MySQL Integrated Security Issue

Hello,

Are you able to connect on the MySQL data source using the root username?

Best regards,

Hi Jeff,

I can connect using root and the other users that I have configured on there, it's just the windows authentication user that I'm having problems with.
In this environment the database running on a server and I'm connecting from my local machine. In this instance my domain account does have login permission on the database machine but I wouldn't have thought that was needed? The connection will also be routing externally so it's possible that firewalls are causing a problem, however I would expect that to prevent me from using RDM to the same database using non-integrated users.

Hi Paul,

Chances are the domain users have not been grant remote login rights to the MySQL instance.

Have a look at the grant statement, chances are you've grant localhost only. https://dev.mysql.com/doc/refman/5.7/en/grant.html

For a quick test grant, for any domain account, access from all hosts (%). If that works then figure out what host is required. Keep in mind, granting all hosts (%) may be a potential security vulnerability, grant specific hosts or subnet for example.

Best regards,

I believe the issue may have been network related, I moved the database to an internal machine and I can connect to it fine from my local machine using integrated security now.
However, I now have another problem. As mentioned I have no problems using the integrated security data source from my local machine, and I have also had a colleague who currently uses RDM add this data source and he can connect fine too. But, after creating a new custom installer for this data source and installing it on a fresh VM and a fresh physical machine when trying to connect to the data source it is unable to but only provides an 'Object reference not set to an instance of an object' error message. Both machines can connect to the data source using the Admin user, it only fails when enabling integrated security.

This is the stack provided:


NullReferenceException - Object reference not set to an instance of an object.

at MySql.Data.MySqlClient.Authentication.MySqlNativePasswordPlugin.MoreData(Byte[] data)
at MySql.Data.MySqlClient.Authentication.MySqlAuthenticationPlugin.AuthenticationChange()
at MySql.Data.MySqlClient.Authentication.MySqlAuthenticationPlugin.HandleAuthChange(MySqlPacket packet)
at MySql.Data.MySqlClient.Authentication.MySqlAuthenticationPlugin.Authenticate(Boolean reset)
at MySql.Data.MySqlClient.NativeDriver.Authenticate(String authMethod, Boolean reset)
at MySql.Data.MySqlClient.NativeDriver.Open()
at MySql.Data.MySqlClient.Driver.Open()
at MySql.Data.MySqlClient.Driver.Create(MySqlConnectionStringBuilder settings)
at MySql.Data.MySqlClient.MySqlPool.CreateNewPooledConnection()
at MySql.Data.MySqlClient.MySqlPool.GetPooledConnection()
at MySql.Data.MySqlClient.MySqlPool.TryToGetDriver()
at MySql.Data.MySqlClient.MySqlPool.GetConnection()
at MySql.Data.MySqlClient.MySqlConnection.Open()
at Devolutions.RemoteDesktopManager.Business.DataSources.DatabaseConnectionDataSource.GetData(String sql, IDbDataParameter[] parameters)
at Devolutions.RemoteDesktopManager.Business.DataSources.MySQLConnectionDataSource.GetDataSourceSettings()
at Devolutions.RemoteDesktopManager.Managers.ConnectionManager.c29fbd34504079a3525ca4c390d5d4074(BaseConnectionDataSource c7f28727fc7a5daa94ba08f688b2a5781)
at Devolutions.RemoteDesktopManager.Managers.ConnectionManager.ca4799bebd8b706f34eea94a778843b55(BaseConnectionDataSource c01af917dca3518ff73ed69848f95f91a, Boolean cfe205b02d73750f8fd14d199343fe545)
at Devolutions.RemoteDesktopManager.Managers.ConnectionManager.LoadConnections(BaseConnectionDataSource dataSource)
at Devolutions.RemoteDesktopManager.Managers.ConnectionManager.RefreshConnections()
at Devolutions.RemoteDesktopManager.Forms.FrmMainRibbonBase.RefreshAllConnectionView(Boolean saveState, Boolean checkOnline)
at Devolutions.RemoteDesktopManager.Managers.MainFormManager.DoFirstLoad(IMainForm mainform)
at Devolutions.RemoteDesktopManager.Forms.FrmMainDocumentManager.cae3b4c7c167cf0d9747ac4fee11ac00a(Object c19f185fd70cefc696ba148af1c4faf54, EventArgs cf1018bb83ec7debd818319fd3cb4844e)
at System.Windows.Forms.Timer.OnTick(EventArgs e)
at System.Windows.Forms.Timer.TimerNativeWindow.WndProc(Message& m)
at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)


As these are new machines I'm wondering if there is an additional dependency that I'm missing?

You might be missing the "MySQL Windows Pluggable Authentication" plugin libraries.

https://dev.mysql.com/doc/refman/5.7/en/windows-pluggable-authentication.html

I haven't knowingly installed them on the two machines I've confirmed this working on, however they do both have MySQL community edition installed on them which the new machines don't.
Does this mean the it is necessary to install MySQL on every client machine?

No, my bad, the plugin is only installed on the server not the clients. So it can't be the cause of the issue.

Back to the original question

Everything that RDM needs to run is included within the installer. So the answer would be no, unless the MySQL driver needs something special to perform the integrated security login.

I'm not an expert of MySQL, let alone the "MySQL Windows Pluggable Authentication" module. We will have to go at it by process of elimination (ie. trial & error).

1 - Can we test to see if the custom installer causes issues with the datasource. Can you create a new datasource on the fresh machines to see if that changes anything.

2 - On the fresh machine can you install Workbench? Are you able to connection using Workbench & integrated security? If so does it work now in RDM?

Best regards,

Just to test this out I installed MySQL community on one of these machines and still getting the same error. I've then test connecting to the data source directly using the mysql shell and using the windows authentication method and it connects fine too, it is only failing through the app itself.

OK, it is now working on one of the machines, but I'm not entirely clear what the solution was. After installing MySQL, I added the domain user account to the local administrator group, logged out and back in, then ran the app as administrator. This worked, I then closed the app and ran it without the 'as administrator' option and it still works.
The odd thing is that on the second fresh machine, my domain account is already in the local admin group, so I'm thinking it could be the logging out that fixed it, just waiting to get access to the second machine to double check this.

Yeah, it does seem to be a permission issue. The domain user has to be a member of the local machine administrator group, and in most cases it was necessary to log off and back on after installing remote desktop manage to resolve the error.

This should at worst be a minor hindrance to our rollout but is unusual behaviour. We're running with version 12.6.6.0 so it is possible that this could be something that is resolved in current versions.