SolarManager unter Versionsverwaltung

Erster Stand der Hintergrundprozesse, die auf der Synology unter
/volume1/homes/wagner/SolarManager laufen: der Manager selbst, die Sammler
je Geraet, die MQTT-Bruecke, der Wecker und - neu hinzugezogen - der
AutoAction-Runner, der als Hintergrundprozess hierher gehoert und nicht ins
Web-Verzeichnis.

Zugangsdaten stehen nicht mehr im Quelltext, sondern in config.ini, die
nicht mit eingecheckt wird. Vorlage ist config.ini.example, gelesen wird sie
von konfig.py. Betroffen waren solarManager.py (Datenbank und Wattpilot),
zeit.py, gatherWaterData.py, wecker.py und skoda_testdaten.py, das sich das
Passwort bisher aus dem Quelltext eines anderen Moduls herausgesucht hat.

Die Kia-Anbindung ist mit dem Fahrzeug entfallen: kiaTest.py,
gatherCarData.py und hyundai_kia_connect_api sind nicht mehr dabei, ebenso
gatherInverterData.py, auf das nur noch eine auskommentierte Zeile zeigte.

Die mitgelieferten Bibliotheken bleiben im Repository - die NAS hat kein
pip, sie muessen neben den Skripten liegen.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

mysql/connector/plugins/__init__.py

@@ -0,0 +1,102 @@
+# Copyright (c) 2022, Oracle and/or its affiliates.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License, version 2.0, as
+# published by the Free Software Foundation.
+#
+# This program is also distributed with certain software (including
+# but not limited to OpenSSL) that is licensed under separate terms,
+# as designated in a particular file or component or in included license
+# documentation.  The authors of MySQL hereby grant you an
+# additional permission to link the program and your derivative works
+# with the separately licensed software that they have included with
+# MySQL.
+#
+# Without limiting anything contained in the foregoing, this file,
+# which is part of MySQL Connector/Python, is also subject to the
+# Universal FOSS Exception, version 1.0, a copy of which can be found at
+# http://oss.oracle.com/licenses/universal-foss-exception.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See the GNU General Public License, version 2.0, for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
+
+"""Base Authentication Plugin class."""
+
+from abc import ABC
+from typing import Optional, Union
+
+from .. import errors
+from ..types import StrOrBytes
+
+
+class BaseAuthPlugin(ABC):
+    """Base class for authentication pluginsF
+
+
+    Classes inheriting from BaseAuthPlugin should implement the method
+    prepare_password(). When instantiating, auth_data argument is
+    required. The username, password and database are optional. The
+    ssl_enabled argument can be used to tell the plugin whether SSL is
+    active or not.
+
+    The method auth_response() method is used to retrieve the password
+    which was prepared by prepare_password().
+    """
+
+    requires_ssl: int = False
+    plugin_name: str = ""
+
+    def __init__(
+        self,
+        auth_data: Optional[bytes],
+        username: Optional[StrOrBytes] = None,
+        password: Optional[str] = None,
+        database: Optional[str] = None,
+        ssl_enabled: bool = False,
+    ) -> None:
+        """Initialization"""
+        self._auth_data: bytes = auth_data
+        self._username: Optional[str] = (
+            username.decode("utf8")
+            if isinstance(username, (bytes, bytearray))
+            else username
+        )
+        self._password: Optional[str] = password
+        self._database: Optional[str] = database
+        self._ssl_enabled: bool = ssl_enabled
+
+    def prepare_password(self) -> bytes:
+        """Prepare and return password as as clear text.
+
+        Returns:
+            bytes: Prepared password.
+        """
+        if not self._password:
+            return b"\x00"
+        password: StrOrBytes = self._password
+
+        if isinstance(password, str):
+            password = password.encode("utf8")
+
+        return password + b"\x00"
+
+    def auth_response(
+        self, auth_data: Optional[bytes] = None  # pylint: disable=unused-argument
+    ) -> bytes:
+        """Return the prepared password to send to MySQL.
+
+        Raises:
+            InterfaceError: When SSL is required by not enabled.
+
+        Returns:
+            str: The prepared password.
+        """
+        if self.requires_ssl and not self._ssl_enabled:
+            raise errors.InterfaceError(f"{self.plugin_name} requires SSL")
+        return self.prepare_password()

mysql/connector/plugins/authentication_kerberos_client.py

@@ -0,0 +1,462 @@
+# Copyright (c) 2022, Oracle and/or its affiliates.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License, version 2.0, as
+# published by the Free Software Foundation.
+#
+# This program is also distributed with certain software (including
+# but not limited to OpenSSL) that is licensed under separate terms,
+# as designated in a particular file or component or in included license
+# documentation.  The authors of MySQL hereby grant you an
+# additional permission to link the program and your derivative works
+# with the separately licensed software that they have included with
+# MySQL.
+#
+# Without limiting anything contained in the foregoing, this file,
+# which is part of MySQL Connector/Python, is also subject to the
+# Universal FOSS Exception, version 1.0, a copy of which can be found at
+# http://oss.oracle.com/licenses/universal-foss-exception.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See the GNU General Public License, version 2.0, for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
+
+# mypy: disable-error-code="str-bytes-safe,misc"
+
+"""Kerberos Authentication Plugin."""
+
+import getpass
+import os
+import struct
+
+from pathlib import Path
+from typing import Any, Optional, Tuple
+
+from ..errors import InterfaceError, ProgrammingError
+from ..logger import logger
+
+try:
+    import gssapi
+except ImportError:
+    gssapi = None
+    if os.name != "nt":
+        raise ProgrammingError(
+            "Module gssapi is required for GSSAPI authentication "
+            "mechanism but was not found. Unable to authenticate "
+            "with the server"
+        ) from None
+
+try:
+    import sspi
+    import sspicon
+except ImportError:
+    sspi = None
+    sspicon = None
+
+from . import BaseAuthPlugin
+
+AUTHENTICATION_PLUGIN_CLASS = (
+    "MySQLSSPIKerberosAuthPlugin" if os.name == "nt" else "MySQLKerberosAuthPlugin"
+)
+
+
+# pylint: disable=c-extension-no-member,no-member
+class MySQLKerberosAuthPlugin(BaseAuthPlugin):
+    """Implement the MySQL Kerberos authentication plugin."""
+
+    plugin_name: str = "authentication_kerberos_client"
+    requires_ssl: bool = False
+    context: Optional[gssapi.SecurityContext] = None
+
+    @staticmethod
+    def get_user_from_credentials() -> str:
+        """Get user from credentials without realm."""
+        try:
+            creds = gssapi.Credentials(usage="initiate")
+            user = str(creds.name)
+            if user.find("@") != -1:
+                user, _ = user.split("@", 1)
+            return user
+        except gssapi.raw.misc.GSSError:
+            return getpass.getuser()
+
+    @staticmethod
+    def get_store() -> dict:
+        """Get a credentials store dictionary.
+
+        Returns:
+            dict: Credentials store dictionary with the krb5 ccache name.
+
+        Raises:
+            InterfaceError: If 'KRB5CCNAME' environment variable is empty.
+        """
+        krb5ccname = os.environ.get(
+            "KRB5CCNAME",
+            f"/tmp/krb5cc_{os.getuid()}"
+            if os.name == "posix"
+            else Path("%TEMP%").joinpath("krb5cc"),
+        )
+        if not krb5ccname:
+            raise InterfaceError(
+                "The 'KRB5CCNAME' environment variable is set to empty"
+            )
+        logger.debug("Using krb5 ccache name: FILE:%s", krb5ccname)
+        store = {b"ccache": f"FILE:{krb5ccname}".encode("utf-8")}
+        return store
+
+    def _acquire_cred_with_password(self, upn: str) -> gssapi.raw.creds.Creds:
+        """Acquire and store credentials through provided password.
+
+        Args:
+            upn (str): User Principal Name.
+
+        Returns:
+            gssapi.raw.creds.Creds: GSSAPI credentials.
+        """
+        logger.debug("Attempt to acquire credentials through provided password")
+        user = gssapi.Name(upn, gssapi.NameType.user)
+        password = self._password.encode("utf-8")
+
+        try:
+            acquire_cred_result = gssapi.raw.acquire_cred_with_password(
+                user, password, usage="initiate"
+            )
+            creds = acquire_cred_result.creds
+            gssapi.raw.store_cred_into(
+                self.get_store(),
+                creds=creds,
+                mech=gssapi.MechType.kerberos,
+                overwrite=True,
+                set_default=True,
+            )
+        except gssapi.raw.misc.GSSError as err:
+            raise ProgrammingError(
+                f"Unable to acquire credentials with the given password: {err}"
+            ) from err
+        return creds
+
+    @staticmethod
+    def _parse_auth_data(packet: bytes) -> Tuple[str, str]:
+        """Parse authentication data.
+
+        Get the SPN and REALM from the authentication data packet.
+
+        Format:
+            SPN string length two bytes <B1> <B2> +
+            SPN string +
+            UPN realm string length two bytes <B1> <B2> +
+            UPN realm string
+
+        Returns:
+            tuple: With 'spn' and 'realm'.
+        """
+        spn_len = struct.unpack("<H", packet[:2])[0]
+        packet = packet[2:]
+
+        spn = struct.unpack(f"<{spn_len}s", packet[:spn_len])[0]
+        packet = packet[spn_len:]
+
+        realm_len = struct.unpack("<H", packet[:2])[0]
+        realm = struct.unpack(f"<{realm_len}s", packet[2:])[0]
+
+        return spn.decode(), realm.decode()
+
+    def auth_response(self, auth_data: Optional[bytes] = None) -> Optional[bytes]:
+        """Prepare the first message to the server."""
+        spn = None
+        realm = None
+
+        if auth_data:
+            try:
+                spn, realm = self._parse_auth_data(auth_data)
+            except struct.error as err:
+                raise InterruptedError(f"Invalid authentication data: {err}") from err
+
+        if spn is None:
+            return self.prepare_password()
+
+        upn = f"{self._username}@{realm}" if self._username else None
+
+        logger.debug("Service Principal: %s", spn)
+        logger.debug("Realm: %s", realm)
+
+        try:
+            # Attempt to retrieve credentials from cache file
+            creds: Any = gssapi.Credentials(usage="initiate")
+            creds_upn = str(creds.name)
+
+            logger.debug("Cached credentials found")
+            logger.debug("Cached credentials UPN: %s", creds_upn)
+
+            # Remove the realm from user
+            if creds_upn.find("@") != -1:
+                creds_user, creds_realm = creds_upn.split("@", 1)
+            else:
+                creds_user = creds_upn
+                creds_realm = None
+
+            upn = f"{self._username}@{realm}" if self._username else creds_upn
+
+            # The user from cached credentials matches with the given user?
+            if self._username and self._username != creds_user:
+                logger.debug(
+                    "The user from cached credentials doesn't match with the "
+                    "given user"
+                )
+                if self._password is not None:
+                    creds = self._acquire_cred_with_password(upn)
+            if creds_realm and creds_realm != realm and self._password is not None:
+                creds = self._acquire_cred_with_password(upn)
+        except gssapi.raw.exceptions.ExpiredCredentialsError as err:
+            if upn and self._password is not None:
+                creds = self._acquire_cred_with_password(upn)
+            else:
+                raise InterfaceError(f"Credentials has expired: {err}") from err
+        except gssapi.raw.misc.GSSError as err:
+            if upn and self._password is not None:
+                creds = self._acquire_cred_with_password(upn)
+            else:
+                raise InterfaceError(
+                    f"Unable to retrieve cached credentials error: {err}"
+                ) from err
+
+        flags = (
+            gssapi.RequirementFlag.mutual_authentication,
+            gssapi.RequirementFlag.extended_error,
+            gssapi.RequirementFlag.delegate_to_peer,
+        )
+        name = gssapi.Name(spn, name_type=gssapi.NameType.kerberos_principal)
+        cname = name.canonicalize(gssapi.MechType.kerberos)
+        self.context = gssapi.SecurityContext(
+            name=cname, creds=creds, flags=sum(flags), usage="initiate"
+        )
+
+        try:
+            initial_client_token: Optional[bytes] = self.context.step()
+        except gssapi.raw.misc.GSSError as err:
+            raise InterfaceError(f"Unable to initiate security context: {err}") from err
+
+        logger.debug("Initial client token: %s", initial_client_token)
+        return initial_client_token
+
+    def auth_continue(
+        self, tgt_auth_challenge: Optional[bytes]
+    ) -> Tuple[Optional[bytes], bool]:
+        """Continue with the Kerberos TGT service request.
+
+        With the TGT authentication service given response generate a TGT
+        service request. This method must be invoked sequentially (in a loop)
+        until the security context is completed and an empty response needs to
+        be send to acknowledge the server.
+
+        Args:
+            tgt_auth_challenge: the challenge for the negotiation.
+
+        Returns:
+            tuple (bytearray TGS service request,
+            bool True if context is completed otherwise False).
+        """
+        logger.debug("tgt_auth challenge: %s", tgt_auth_challenge)
+
+        resp: Optional[bytes] = self.context.step(tgt_auth_challenge)
+
+        logger.debug("Context step response: %s", resp)
+        logger.debug("Context completed?: %s", self.context.complete)
+
+        return resp, self.context.complete
+
+    def auth_accept_close_handshake(self, message: bytes) -> bytes:
+        """Accept handshake and generate closing handshake message for server.
+
+        This method verifies the server authenticity from the given message
+        and included signature and generates the closing handshake for the
+        server.
+
+        When this method is invoked the security context is already established
+        and the client and server can send GSSAPI formated secure messages.
+
+        To finish the authentication handshake the server sends a message
+        with the security layer availability and the maximum buffer size.
+
+        Since the connector only uses the GSSAPI authentication mechanism to
+        authenticate the user with the server, the server will verify clients
+        message signature and terminate the GSSAPI authentication and send two
+        messages; an authentication acceptance b'\x01\x00\x00\x08\x01' and a
+        OK packet (that must be received after sent the returned message from
+        this method).
+
+        Args:
+            message: a wrapped gssapi message from the server.
+
+        Returns:
+            bytearray (closing handshake message to be send to the server).
+        """
+        if not self.context.complete:
+            raise ProgrammingError("Security context is not completed")
+        logger.debug("Server message: %s", message)
+        logger.debug("GSSAPI flags in use: %s", self.context.actual_flags)
+        try:
+            unwraped = self.context.unwrap(message)
+            logger.debug("Unwraped: %s", unwraped)
+        except gssapi.raw.exceptions.BadMICError as err:
+            logger.debug("Unable to unwrap server message: %s", err)
+            raise InterfaceError(f"Unable to unwrap server message: {err}") from err
+
+        logger.debug("Unwrapped server message: %s", unwraped)
+        # The message contents for the clients closing message:
+        #   - security level 1 byte, must be always 1.
+        #   - conciliated buffer size 3 bytes, without importance as no
+        #     further GSSAPI messages will be sends.
+        response = bytearray(b"\x01\x00\x00\00")
+        # Closing handshake must not be encrypted.
+        logger.debug("Message response: %s", response)
+        wraped = self.context.wrap(response, encrypt=False)
+        logger.debug(
+            "Wrapped message response: %s, length: %d",
+            wraped[0],
+            len(wraped[0]),
+        )
+
+        return wraped.message
+
+
+class MySQLSSPIKerberosAuthPlugin(BaseAuthPlugin):
+    """Implement the MySQL Kerberos authentication plugin with Windows SSPI"""
+
+    plugin_name: str = "authentication_kerberos_client"
+    requires_ssl: bool = False
+    context: Any = None
+    clientauth: Any = None
+
+    @staticmethod
+    def _parse_auth_data(packet: bytes) -> Tuple[str, str]:
+        """Parse authentication data.
+
+        Get the SPN and REALM from the authentication data packet.
+
+        Format:
+            SPN string length two bytes <B1> <B2> +
+            SPN string +
+            UPN realm string length two bytes <B1> <B2> +
+            UPN realm string
+
+        Returns:
+            tuple: With 'spn' and 'realm'.
+        """
+        spn_len = struct.unpack("<H", packet[:2])[0]
+        packet = packet[2:]
+
+        spn = struct.unpack(f"<{spn_len}s", packet[:spn_len])[0]
+        packet = packet[spn_len:]
+
+        realm_len = struct.unpack("<H", packet[:2])[0]
+        realm = struct.unpack(f"<{realm_len}s", packet[2:])[0]
+
+        return spn.decode(), realm.decode()
+
+    def auth_response(self, auth_data: Optional[bytes] = None) -> Optional[bytes]:
+        """Prepare the first message to the server."""
+        logger.debug("auth_response for sspi")
+        spn = None
+        realm = None
+
+        if auth_data:
+            try:
+                spn, realm = self._parse_auth_data(auth_data)
+            except struct.error as err:
+                raise InterruptedError(f"Invalid authentication data: {err}") from err
+
+        logger.debug("Service Principal: %s", spn)
+        logger.debug("Realm: %s", realm)
+
+        if sspicon is None or sspi is None:
+            raise ProgrammingError(
+                'Package "pywin32" (Python for Win32 (pywin32) extensions)'
+                " is not installed."
+            )
+
+        flags = (sspicon.ISC_REQ_MUTUAL_AUTH, sspicon.ISC_REQ_DELEGATE)
+
+        if self._username and self._password:
+            _auth_info = (self._username, realm, self._password)
+        else:
+            _auth_info = None
+
+        targetspn = spn
+        logger.debug("targetspn: %s", targetspn)
+        logger.debug("_auth_info is None: %s", _auth_info is None)
+
+        # The Security Support Provider Interface (SSPI) is an interface
+        # that allows us to choose from a set of SSPs available in the
+        # system; the idea of SSPI is to keep interface consistent no
+        # matter what back end (a.k.a., SSP) we choose.
+
+        # When using SSPI we should not use Kerberos directly as SSP,
+        # as remarked in [2], but we can use it indirectly via another
+        # SSP named Negotiate that acts as an application layer between
+        # SSPI and the other SSPs [1].
+
+        # Negotiate can select between Kerberos and NTLM on the fly;
+        # it chooses Kerberos unless it cannot be used by one of the
+        # systems involved in the authentication or the calling
+        # application did not provide sufficient information to use
+        # Kerberos.
+
+        # prefix: https://docs.microsoft.com/en-us/windows/win32/secauthn
+        # [1] prefix/microsoft-negotiate?source=recommendations
+        # [2] prefix/microsoft-kerberos?source=recommendations
+        self.clientauth = sspi.ClientAuth(
+            "Negotiate",
+            targetspn=targetspn,
+            auth_info=_auth_info,
+            scflags=sum(flags),
+            datarep=sspicon.SECURITY_NETWORK_DREP,
+        )
+
+        try:
+            data = None
+            err, out_buf = self.clientauth.authorize(data)
+            logger.debug("Context step err: %s", err)
+            logger.debug("Context step out_buf: %s", out_buf)
+            logger.debug("Context completed?: %s", self.clientauth.authenticated)
+            initial_client_token = out_buf[0].Buffer
+            logger.debug("pkg_info: %s", self.clientauth.pkg_info)
+        except Exception as err:
+            raise InterfaceError(f"Unable to initiate security context: {err}") from err
+
+        logger.debug("Initial client token: %s", initial_client_token)
+        return initial_client_token
+
+    def auth_continue(
+        self, tgt_auth_challenge: Optional[bytes]
+    ) -> Tuple[Optional[bytes], bool]:
+        """Continue with the Kerberos TGT service request.
+
+        With the TGT authentication service given response generate a TGT
+        service request. This method must be invoked sequentially (in a loop)
+        until the security context is completed and an empty response needs to
+        be send to acknowledge the server.
+
+        Args:
+            tgt_auth_challenge: the challenge for the negotiation.
+
+        Returns:
+            tuple (bytearray TGS service request,
+            bool True if context is completed otherwise False).
+        """
+        logger.debug("tgt_auth challenge: %s", tgt_auth_challenge)
+
+        err, out_buf = self.clientauth.authorize(tgt_auth_challenge)
+
+        logger.debug("Context step err: %s", err)
+        logger.debug("Context step out_buf: %s", out_buf)
+        resp = out_buf[0].Buffer
+        logger.debug("Context step resp: %s", resp)
+        logger.debug("Context completed?: %s", self.clientauth.authenticated)
+
+        return resp, self.clientauth.authenticated

mysql/connector/plugins/authentication_ldap_sasl_client.py

@@ -0,0 +1,496 @@
+# Copyright (c) 2022, Oracle and/or its affiliates.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License, version 2.0, as
+# published by the Free Software Foundation.
+#
+# This program is also distributed with certain software (including
+# but not limited to OpenSSL) that is licensed under separate terms,
+# as designated in a particular file or component or in included license
+# documentation.  The authors of MySQL hereby grant you an
+# additional permission to link the program and your derivative works
+# with the separately licensed software that they have included with
+# MySQL.
+#
+# Without limiting anything contained in the foregoing, this file,
+# which is part of MySQL Connector/Python, is also subject to the
+# Universal FOSS Exception, version 1.0, a copy of which can be found at
+# http://oss.oracle.com/licenses/universal-foss-exception.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See the GNU General Public License, version 2.0, for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
+
+"""LDAP SASL Authentication Plugin."""
+
+import hmac
+
+from base64 import b64decode, b64encode
+from hashlib import sha1, sha256
+from typing import Any, Callable, List, Optional, Tuple
+from uuid import uuid4
+
+from ..errors import InterfaceError, ProgrammingError
+from ..logger import logger
+from ..types import StrOrBytes
+
+try:
+    import gssapi
+except ImportError:
+    raise ProgrammingError(
+        "Module gssapi is required for GSSAPI authentication "
+        "mechanism but was not found. Unable to authenticate "
+        "with the server"
+    ) from None
+
+from ..utils import (
+    normalize_unicode_string as norm_ustr,
+    validate_normalized_unicode_string as valid_norm,
+)
+from . import BaseAuthPlugin
+
+AUTHENTICATION_PLUGIN_CLASS = "MySQLLdapSaslPasswordAuthPlugin"
+
+
+# pylint: disable=c-extension-no-member,no-member
+class MySQLLdapSaslPasswordAuthPlugin(BaseAuthPlugin):
+    """Class implementing the MySQL ldap sasl authentication plugin.
+
+    The MySQL's ldap sasl authentication plugin support two authentication
+    methods SCRAM-SHA-1 and GSSAPI (using Kerberos). This implementation only
+    support SCRAM-SHA-1 and SCRAM-SHA-256.
+
+    SCRAM-SHA-1 amd SCRAM-SHA-256
+        This method requires 2 messages from client and 2 responses from
+        server.
+
+        The first message from client will be generated by prepare_password(),
+        after receive the response from the server, it is required that this
+        response is passed back to auth_continue() which will return the
+        second message from the client. After send this second message to the
+        server, the second server respond needs to be passed to auth_finalize()
+        to finish the authentication process.
+    """
+
+    sasl_mechanisms: List[str] = ["SCRAM-SHA-1", "SCRAM-SHA-256", "GSSAPI"]
+    requires_ssl: bool = False
+    plugin_name: str = "authentication_ldap_sasl_client"
+    def_digest_mode: Callable = sha1
+    client_nonce: Optional[str] = None
+    client_salt: Any = None
+    server_salt: Optional[str] = None
+    krb_service_principal: Optional[StrOrBytes] = None
+    iterations: int = 0
+    server_auth_var: Optional[str] = None
+    target_name: Optional[gssapi.Name] = None
+    ctx: gssapi.SecurityContext = None
+    servers_first: Optional[str] = None
+    server_nonce: Optional[str] = None
+
+    @staticmethod
+    def _xor(bytes1: bytes, bytes2: bytes) -> bytes:
+        return bytes([b1 ^ b2 for b1, b2 in zip(bytes1, bytes2)])
+
+    def _hmac(self, password: bytes, salt: bytes) -> bytes:
+        digest_maker = hmac.new(password, salt, self.def_digest_mode)
+        return digest_maker.digest()
+
+    def _hi(self, password: str, salt: bytes, count: int) -> bytes:
+        """Prepares Hi
+        Hi(password, salt, iterations) where Hi(p,s,i) is defined as
+        PBKDF2 (HMAC, p, s, i, output length of H).
+        """
+        pw = password.encode()
+        hi = self._hmac(pw, salt + b"\x00\x00\x00\x01")
+        aux = hi
+        for _ in range(count - 1):
+            aux = self._hmac(pw, aux)
+            hi = self._xor(hi, aux)
+        return hi
+
+    @staticmethod
+    def _normalize(string: str) -> str:
+        norm_str = norm_ustr(string)
+        broken_rule = valid_norm(norm_str)
+        if broken_rule is not None:
+            raise InterfaceError(f"broken_rule: {broken_rule}")
+        return norm_str
+
+    def _first_message(self) -> bytes:
+        """This method generates the first message to the server to start the
+
+        The client-first message consists of a gs2-header,
+        the desired username, and a randomly generated client nonce cnonce.
+
+        The first message from the server has the form:
+            b'n,a=<user_name>,n=<user_name>,r=<client_nonce>
+
+        Returns client's first message
+        """
+        cfm_fprnat = "n,a={user_name},n={user_name},r={client_nonce}"
+        self.client_nonce = str(uuid4()).replace("-", "")
+        cfm: StrOrBytes = cfm_fprnat.format(
+            user_name=self._normalize(self._username),
+            client_nonce=self.client_nonce,
+        )
+
+        if isinstance(cfm, str):
+            cfm = cfm.encode("utf8")
+        return cfm
+
+    def _first_message_krb(self) -> Optional[bytes]:
+        """Get a TGT Authentication request and initiates security context.
+
+        This method will contact the Kerberos KDC in order of obtain a TGT.
+        """
+        user_name = gssapi.raw.names.import_name(
+            self._username.encode("utf8"), name_type=gssapi.NameType.user
+        )
+
+        # Use defaults store = {'ccache': 'FILE:/tmp/krb5cc_1000'}#,
+        #                       'keytab':'/etc/some.keytab' }
+        # Attempt to retrieve credential from default cache file.
+        try:
+            cred: Any = gssapi.Credentials()
+            logger.debug(
+                "# Stored credentials found, if password was given it will be ignored."
+            )
+            try:
+                # validate credentials has not expired.
+                cred.lifetime
+            except gssapi.raw.exceptions.ExpiredCredentialsError as err:
+                logger.warning(" Credentials has expired: %s", err)
+                cred.acquire(user_name)
+                raise InterfaceError(f"Credentials has expired: {err}") from err
+        except gssapi.raw.misc.GSSError as err:
+            if not self._password:
+                raise InterfaceError(
+                    f"Unable to retrieve stored credentials error: {err}"
+                ) from err
+            try:
+                logger.debug("# Attempt to retrieve credentials with given password")
+                acquire_cred_result = gssapi.raw.acquire_cred_with_password(
+                    user_name,
+                    self._password.encode("utf8"),
+                    usage="initiate",
+                )
+                cred = acquire_cred_result[0]
+            except gssapi.raw.misc.GSSError as err2:
+                raise ProgrammingError(
+                    f"Unable to retrieve credentials with the given password: {err2}"
+                ) from err
+
+        flags_l = (
+            gssapi.RequirementFlag.mutual_authentication,
+            gssapi.RequirementFlag.extended_error,
+            gssapi.RequirementFlag.delegate_to_peer,
+        )
+
+        if self.krb_service_principal:
+            service_principal = self.krb_service_principal
+        else:
+            service_principal = "ldap/ldapauth"
+        logger.debug("# service principal: %s", service_principal)
+        servk = gssapi.Name(
+            service_principal, name_type=gssapi.NameType.kerberos_principal
+        )
+        self.target_name = servk
+        self.ctx = gssapi.SecurityContext(
+            name=servk, creds=cred, flags=sum(flags_l), usage="initiate"
+        )
+
+        try:
+            # step() returns bytes | None, see documentation,
+            # so this method could return a NULL payload.
+            # ref: https://pythongssapi.github.io/<suffix>
+            # suffix: python-gssapi/latest/gssapi.html#gssapi.sec_contexts.SecurityContext
+            initial_client_token = self.ctx.step()
+        except gssapi.raw.misc.GSSError as err:
+            raise InterfaceError(f"Unable to initiate security context: {err}") from err
+
+        logger.debug("# initial client token: %s", initial_client_token)
+        return initial_client_token
+
+    def auth_continue_krb(
+        self, tgt_auth_challenge: Optional[bytes]
+    ) -> Tuple[Optional[bytes], bool]:
+        """Continue with the Kerberos TGT service request.
+
+        With the TGT authentication service given response generate a TGT
+        service request. This method must be invoked sequentially (in a loop)
+        until the security context is completed and an empty response needs to
+        be send to acknowledge the server.
+
+        Args:
+            tgt_auth_challenge the challenge for the negotiation.
+
+        Returns: tuple (bytearray TGS service request,
+                        bool True if context is completed otherwise False).
+        """
+        logger.debug("tgt_auth challenge: %s", tgt_auth_challenge)
+
+        resp = self.ctx.step(tgt_auth_challenge)
+        logger.debug("# context step response: %s", resp)
+        logger.debug("# context completed?: %s", self.ctx.complete)
+
+        return resp, self.ctx.complete
+
+    def auth_accept_close_handshake(self, message: bytes) -> bytes:
+        """Accept handshake and generate closing handshake message for server.
+
+        This method verifies the server authenticity from the given message
+        and included signature and generates the closing handshake for the
+        server.
+
+        When this method is invoked the security context is already established
+        and the client and server can send GSSAPI formated secure messages.
+
+        To finish the authentication handshake the server sends a message
+        with the security layer availability and the maximum buffer size.
+
+        Since the connector only uses the GSSAPI authentication mechanism to
+        authenticate the user with the server, the server will verify clients
+        message signature and terminate the GSSAPI authentication and send two
+        messages; an authentication acceptance b'\x01\x00\x00\x08\x01' and a
+        OK packet (that must be received after sent the returned message from
+        this method).
+
+        Args:
+            message a wrapped hssapi message from the server.
+
+        Returns: bytearray closing handshake message to be send to the server.
+        """
+        if not self.ctx.complete:
+            raise ProgrammingError("Security context is not completed.")
+        logger.debug("# servers message: %s", message)
+        logger.debug("# GSSAPI flags in use: %s", self.ctx.actual_flags)
+        try:
+            unwraped = self.ctx.unwrap(message)
+            logger.debug("# unwraped: %s", unwraped)
+        except gssapi.raw.exceptions.BadMICError as err:
+            raise InterfaceError(f"Unable to unwrap server message: {err}") from err
+
+        logger.debug("# unwrapped server message: %s", unwraped)
+        # The message contents for the clients closing message:
+        #   - security level 1 byte, must be always 1.
+        #   - conciliated buffer size 3 bytes, without importance as no
+        #     further GSSAPI messages will be sends.
+        response = bytearray(b"\x01\x00\x00\00")
+        # Closing handshake must not be encrypted.
+        logger.debug("# message response: %s", response)
+        wraped = self.ctx.wrap(response, encrypt=False)
+        logger.debug(
+            "# wrapped message response: %s, length: %d",
+            wraped[0],
+            len(wraped[0]),
+        )
+
+        return wraped.message
+
+    def auth_response(  # type: ignore[override]
+        self,
+        auth_data: Optional[str] = None,
+    ) -> Optional[bytes]:
+        """This method will prepare the fist message to the server.
+
+        Returns bytes to send to the server as the first message.
+        """
+        krb_service_principal = auth_data
+        auth_mechanism = self._auth_data.decode()
+        self.krb_service_principal = krb_service_principal
+        logger.debug("read_method_name_from_server: %s", auth_mechanism)
+        if auth_mechanism not in self.sasl_mechanisms:
+            auth_mechanisms = '", "'.join(self.sasl_mechanisms[:-1])
+            raise InterfaceError(
+                f'The sasl authentication method "{auth_mechanism}" requested '
+                f'from the server is not supported. Only "{auth_mechanisms}" '
+                f'and "{self.sasl_mechanisms[-1]}" are supported'
+            )
+
+        if b"GSSAPI" in self._auth_data:
+            return self._first_message_krb()
+
+        if self._auth_data == b"SCRAM-SHA-256":
+            self.def_digest_mode = sha256
+
+        return self._first_message()
+
+    def _second_message(self) -> bytes:
+        """This method generates the second message to the server
+
+        Second message consist on the concatenation of the client and the
+        server nonce, and cproof.
+
+        c=<n,a=<user_name>>,r=<server_nonce>,p=<client_proof>
+        where:
+            <client_proof>: xor(<client_key>, <client_signature>)
+
+            <client_key>: hmac(salted_password, b"Client Key")
+            <client_signature>: hmac(<stored_key>, <auth_msg>)
+            <stored_key>: h(<client_key>)
+            <auth_msg>: <client_first_no_header>,<servers_first>,
+                        c=<client_header>,r=<server_nonce>
+            <client_first_no_header>: n=<username>r=<client_nonce>
+        """
+        if not self._auth_data:
+            raise InterfaceError("Missing authentication data (seed)")
+
+        passw = self._normalize(self._password)
+        salted_password = self._hi(passw, b64decode(self.server_salt), self.iterations)
+        logger.debug("salted_password: %s", b64encode(salted_password).decode())
+
+        client_key = self._hmac(salted_password, b"Client Key")
+        logger.debug("client_key: %s", b64encode(client_key).decode())
+
+        stored_key = self.def_digest_mode(client_key).digest()
+        logger.debug("stored_key: %s", b64encode(stored_key).decode())
+
+        server_key = self._hmac(salted_password, b"Server Key")
+        logger.debug("server_key: %s", b64encode(server_key).decode())
+
+        client_first_no_header = ",".join(
+            [
+                f"n={self._normalize(self._username)}",
+                f"r={self.client_nonce}",
+            ]
+        )
+        logger.debug("client_first_no_header: %s", client_first_no_header)
+
+        client_header = b64encode(
+            f"n,a={self._normalize(self._username)},".encode()
+        ).decode()
+
+        auth_msg = ",".join(
+            [
+                client_first_no_header,
+                self.servers_first,
+                f"c={client_header}",
+                f"r={self.server_nonce}",
+            ]
+        )
+        logger.debug("auth_msg: %s", auth_msg)
+
+        client_signature = self._hmac(stored_key, auth_msg.encode())
+        logger.debug("client_signature: %s", b64encode(client_signature).decode())
+
+        client_proof = self._xor(client_key, client_signature)
+        logger.debug("client_proof: %s", b64encode(client_proof).decode())
+
+        self.server_auth_var = b64encode(
+            self._hmac(server_key, auth_msg.encode())
+        ).decode()
+        logger.debug("server_auth_var: %s", self.server_auth_var)
+
+        msg = ",".join(
+            [
+                f"c={client_header}",
+                f"r={self.server_nonce}",
+                f"p={b64encode(client_proof).decode()}",
+            ]
+        )
+        logger.debug("second_message: %s", msg)
+        return msg.encode()
+
+    def _validate_first_reponse(self, servers_first: bytes) -> None:
+        """Validates first message from the server.
+
+        Extracts the server's salt and iterations from the servers 1st response.
+        First message from the server is in the form:
+            <server_salt>,i=<iterations>
+        """
+        if not servers_first or not isinstance(servers_first, (bytearray, bytes)):
+            raise InterfaceError(f"Unexpected server message: {repr(servers_first)}")
+        try:
+            servers_first_str = servers_first.decode()
+            self.servers_first = servers_first_str
+            r_server_nonce, s_salt, i_counter = servers_first_str.split(",")
+        except ValueError:
+            raise InterfaceError(
+                f"Unexpected server message: {servers_first_str}"
+            ) from None
+        if (
+            not r_server_nonce.startswith("r=")
+            or not s_salt.startswith("s=")
+            or not i_counter.startswith("i=")
+        ):
+            raise InterfaceError(
+                f"Incomplete reponse from the server: {servers_first_str}"
+            )
+        if self.client_nonce in r_server_nonce:
+            self.server_nonce = r_server_nonce[2:]
+            logger.debug("server_nonce: %s", self.server_nonce)
+        else:
+            raise InterfaceError(
+                "Unable to authenticate response: response not well formed "
+                f"{servers_first_str}"
+            )
+        self.server_salt = s_salt[2:]
+        logger.debug(
+            "server_salt: %s length: %s",
+            self.server_salt,
+            len(self.server_salt),
+        )
+        try:
+            i_counter = i_counter[2:]
+            logger.debug("iterations: %s", i_counter)
+            self.iterations = int(i_counter)
+        except Exception as err:
+            raise InterfaceError(
+                f"Unable to authenticate: iterations not found {servers_first_str}"
+            ) from err
+
+    def auth_continue(self, servers_first_response: bytes) -> bytes:
+        """return the second message from the client.
+
+        Returns bytes to send to the server as the second message.
+        """
+        self._validate_first_reponse(servers_first_response)
+        return self._second_message()
+
+    def _validate_second_reponse(self, servers_second: bytearray) -> bool:
+        """Validates second message from the server.
+
+        The client and the server prove to each other they have the same Auth
+        variable.
+
+        The second message from the server consist of the server's proof:
+            server_proof = HMAC(<server_key>, <auth_msg>)
+            where:
+                <server_key>: hmac(<salted_password>, b"Server Key")
+                <auth_msg>: <client_first_no_header>,<servers_first>,
+                            c=<client_header>,r=<server_nonce>
+
+        Our server_proof must be equal to the Auth variable send on this second
+        response.
+        """
+        if (
+            not servers_second
+            or not isinstance(servers_second, bytearray)
+            or len(servers_second) <= 2
+            or not servers_second.startswith(b"v=")
+        ):
+            raise InterfaceError("The server's proof is not well formated")
+        server_var = servers_second[2:].decode()
+        logger.debug("server auth variable: %s", server_var)
+        return self.server_auth_var == server_var
+
+    def auth_finalize(self, servers_second_response: bytearray) -> bool:
+        """finalize the authentication process.
+
+        Raises InterfaceError if the ervers_second_response is invalid.
+
+        Returns True in successful authentication False otherwise.
+        """
+        if not self._validate_second_reponse(servers_second_response):
+            raise InterfaceError(
+                "Authentication failed: Unable to proof server identity"
+            )
+        return True
+
+
+# pylint: enable=c-extension-no-member,no-member

mysql/connector/plugins/authentication_oci_client.py

@@ -0,0 +1,190 @@
+# Copyright (c) 2022, Oracle and/or its affiliates.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License, version 2.0, as
+# published by the Free Software Foundation.
+#
+# This program is also distributed with certain software (including
+# but not limited to OpenSSL) that is licensed under separate terms,
+# as designated in a particular file or component or in included license
+# documentation.  The authors of MySQL hereby grant you an
+# additional permission to link the program and your derivative works
+# with the separately licensed software that they have included with
+# MySQL.
+#
+# Without limiting anything contained in the foregoing, this file,
+# which is part of MySQL Connector/Python, is also subject to the
+# Universal FOSS Exception, version 1.0, a copy of which can be found at
+# http://oss.oracle.com/licenses/universal-foss-exception.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See the GNU General Public License, version 2.0, for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
+
+# mypy: disable-error-code="arg-type,union-attr,call-arg"
+
+"""OCI Authentication Plugin."""
+
+import json
+import os
+
+from base64 import b64encode
+from pathlib import Path
+from typing import Any, Dict, Optional
+
+from .. import errors
+from ..logger import logger
+
+try:
+    from cryptography.exceptions import UnsupportedAlgorithm
+    from cryptography.hazmat.primitives import hashes, serialization
+    from cryptography.hazmat.primitives.asymmetric import padding
+    from cryptography.hazmat.primitives.asymmetric.types import PRIVATE_KEY_TYPES
+except ImportError:
+    raise errors.ProgrammingError("Package 'cryptography' is not installed") from None
+
+try:
+    from oci import config, exceptions
+except ImportError:
+    raise errors.ProgrammingError(
+        "Package 'oci' (Oracle Cloud Infrastructure Python SDK) is not installed"
+    ) from None
+
+from . import BaseAuthPlugin
+
+AUTHENTICATION_PLUGIN_CLASS = "MySQLOCIAuthPlugin"
+OCI_SECURITY_TOKEN_MAX_SIZE = 10 * 1024  # In bytes
+OCI_SECURITY_TOKEN_TOO_LARGE = "Ephemeral security token is too large (10KB max)"
+OCI_SECURITY_TOKEN_FILE_NOT_AVAILABLE = (
+    "Ephemeral security token file ('security_token_file') could not be read"
+)
+OCI_PROFILE_MISSING_PROPERTIES = (
+    "OCI configuration file does not contain a 'fingerprint' or 'key_file' entry"
+)
+
+
+class MySQLOCIAuthPlugin(BaseAuthPlugin):
+    """Implement the MySQL OCI IAM authentication plugin."""
+
+    plugin_name: str = "authentication_oci_client"
+    requires_ssl: bool = False
+    context: Any = None
+    oci_config_profile: str = "DEFAULT"
+    oci_config_file: str = config.DEFAULT_LOCATION
+
+    @staticmethod
+    def _prepare_auth_response(signature: bytes, oci_config: Dict[str, Any]) -> str:
+        """Prepare client's authentication response
+
+        Prepares client's authentication response in JSON format
+        Args:
+            signature (bytes):  server's nonce to be signed by client.
+            oci_config (dict): OCI configuration object.
+
+        Returns:
+            str: JSON string with the following format:
+                 {"fingerprint": str, "signature": str, "token": base64.base64.base64}
+
+        Raises:
+            ProgrammingError: If the ephemeral security token file can't be open or the
+                              token is too large.
+        """
+        signature_64 = b64encode(signature)
+        auth_response = {
+            "fingerprint": oci_config["fingerprint"],
+            "signature": signature_64.decode(),
+        }
+
+        # The security token, if it exists, should be a JWT (JSON Web Token), consisted
+        # of a base64-encoded header, body, and signature, separated by '.',
+        # e.g. "Base64.Base64.Base64", stored in a file at the path specified by the
+        # security_token_file configuration property
+        if oci_config.get("security_token_file"):
+            try:
+                security_token_file = Path(oci_config["security_token_file"])
+                # Check if token exceeds the maximum size
+                if security_token_file.stat().st_size > OCI_SECURITY_TOKEN_MAX_SIZE:
+                    raise errors.ProgrammingError(OCI_SECURITY_TOKEN_TOO_LARGE)
+                auth_response["token"] = security_token_file.read_text(encoding="utf-8")
+            except (OSError, UnicodeError) as err:
+                raise errors.ProgrammingError(
+                    OCI_SECURITY_TOKEN_FILE_NOT_AVAILABLE
+                ) from err
+        return json.dumps(auth_response, separators=(",", ":"))
+
+    @staticmethod
+    def _get_private_key(key_path: str) -> PRIVATE_KEY_TYPES:
+        """Get the private_key form the given location"""
+        try:
+            with open(os.path.expanduser(key_path), "rb") as key_file:
+                private_key = serialization.load_pem_private_key(
+                    key_file.read(),
+                    password=None,
+                )
+        except (TypeError, OSError, ValueError, UnsupportedAlgorithm) as err:
+            raise errors.ProgrammingError(
+                "An error occurred while reading the API_KEY from "
+                f'"{key_path}": {err}'
+            )
+
+        return private_key
+
+    def _get_valid_oci_config(self) -> Dict[str, Any]:
+        """Get a valid OCI config from the given configuration file path"""
+        error_list = []
+        req_keys = {
+            "fingerprint": (lambda x: len(x) > 32),
+            "key_file": (lambda x: os.path.exists(os.path.expanduser(x))),
+        }
+
+        oci_config: Dict[str, Any] = {}
+        try:
+            # key_file is validated by oci.config if present
+            oci_config = config.from_file(
+                self.oci_config_file or config.DEFAULT_LOCATION,
+                self.oci_config_profile or "DEFAULT",
+            )
+            for req_key, req_value in req_keys.items():
+                try:
+                    # Verify parameter in req_key is present and valid
+                    if oci_config[req_key] and not req_value(oci_config[req_key]):
+                        error_list.append(f'Parameter "{req_key}" is invalid')
+                except KeyError:
+                    error_list.append(f"Does not contain parameter {req_key}")
+        except (
+            exceptions.ConfigFileNotFound,
+            exceptions.InvalidConfig,
+            exceptions.InvalidKeyFilePath,
+            exceptions.InvalidPrivateKey,
+            exceptions.ProfileNotFound,
+        ) as err:
+            error_list.append(str(err))
+
+        # Raise errors if any
+        if error_list:
+            raise errors.ProgrammingError(
+                f"Invalid oci-config-file: {self.oci_config_file}. "
+                f"Errors found: {error_list}"
+            )
+
+        return oci_config
+
+    def auth_response(self, auth_data: Optional[bytes] = None) -> bytes:
+        """Prepare authentication string for the server."""
+        logger.debug("server nonce: %s, len %d", self._auth_data, len(self._auth_data))
+
+        oci_config = self._get_valid_oci_config()
+
+        private_key = self._get_private_key(oci_config["key_file"])
+        signature = private_key.sign(
+            self._auth_data, padding.PKCS1v15(), hashes.SHA256()
+        )
+
+        auth_response = self._prepare_auth_response(signature, oci_config)
+        logger.debug("authentication response: %s", auth_response)
+        return auth_response.encode()

mysql/connector/plugins/caching_sha2_password.py

@@ -0,0 +1,101 @@
+# Copyright (c) 2022, Oracle and/or its affiliates.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License, version 2.0, as
+# published by the Free Software Foundation.
+#
+# This program is also distributed with certain software (including
+# but not limited to OpenSSL) that is licensed under separate terms,
+# as designated in a particular file or component or in included license
+# documentation.  The authors of MySQL hereby grant you an
+# additional permission to link the program and your derivative works
+# with the separately licensed software that they have included with
+# MySQL.
+#
+# Without limiting anything contained in the foregoing, this file,
+# which is part of MySQL Connector/Python, is also subject to the
+# Universal FOSS Exception, version 1.0, a copy of which can be found at
+# http://oss.oracle.com/licenses/universal-foss-exception.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See the GNU General Public License, version 2.0, for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
+
+"""Caching SHA2 Password Authentication Plugin."""
+
+import struct
+
+from hashlib import sha256
+from typing import Optional
+
+from ..errors import InterfaceError
+from . import BaseAuthPlugin
+
+AUTHENTICATION_PLUGIN_CLASS = "MySQLCachingSHA2PasswordAuthPlugin"
+
+
+class MySQLCachingSHA2PasswordAuthPlugin(BaseAuthPlugin):
+    """Class implementing the MySQL caching_sha2_password authentication plugin
+
+    Note that encrypting using RSA is not supported since the Python
+    Standard Library does not provide this OpenSSL functionality.
+    """
+
+    requires_ssl: bool = False
+    plugin_name: str = "caching_sha2_password"
+    perform_full_authentication: int = 4
+    fast_auth_success: int = 3
+
+    def _scramble(self) -> bytes:
+        """Return a scramble of the password using a Nonce sent by the
+        server.
+
+        The scramble is of the form:
+        XOR(SHA2(password), SHA2(SHA2(SHA2(password)), Nonce))
+        """
+        if not self._auth_data:
+            raise InterfaceError("Missing authentication data (seed)")
+
+        if not self._password:
+            return b""
+
+        password = (
+            self._password.encode("utf-8")
+            if isinstance(self._password, str)
+            else self._password
+        )
+        auth_data = self._auth_data
+
+        hash1 = sha256(password).digest()
+        hash2 = sha256()
+        hash2.update(sha256(hash1).digest())
+        hash2.update(auth_data)
+        hash2_digest: bytes = hash2.digest()
+        xored = [h1 ^ h2 for (h1, h2) in zip(hash1, hash2_digest)]
+        hash3 = struct.pack("32B", *xored)
+        return hash3
+
+    def _full_authentication(self) -> bytes:
+        """Returns password as as clear text"""
+        if not self._ssl_enabled:
+            raise InterfaceError(f"{self.plugin_name} requires SSL")
+        return super().prepare_password()
+
+    def prepare_password(self) -> Optional[bytes]:
+        """Prepare and return password.
+
+        Returns:
+            bytes: Prepared password.
+        """
+        if not self._auth_data:
+            return None
+        if len(self._auth_data) > 1:
+            return self._scramble()
+        if self._auth_data[0] == self.perform_full_authentication:
+            return self._full_authentication()
+        return None

mysql/connector/plugins/mysql_clear_password.py

@@ -0,0 +1,40 @@
+# Copyright (c) 2022, Oracle and/or its affiliates.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License, version 2.0, as
+# published by the Free Software Foundation.
+#
+# This program is also distributed with certain software (including
+# but not limited to OpenSSL) that is licensed under separate terms,
+# as designated in a particular file or component or in included license
+# documentation.  The authors of MySQL hereby grant you an
+# additional permission to link the program and your derivative works
+# with the separately licensed software that they have included with
+# MySQL.
+#
+# Without limiting anything contained in the foregoing, this file,
+# which is part of MySQL Connector/Python, is also subject to the
+# Universal FOSS Exception, version 1.0, a copy of which can be found at
+# http://oss.oracle.com/licenses/universal-foss-exception.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See the GNU General Public License, version 2.0, for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
+
+"""Clear Password Authentication Plugin."""
+
+from . import BaseAuthPlugin
+
+AUTHENTICATION_PLUGIN_CLASS = "MySQLClearPasswordAuthPlugin"
+
+
+class MySQLClearPasswordAuthPlugin(BaseAuthPlugin):
+    """Class implementing the MySQL Clear Password authentication plugin"""
+
+    requires_ssl: bool = True
+    plugin_name: str = "mysql_clear_password"

mysql/connector/plugins/mysql_native_password.py

@@ -0,0 +1,74 @@
+# Copyright (c) 2022, Oracle and/or its affiliates.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License, version 2.0, as
+# published by the Free Software Foundation.
+#
+# This program is also distributed with certain software (including
+# but not limited to OpenSSL) that is licensed under separate terms,
+# as designated in a particular file or component or in included license
+# documentation.  The authors of MySQL hereby grant you an
+# additional permission to link the program and your derivative works
+# with the separately licensed software that they have included with
+# MySQL.
+#
+# Without limiting anything contained in the foregoing, this file,
+# which is part of MySQL Connector/Python, is also subject to the
+# Universal FOSS Exception, version 1.0, a copy of which can be found at
+# http://oss.oracle.com/licenses/universal-foss-exception.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See the GNU General Public License, version 2.0, for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
+
+"""Native Password Authentication Plugin."""
+
+import struct
+
+from hashlib import sha1
+
+from ..errors import InterfaceError
+from ..types import StrOrBytes
+from . import BaseAuthPlugin
+
+AUTHENTICATION_PLUGIN_CLASS = "MySQLNativePasswordAuthPlugin"
+
+
+class MySQLNativePasswordAuthPlugin(BaseAuthPlugin):
+    """Class implementing the MySQL Native Password authentication plugin"""
+
+    requires_ssl: bool = False
+    plugin_name: str = "mysql_native_password"
+
+    def prepare_password(self) -> bytes:
+        """Prepares and returns password as native MySQL 4.1+ password"""
+        if not self._auth_data:
+            raise InterfaceError("Missing authentication data (seed)")
+
+        if not self._password:
+            return b""
+        password: StrOrBytes = self._password
+
+        if isinstance(self._password, str):
+            password = self._password.encode("utf-8")
+        else:
+            password = self._password
+
+        auth_data = self._auth_data
+
+        hash4 = None
+        try:
+            hash1 = sha1(password).digest()
+            hash2 = sha1(hash1).digest()
+            hash3 = sha1(auth_data + hash2).digest()
+            xored = [h1 ^ h3 for (h1, h3) in zip(hash1, hash3)]
+            hash4 = struct.pack("20B", *xored)
+        except (struct.error, TypeError) as err:
+            raise InterfaceError(f"Failed scrambling password; {err}") from err
+
+        return hash4

mysql/connector/plugins/sha256_password.py

@@ -0,0 +1,44 @@
+# Copyright (c) 2022, Oracle and/or its affiliates.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License, version 2.0, as
+# published by the Free Software Foundation.
+#
+# This program is also distributed with certain software (including
+# but not limited to OpenSSL) that is licensed under separate terms,
+# as designated in a particular file or component or in included license
+# documentation.  The authors of MySQL hereby grant you an
+# additional permission to link the program and your derivative works
+# with the separately licensed software that they have included with
+# MySQL.
+#
+# Without limiting anything contained in the foregoing, this file,
+# which is part of MySQL Connector/Python, is also subject to the
+# Universal FOSS Exception, version 1.0, a copy of which can be found at
+# http://oss.oracle.com/licenses/universal-foss-exception.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See the GNU General Public License, version 2.0, for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
+
+"""SHA256 Password Authentication Plugin."""
+
+from . import BaseAuthPlugin
+
+AUTHENTICATION_PLUGIN_CLASS = "MySQLSHA256PasswordAuthPlugin"
+
+
+class MySQLSHA256PasswordAuthPlugin(BaseAuthPlugin):
+    """Class implementing the MySQL SHA256 authentication plugin
+
+    Note that encrypting using RSA is not supported since the Python
+    Standard Library does not provide this OpenSSL functionality.
+    """
+
+    requires_ssl: bool = True
+    plugin_name: str = "sha256_password"