apache/seatunnel · error · DebeziumException

Failed to authenticate to the MySQL database at <hostname>:<

Error message

Failed to authenticate to the MySQL database at <hostname>:<port> with user '<username>'

What it means

Thrown as a DebeziumException by MySqlStreamingChangeEventSource when the binlog client fails to authenticate to the MySQL server during CDC streaming (an AuthenticationException was caught). It means the hostname/port were reachable but the username/password combination was rejected. The connector wraps it with host, port, and user for diagnosis.

Source

Thrown at seatunnel-connectors-v2/connector-cdc/connector-cdc-mysql/src/main/java/io/debezium/connector/mysql/MySqlStreamingChangeEventSource.java:1235

                    long duration = clock.currentTimeInMillis() - started;
                    if (duration > (0.9 * timeout)) {
                        double actualSeconds = TimeUnit.MILLISECONDS.toSeconds(duration);
                        throw new DebeziumException(
                                "Timed out after "
                                        + actualSeconds
                                        + " seconds while waiting to connect to MySQL at "
                                        + connectorConfig.hostname()
                                        + ":"
                                        + connectorConfig.port()
                                        + " with user '"
                                        + connectorConfig.username()
                                        + "'",
                                e);
                    }
                    // Otherwise, we were told to shutdown, so we don't care about the timeout
                    // exception
                } catch (AuthenticationException e) {
                    throw new DebeziumException(
                            "Failed to authenticate to the MySQL database at "
                                    + connectorConfig.hostname()
                                    + ":"
                                    + connectorConfig.port()
                                    + " with user '"
                                    + connectorConfig.username()
                                    + "'",
                            e);
                } catch (Throwable e) {
                    throw new DebeziumException(
                            "Unable to connect to the MySQL database at "
                                    + connectorConfig.hostname()
                                    + ":"
                                    + connectorConfig.port()
                                    + " with user '"
                                    + connectorConfig.username()
                                    + "': "
                                    + e.getMessage(),

View on GitHub (pinned to cf67b549a7)

Solutions

1. Verify the username/password in the SeaTunnel MySQL CDC source config by logging in manually: mysql -h <host> -P <port> -u <user> -p
2. Grant replication privileges: GRANT SELECT, RELOAD, SHOW DATABASES, REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO '<user>'@'%';
3. Check the account host pattern allows the connector's source IP (user'@'%' vs 'user'@'localhost').
4. If MySQL 8 with caching_sha2_password, ensure SSL is enabled for the CDC connection or change the user to mysql_native_password.
5. If the password was rotated, update the config and restart the job.

Example fix

// before
"username" = "cdc_user",
"password" = "old_password"
// after
"username" = "cdc_user",
"password" = "correct_current_password"

// Validate MySQL credentials before starting the CDC job
try (Connection c = DriverManager.getConnection(
        "jdbc:mysql://" + host + ":" + port + "/?useSSL=true", user, pass)) {
    try (Statement s = c.createStatement();
         ResultSet rs = s.executeQuery("SELECT 1")) {
        if (!rs.next()) throw new IllegalStateException("auth probe failed");
    }
} // SQLException here => fix credentials/privileges before launching CDC

try {
    startCdcSource(config);
} catch (DebeziumException e) {
    if (e.getMessage() != null && e.getMessage().startsWith("Failed to authenticate")) {
        // halt and alert ops: don't retry with the same credentials
        log.error("MySQL CDC auth failed for user {} at {}:{}", user, host, port, e);
        throw new FatalConfigException("Check username/password/privileges", e);
    }
    throw e;
}

When it happens

Trigger: The MySQL binlog connection (via mysql-binlog-connector) receives an AuthenticationException while establishing the streaming connection with connectorConfig.username()/password() credentials.

Common situations: Wrong or rotated password in the connector config; user missing REPLICATION SLAVE/REPLICATION CLIENT privileges; using caching_sha2_password without SSL in older MySQL/Debezium combos; typo'd username or connecting to a replica that rejects the account's host pattern.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unable to connect to the MySQL database at <hostname>:<port>
• Unable to instantiate the database history class " + config.
• Data change record shouldn't use READ operation, the the rec
• The table changes should only have one element
• Unknown table change type:

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/6e3629b6beccf880. Report an issue: GitHub.