Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Confusing exception message for yubikey protected servers #987

Closed
KaibutsuX opened this issue Jun 15, 2021 · 3 comments · Fixed by #1004
Closed

Confusing exception message for yubikey protected servers #987

KaibutsuX opened this issue Jun 15, 2021 · 3 comments · Fixed by #1004

Comments

@KaibutsuX
Copy link

I use a bunch of mariadb servers which are protected with password+yubikey.

I'm not clear on how it's configured within the server, I don't really have visibility to that, all I know is that from PDB'ing the auth/connect code in pymysql that it looks like it's expecting the password prompt to literally be exactly: Password:

However in my case, the prompt (connections.py:912) is actually: Yubikey + password:

To Reproduce

python -c "import pymysql; pymysql.connect(host='mariadb-server', user='root', passwd='xxxx')"
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/usr/lib/python3.9/site-packages/pymysql/connections.py", line 353, in __init__
    self.connect()
  File "/usr/lib/python3.9/site-packages/pymysql/connections.py", line 633, in connect
    self._request_authentication()
  File "/usr/lib/python3.9/site-packages/pymysql/connections.py", line 921, in _request_authentication
    auth_packet = self._process_auth(plugin_name, auth_packet)
  File "/usr/lib/python3.9/site-packages/pymysql/connections.py", line 1002, in _process_auth
    raise err.OperationalError(
pymysql.err.OperationalError: (2059, "Authentication plugin 'b'dialog'' (None) not configured")

Expected
I don't know if I can register my own handler for this (not that it would really do much good, I don't want to write a yubikey token parser and all that) but at a very minimum I think it would be helpful to see the actual prompt or some other kind of message that at least says something to the effect of 'prompt type is not understood' instead of the above plugin 'dialog' (None) not configured

Environment

  • OS: Linux (Arch, Centos7)
  • Server and version:MariaDB 10.3.27
  • PyMySQL version: all versions at least 0.7.2 and newer

Additional context

In my specific scenario it appears that I am hitting this because from certain network subnets my root credentials work fine without ever invoking the prompt code, but on other subnets the root user is restricted without a yubikey and therefore I get the unsupported prompt type.

@methane
Copy link
Member

methane commented Jun 15, 2021

MySQL server requested "dialog" auth plugin. And PyMySQL don't know how to handle the "dialog" auth plugin. That's why error message use the term "dialog".
Prompt is not necessary to implement "dialog" auth plugin. So 'prompt type is not understood' is worse than current error message.

@KaibutsuX
Copy link
Author

PyMySQL certainly knows how to use the dialog plugin, but apparently only if the prompt is Password: or if a suitable handler has been configured. Again, see line 913 of connections.py.

@KaibutsuX
Copy link
Author

If the MySQL server is configured to ask:

Please enter your shoe size: and pymysql only expects a password prompt, it seems common sense to show a message relevant to the specific prompt that can't be handled instead of a generic exception message that actually contains the python literal None and no reference to the prompt which is actually unsupported.

methane added a commit to methane/PyMySQL that referenced this issue Aug 28, 2021
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Aug 29, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants