{"record":{"id":"6e3629b6beccf880","repo":"apache/seatunnel","slug":"failed-to-authenticate-to-the-mysql-database-at-h","errorCode":null,"errorMessage":"Failed to authenticate to the MySQL database at <hostname>:<port> with user '<username>'","messagePattern":"Failed to authenticate to the MySQL database at <hostname>:<port> with user '<username>'","errorType":"exception","errorClass":"DebeziumException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-cdc/connector-cdc-mysql/src/main/java/io/debezium/connector/mysql/MySqlStreamingChangeEventSource.java","lineNumber":1235,"sourceCode":"                    long duration = clock.currentTimeInMillis() - started;\n                    if (duration > (0.9 * timeout)) {\n                        double actualSeconds = TimeUnit.MILLISECONDS.toSeconds(duration);\n                        throw new DebeziumException(\n                                \"Timed out after \"\n                                        + actualSeconds\n                                        + \" seconds while waiting to connect to MySQL at \"\n                                        + connectorConfig.hostname()\n                                        + \":\"\n                                        + connectorConfig.port()\n                                        + \" with user '\"\n                                        + connectorConfig.username()\n                                        + \"'\",\n                                e);\n                    }\n                    // Otherwise, we were told to shutdown, so we don't care about the timeout\n                    // exception\n                } catch (AuthenticationException e) {\n                    throw new DebeziumException(\n                            \"Failed to authenticate to the MySQL database at \"\n                                    + connectorConfig.hostname()\n                                    + \":\"\n                                    + connectorConfig.port()\n                                    + \" with user '\"\n                                    + connectorConfig.username()\n                                    + \"'\",\n                            e);\n                } catch (Throwable e) {\n                    throw new DebeziumException(\n                            \"Unable to connect to the MySQL database at \"\n                                    + connectorConfig.hostname()\n                                    + \":\"\n                                    + connectorConfig.port()\n                                    + \" with user '\"\n                                    + connectorConfig.username()\n                                    + \"': \"\n                                    + e.getMessage(),","sourceCodeStart":1217,"sourceCodeEnd":1253,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-cdc/connector-cdc-mysql/src/main/java/io/debezium/connector/mysql/MySqlStreamingChangeEventSource.java#L1217-L1253","documentation":"Thrown as a DebeziumException by MySqlStreamingChangeEventSource when the binlog client fails to authenticate to the MySQL server during CDC streaming (an AuthenticationException was caught). It means the hostname/port were reachable but the username/password combination was rejected. The connector wraps it with host, port, and user for diagnosis.","triggerScenarios":"The MySQL binlog connection (via mysql-binlog-connector) receives an AuthenticationException while establishing the streaming connection with connectorConfig.username()/password() credentials.","commonSituations":"Wrong or rotated password in the connector config; user missing REPLICATION SLAVE/REPLICATION CLIENT privileges; using caching_sha2_password without SSL in older MySQL/Debezium combos; typo'd username or connecting to a replica that rejects the account's host pattern.","solutions":["Verify the username/password in the SeaTunnel MySQL CDC source config by logging in manually: mysql -h <host> -P <port> -u <user> -p","Grant replication privileges: GRANT SELECT, RELOAD, SHOW DATABASES, REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO '<user>'@'%';","Check the account host pattern allows the connector's source IP (user'@'%' vs 'user'@'localhost').","If MySQL 8 with caching_sha2_password, ensure SSL is enabled for the CDC connection or change the user to mysql_native_password.","If the password was rotated, update the config and restart the job."],"exampleFix":"// before\n\"username\" = \"cdc_user\",\n\"password\" = \"old_password\"\n// after\n\"username\" = \"cdc_user\",\n\"password\" = \"correct_current_password\"","handlingStrategy":"validation","validationCode":"// Validate MySQL credentials before starting the CDC job\ntry (Connection c = DriverManager.getConnection(\n        \"jdbc:mysql://\" + host + \":\" + port + \"/?useSSL=true\", user, pass)) {\n    try (Statement s = c.createStatement();\n         ResultSet rs = s.executeQuery(\"SELECT 1\")) {\n        if (!rs.next()) throw new IllegalStateException(\"auth probe failed\");\n    }\n} // SQLException here => fix credentials/privileges before launching CDC","typeGuard":null,"tryCatchPattern":"try {\n    startCdcSource(config);\n} catch (DebeziumException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"Failed to authenticate\")) {\n        // halt and alert ops: don't retry with the same credentials\n        log.error(\"MySQL CDC auth failed for user {} at {}:{}\", user, host, port, e);\n        throw new FatalConfigException(\"Check username/password/privileges\", e);\n    }\n    throw e;\n}","preventionTips":["Smoke-test the exact user/password with a mysql CLI login from the job host before deploying.","Always grant REPLICATION SLAVE and REPLICATION CLIENT to the CDC user.","Use a dedicated CDC account and rotate secrets via config management, not manual edits.","For MySQL 8, prefer SSL-enabled connections so caching_sha2_password works.","Watch account host patterns ('%') so the connector's source IP is allowed."],"tags":["mysql","cdc","authentication","debezium"],"backgroundTag":"authentication-required","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}