for user 'tester'@'10.160.132.63' (using password: NO)

Datacharmer (Giuseppe Maxia) already raised similar issue and that's whey we implemented the support of login-path with higher priority.

See this thread: http://datacharmer.blogspot.com/2018/02/the-confusing-strategy-for-mysql-shell.html

As a workaround, you can set MYSQLSH_CREDENTIAL_STORE_HELPER="<disabled>" (environment variable)

Just some examples with Alfredo's workaround:

$ echo 'Passw0rd!' | MYSQLSH_CREDENTIAL_STORE_HELPER="<disabled>" mysqlsh fred@localhost \
          --passwords-from-stdin --sql -e "select now()"
Please provide the password for 'fred@localhost': now()
2022-08-17 07:31:25

$ MYSQLSH_CREDENTIAL_STORE_HELPER="<disabled>" mysqlsh fred@localhost \
         --passwords-from-stdin --sql -e "select now()" <<< 'Passw0rd!'
Please provide the password for 'fred@localhost': now()
2022-08-17 07:32:35

With -i it works too:

$ MYSQLSH_CREDENTIAL_STORE_HELPER="<disabled>" mysqlsh fred@localhost \
     --passwords-from-stdin -i --sql -e "select now()" <<< 'Passw0rd!'
Please provide the password for 'fred@localhost': MySQL Shell 8.0.30

Copyright (c) 2016, 2022, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its affiliates.
Other names may be trademarks of their respective owners.

Type '\help' or '\?' for help; '\quit' to exit.
Creating a session to 'fred@localhost'
Your MySQL connection id is 52 (X protocol)
Server version: 8.0.30 MySQL Community Server - GPL
No default schema selected; type \use <schema> to set one.
+---------------------+
| now()               |
+---------------------+
| 2022-08-17 07:33:06 |
+---------------------+
1 row in set (0.0001 sec)

However the option --nw it is NOT working:

$ MYSQLSH_CREDENTIAL_STORE_HELPER="<disabled>" mysqlsh fred@localhost  \
    --passwords-from-stdin --nw --sql -e "select now()" <<< 'Passw0rd!'
MySQL Error 1045: Access denied for user 'fred'@'localhost' (using password: NO)

The workaround does not work for my use case as I'm still getting a password prompt.  As Fred points out, --nw suppresses the prompt, but then access is denied.

I don't want login path either at this point so the PW is not sitting on disk.

Posted by developer:
 
Added the following note to the MySQL Shell 8.0.31 release notes:

Passwords were not accepted when provided by the --passwords-from-stdin command-line option.