How do I connect my .NET App Engine app to a Cloud SQL MySQL 8.0 instance using Cloud IAM?

The error message

  Authentication method 'mysql_clear_password' requires a secure connection

indicates that when using Cloud SQL IAM authentication, MySQL requires that the cleartext authentication plugin be allowed only on a secure (TLS) connection. Even though you’re not using a password per se, the authentication mechanism still sends credentials in cleartext so the connector demands that cleartext be used only in a secure context.

To fix this you have two options:

1. Enable TLS on the connection:
   In the connection string, set the SSL mode to a value that forces TLS (for example, SslMode=Preferred or SslMode=Required). If you have the proper certificates, configure the connection to use them. This is the more secure approach if you want the benefits of TLS encryption.

2. Allow the cleartext plugin in the connector:
   In MySqlConnector 2.4.0 you can enable the cleartext authentication plugin by adding the property
     AllowCleartextPlugin=true
   to your connection string. For example:

   CSHARPCopied
   var connStr = new MySqlConnectionStringBuilder {
       Server = "<my internal ip>",
       Database = "MysqlDatabase",
       UserID = "<App Engine default service account>",
       SslMode = MySqlSslMode.None,  // When using AllowCleartextPlugin, ensure you’re in a secure network
       AllowCleartextPlugin = true
   };

A few things to keep in mind:

• Even if your App Engine app runs in a private VPC and the network is “internally secure,” the MySqlConnector still enforces the TLS requirement for the mysql_clear_password authentication mechanism unless you explicitly allow cleartext with the above flag.
• When using Cloud SQL IAM authentication, the recommended secure approach is to configure TLS on the connection—in production environments this is advisable to ensure data protection.
• Double-check that the service account and Cloud SQL IAM permissions are correctly set up; however, your current error centers solely on the authentication mode.

Choose the approach that best meets your security requirements. If you opt for the cleartext plugin option, make sure that your deployment network remains secure.