Bug #92290 mysql_change_user() don't uses given password (sha256_password)

• Submitted: 5 Sep 2018 1:20
• Modified: 5 Sep 2018 5:51
• Reporter: Jose Israel Gomez Delgado
• Status: Verified
• Category: MySQL Server: C API (client library)
• Severity: S3 (Non-critical)
• Version: 5.6.41
• OS: Any
• CPU Architecture: Any
• Tags: mysql_change_user(), password

[5 Sep 2018 1:20] Jose Israel Gomez Delgado

Description:
While using:
  mysql_change_user(&mysql, "sha256user", "sha256p@ss", "new_database")

got Access denied for user 'sha256user'@'127.0.0.1' (using password: NO)

The original user was 'root', w/o password.

The problem seems to be only with a user that uses 'sha256_password' plugin authentication over MySQL 5.6.41.

How to repeat:
Create user like:
mysql> SET old_passwords = 2;
mysql>CREATE USER 'sha256user'@'localhost'  IDENTIFIED WITH sha256_password;
mysql>SET PASSWORD FOR 'sha256user'@'localhost' = PASSWORD('sha256P@ss');

Suggested fix:
Make mysql_change_user() success for userd with sha256_password.

[5 Sep 2018 1:46] Jose Israel Gomez Delgado

More setup details:
SET old_passwords = 2; 
was used prior to:
SET PASSWORD FOR 'sha256user'@'localhost' = PASSWORD('sha256P@ss');

Note:
Also created another user with sha256_password, but w/o setting any password, an got same error.