Pomelo.entityframeworkcore.mysql: Db Migrate() throws Access denied for user 'root'@'localhost'

[waseemdev]

This exception occurs only when calling Migrate/MigrateAsync, reading data from tables, for example, is working without problems, here is my test that I used:

    var count = await dbContext.TestTable.CountAsync(); // no problem
    Log(count);
    try
    {
        await dbContext.Database.MigrateAsync(); // exception!!!
    }
    catch (Exception ex)
    {
        LogError(ex);
    }
    count = await dbContext.TestTable.CountAsync(); // no problem
    Log(count);

Exception:

fail: Microsoft.EntityFrameworkCore.Database.Connection[20004]
      An error occurred using the connection to database '' on server 'localhost'.
MySql.Data.MySqlClient.MySqlException (0x80004005): Access denied for user 'root'@'localhost'
   at MySqlConnector.Core.ServerSession.TryAsyncContinuation(Task`1 task) in C:\projects\mysqlconnector\src\MySqlConnector\Core\ServerSession.cs:line 1245
   at System.Threading.Tasks.ContinuationResultTaskFromResultTask`2.InnerInvoke()
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state)
--- End of stack trace from previous location where exception was thrown ---
   at System.Threading.Tasks.Task.ExecuteWithThreadLocal(Task& currentTaskSlot)
--- End of stack trace from previous location where exception was thrown ---
   at MySqlConnector.Core.ServerSession.ConnectAsync(ConnectionSettings cs, ILoadBalancer loadBalancer, IOBehavior ioBehavior, CancellationToken cancellationToken) in C:\projects\mysqlconnector\src\MySqlConnector\Core\ServerSession.cs:line 356
   at MySql.Data.MySqlClient.MySqlConnection.CreateSessionAsync(Nullable`1 ioBehavior, CancellationToken cancellationToken) in C:\projects\mysqlconnector\src\MySqlConnector\MySql.Data.MySqlClient\MySqlConnection.cs:line 416
   at MySql.Data.MySqlClient.MySqlConnection.OpenAsync(Nullable`1 ioBehavior, CancellationToken cancellationToken) in C:\projects\mysqlconnector\src\MySqlConnector\MySql.Data.MySqlClient\MySqlConnection.cs:line 175
   at Microsoft.EntityFrameworkCore.Storage.RelationalConnection.OpenDbConnectionAsync(Boolean errorsExpected, CancellationToken cancellationToken)

Further technical details

MariaDB version: 10.4.8
Operating system: Ubuntu 18.04
Pomelo.EntityFrameworkCore.MySql version: 2.1.2
Microsoft.AspNetCore.App version: 2.1.2 (inside docker)

[lauxjpn]

I could not reproduce this issue with the following code in 2.1.2 (after creating an initial migration using the command line) or any newer version:

```c#
using System.Diagnostics;
using System.Linq;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Logging;

namespace IssueConsoleTemplate
{
public class TestEntity
{
public int Id { get; set; }
public int MyValue { get; set; }
}

public class Issue908Context : DbContext
{
    public DbSet<TestEntity> TestEntities { get; set; }

    protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
    {
        // Use non-root non-default user with password to test.
        // The (empty) database "Issue908" must already exist
        // and "issue908User" must have access.
        optionsBuilder
            .UseMySql(

"server=127.0.0.1;port=3308;user=issue908User;password=asdf;database=Issue908")
.UseLoggerFactory(LoggerFactory.Create(b => b
.AddConsole()
.AddFilter(level => true)))
.EnableSensitiveDataLogging();
}

    protected override void OnModelCreating(ModelBuilder modelBuilder)
    {
        modelBuilder.Entity<TestEntity>()
            .HasData(new TestEntity { Id = 1, MyValue = 42 });
    }
}

internal class Program
{
    private static void Main()
    {
        using var context = new Issue908Context();

        context.Database.Migrate();

        var theEntity = context.TestEntities.Single();

        Debug.Assert(theEntity.MyValue == 42);
    }
}

}

I tested this with a user that had only access to the test database and made sure before, that the root user had a (different) password set.

This is the full EF Core log output:

dbug: Microsoft.EntityFrameworkCore.Infrastructure[10401]
An 'IServiceProvider' was created for internal use by Entity Framework.
warn: Microsoft.EntityFrameworkCore.Model.Validation[10400]
Sensitive data logging is enabled. Log entries and exception messages may include sensitive application data, this mode should only be enabled during development.
info: Microsoft.EntityFrameworkCore.Infrastructure[10403]
Entity Framework Core 2.1.2-rtm-30932 initialized 'Issue908Context' using provider 'Pomelo.EntityFrameworkCore.MySql' with options: SensitiveDataLoggingEnabled
dbug: Microsoft.EntityFrameworkCore.Migrations[20400]
Migrating using database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20000]
Opening connection to database '' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20001]
Opened connection to database '' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20000]
Opening connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20001]
Opened connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Command[20100]
Executing DbCommand [Parameters=[], CommandType='Text', CommandTimeout='30']
SELECT 1 FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA='Issue908' AND TABLE_NAME='__EFMigrationsHistory';
info: Microsoft.EntityFrameworkCore.Database.Command[20101]
Executed DbCommand (13ms) [Parameters=[], CommandType='Text', CommandTimeout='30']
SELECT 1 FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA='Issue908' AND TABLE_NAME='__EFMigrationsHistory';
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20002]
Closing connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20003]
Closed connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20000]
Opening connection to database '' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20001]
Opened connection to database '' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.ChangeTracking[10800]
DetectChanges starting for 'Issue908Context'.
dbug: Microsoft.EntityFrameworkCore.ChangeTracking[10801]
DetectChanges completed for 'Issue908Context'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20000]
Opening connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20001]
Opened connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Command[20100]
Executing DbCommand [Parameters=[], CommandType='Text', CommandTimeout='30']
CREATE TABLE __EFMigrationsHistory (
MigrationId varchar(95) NOT NULL,
ProductVersion varchar(32) NOT NULL,
CONSTRAINT PK___EFMigrationsHistory PRIMARY KEY (MigrationId)
);
info: Microsoft.EntityFrameworkCore.Database.Command[20101]
Executed DbCommand (30ms) [Parameters=[], CommandType='Text', CommandTimeout='30']
CREATE TABLE __EFMigrationsHistory (
MigrationId varchar(95) NOT NULL,
ProductVersion varchar(32) NOT NULL,
CONSTRAINT PK___EFMigrationsHistory PRIMARY KEY (MigrationId)
);
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20002]
Closing connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20003]
Closed connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20000]
Opening connection to database '' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20001]
Opened connection to database '' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20000]
Opening connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20001]
Opened connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Command[20100]
Executing DbCommand [Parameters=[], CommandType='Text', CommandTimeout='30']
SELECT 1 FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA='Issue908' AND TABLE_NAME='__EFMigrationsHistory';
info: Microsoft.EntityFrameworkCore.Database.Command[20101]
Executed DbCommand (9ms) [Parameters=[], CommandType='Text', CommandTimeout='30']
SELECT 1 FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA='Issue908' AND TABLE_NAME='__EFMigrationsHistory';
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20002]
Closing connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20003]
Closed connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20000]
Opening connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20001]
Opened connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Command[20100]
Executing DbCommand [Parameters=[], CommandType='Text', CommandTimeout='30']
SELECT MigrationId, ProductVersion
FROM __EFMigrationsHistory
ORDER BY MigrationId;
info: Microsoft.EntityFrameworkCore.Database.Command[20101]
Executed DbCommand (5ms) [Parameters=[], CommandType='Text', CommandTimeout='30']
SELECT MigrationId, ProductVersion
FROM __EFMigrationsHistory
ORDER BY MigrationId;
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20002]
Closing connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20003]
Closed connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Command[20300]
A data reader was disposed.
info: Microsoft.EntityFrameworkCore.Migrations[20402]
Applying migration '20191103140404_InitialCreate'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20000]
Opening connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20001]
Opened connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Transaction[20200]
Beginning transaction with isolation level 'Unspecified'.
dbug: Microsoft.EntityFrameworkCore.Database.Command[20100]
Executing DbCommand [Parameters=[], CommandType='Text', CommandTimeout='30']
CREATE TABLE TestEntities (
Id int NOT NULL AUTO_INCREMENT,
MyValue int NOT NULL,
CONSTRAINT PK_TestEntities PRIMARY KEY (Id)
);
info: Microsoft.EntityFrameworkCore.Database.Command[20101]
Executed DbCommand (31ms) [Parameters=[], CommandType='Text', CommandTimeout='30']
CREATE TABLE TestEntities (
Id int NOT NULL AUTO_INCREMENT,
MyValue int NOT NULL,
CONSTRAINT PK_TestEntities PRIMARY KEY (Id)
);
dbug: Microsoft.EntityFrameworkCore.Database.Command[20100]
Executing DbCommand [Parameters=[], CommandType='Text', CommandTimeout='30']
INSERT INTO TestEntities (Id, MyValue)
VALUES (1, 42);
info: Microsoft.EntityFrameworkCore.Database.Command[20101]
Executed DbCommand (5ms) [Parameters=[], CommandType='Text', CommandTimeout='30']
INSERT INTO TestEntities (Id, MyValue)
VALUES (1, 42);
dbug: Microsoft.EntityFrameworkCore.Database.Command[20100]
Executing DbCommand [Parameters=[], CommandType='Text', CommandTimeout='30']
INSERT INTO __EFMigrationsHistory (MigrationId, ProductVersion)
VALUES ('20191103140404_InitialCreate', '2.1.2-rtm-30932');
info: Microsoft.EntityFrameworkCore.Database.Command[20101]
Executed DbCommand (3ms) [Parameters=[], CommandType='Text', CommandTimeout='30']
INSERT INTO __EFMigrationsHistory (MigrationId, ProductVersion)
VALUES ('20191103140404_InitialCreate', '2.1.2-rtm-30932');
dbug: Microsoft.EntityFrameworkCore.Database.Transaction[20202]
Committing transaction.
dbug: Microsoft.EntityFrameworkCore.Database.Transaction[20204]
Disposing transaction.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20002]
Closing connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20003]
Closed connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Query[10101]
Compiling query model:
'(from TestEntity _1 in DbSet
select [_1]).Single()'
dbug: Microsoft.EntityFrameworkCore.Query[10104]
Optimized query model:
'(from TestEntity _1 in DbSet
select [_1]).Single()'
dbug: Microsoft.EntityFrameworkCore.Query[10107]
(QueryContext queryContext) => IEnumerable _InterceptExceptions(
source: IEnumerable _TrackEntities(
results: IEnumerable _ToSequence(() => TestEntity Single(IEnumerable _ShapedQuery(
queryContext: queryContext,
shaperCommandContext: SelectExpression:
SELECT t.Id, t.MyValue
FROM TestEntities AS t
LIMIT 2,
shaper: UnbufferedEntityShaper))),
queryContext: queryContext,
entityTrackingInfos: { itemType: TestEntity },
entityAccessors: List>
{
Func,
}
),
contextType: IssueConsoleTemplate.Issue908Context,
logger: DiagnosticsLogger,
queryContext: queryContext)
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20000]
Opening connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20001]
Opened connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Command[20100]
Executing DbCommand [Parameters=[], CommandType='Text', CommandTimeout='30']
SELECT t.Id, t.MyValue
FROM TestEntities AS t
LIMIT 2
info: Microsoft.EntityFrameworkCore.Database.Command[20101]
Executed DbCommand (1ms) [Parameters=[], CommandType='Text', CommandTimeout='30']
SELECT t.Id, t.MyValue
FROM TestEntities AS t
LIMIT 2
dbug: Microsoft.EntityFrameworkCore.Database.Command[20300]
A data reader was disposed.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20002]
Closing connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.Database.Connection[20003]
Closed connection to database 'Issue908' on server '127.0.0.1'.
dbug: Microsoft.EntityFrameworkCore.ChangeTracking[10806]
Context 'TestEntity' started tracking '{Id: 1}' entity with key 'Issue908Context'.
dbug: Microsoft.EntityFrameworkCore.Infrastructure[10407]
'Issue908Context' disposed.
```

Please provide us with a fully functional example, that reproduces this issue.
Of course you can always just try the latest version and see. if the issue for you still exists.

[waseemdev]

I spend the whole day figuring out what is the problem with no success.
Here is an example (https://github.com/waseemdev/mariadb-test) that doesn't work on the Ubuntu server but works on my local machine (Windows 10)!

Thank you.

[lauxjpn]

I will take a look at it.

To narrow down the issue:

• Did you run the sample code I provided? Does it work or does it fail?
• Did you try to run your project outside of your docker container on Ubuntu (e.g. in a local VM)?

[lauxjpn]

With the project you provided, I could reproduce the issue.
It is related to your shared DbContext code.

I made the following changes to your files to make your test methods work by basically removing your custom shared DbContext/MySqlConnection code:

Startup.cs:
```c#
using System;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;

namespace WebApplication6
{
public class Startup
{
public Startup(IConfiguration configuration)
{
Configuration = configuration;
}

    public IConfiguration Configuration { get; }

    // This method gets called by the runtime. Use this method to add services to the container.
    public void ConfigureServices(IServiceCollection services)
    {
        var connectionString = Configuration["Data:ApplicationDbContext:ConnectionString"];

        services.AddEntityFrameworkMySql()
            .AddDbContext<ApplicationDbContext>(options => options
                .UseMySql(connectionString, sqlOptions => {
                    sqlOptions.MigrationsAssembly("WebApplication6");
                    sqlOptions.EnableRetryOnFailure(
                        maxRetryCount: 4,
                        maxRetryDelay: TimeSpan.FromMilliseconds(2000),
                        errorNumbersToAdd: null);
                })
                .EnableSensitiveDataLogging()
                .EnableDetailedErrors());

        services.AddMvc();
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        if (env.IsDevelopment())
        {
            //app.UseBrowserLink();
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Error");
        }

        app.UseStaticFiles();

        app.UseMvc();
    }
}

}

**ApplicationDbContext.cs:**
```c#
using Microsoft.EntityFrameworkCore;
using System.ComponentModel.DataAnnotations;
using System.ComponentModel.DataAnnotations.Schema;

namespace WebApplication6
{
    public class ApplicationDbContext : DbContext
    {
        public ApplicationDbContext(DbContextOptions<ApplicationDbContext> options)
            : base(options)
        {
        }

        public DbSet<Items> Items { get; set; }
    }

    public class Items
    {
        [Key]
        [DatabaseGenerated(DatabaseGeneratedOption.Identity)]
        public long Id { get; set; }
        public string Name { get; set; }
        public string Name2 { get; set; }
        public string Name3 { get; set; }
    }
}

[waseemdev]

Did you run the sample code I provided? Does it work or does it fail?

No, but I tried my example with normal DbContext setup without the shared DbContext code as you mentioned, and it is working.
I added this code to share the MySqlConnection between DbContexts so I can use the same transaction over multiple DbContexts.

Did you try to run your project outside of your docker container on Ubuntu (e.g. in a local VM)?

No.

[lauxjpn]

The issue

The underlying issue with sharing a single connection and calling MigrateAsync() is, that the methods responsible for checking the databases existence and so on, create their own temporary connection object for their operations (MySqlRelationalConnection.CreateMasterConnection()).

This temporary connection object needs to get a connection string from somewhere to establish its connection. If you called .UseMySql() with a connection string as a parameter, it will reuse that one.

But if you called it with an already existing connection object, it will retrieve the connection string used for this original connection object from the object itself at the point in time when the temporary connection object needs to be created.

If at this point in time, the original connection object has already been used, sensitive connection information like the password will have already been stripped from the connection string of the original connection for security reasons.

As a result, the connection string used for the temporary connection object might not contain all the necessary information anymore and opening the temporary connection might fail.

Also, because a temporary connection object is used internally (and the EF Core code does not seem to take steps here to enlist in any transaction), this object will not be part of your transaction.

Workaround

You can specify PersistSecurityInfo=True in your connection string for your shared/original connection object and keep the password in the string. This will make the MigrateAsync() call work, but it will still not enlist in your transaction.

If you need the migration commands in your transaction, you can upgrade your code to 3.0.0, as we are supporting ambient transactions in 3.0.0, which should work here, I think.

Steps for us to fix

The easiest way to ensure that we reuse a connection string as best as possible, is to read it from the original connection object the moment a MySqlRelationalConnection is created and override the ConnectionString property to instead always return our early read one.

``c# public class MySqlRelationalConnection { public MySqlRelationalConnection( [NotNull] RelationalConnectionDependencies dependencies) : base(dependencies) { // Read the connection string now, because ifUseMySql()is being called with a // connection object instead with a connection string, and then later //CreateMasterConnection()` is called after the original connection object has
// been opened, sensitive information will have been stripped from the connection
// string by default and the master connnection string might not contain all the
// necessary information to establish its connection. (#908)
this.ConnectionString = base.ConnectionString;
}

public override string ConnectionString { get; }

}
```

This ensures, that even without specifying PersistSecurityInfo=True explicitly, a master connection will be created without issues later on, as long as the original connection had not already been opened at the time it was used as a parameter for .UseMySql().

This should be the expected behavior, because using a second/master connection for internal operations is an implementation detail that most users will be unaware about.

Since using a master connection seems to be the default implementation for providers, this issue might concern other providers as well. /cc @AndriySvyryd @roji

[waseemdev]

Ok, since the issue is when using migration with MySqlConnection only and not with ConnectionString, and at the migration time no need for the transaction, I came up with a simple workaround by adding IsMigration property inside DbContext and checking it, if true then will use a connection string, otherwise will use the shared connection:

    if (IsMigration)
        optionsBuilder.UseMySql(connectionString, ...);
    else
        optionsBuilder.UseMySql(serviceProvider.GetRequiredService<MySqlConnection>(), ...);

Thank you for the information.

[roji]

@lauxjpn yeah, this is indeed an issue. In Npgsql I worked around this by having a CloneWith method on NpgsqlConnection, which accepts a new connection string but keeps authentication information from the clone source (password, SSL/TLS callbacks if relevant). This also allows you to take an existing connection string and change options on it (e.g. make it non-pooling) while conserving auth options, regardless of whether PersistSecurityInfo was set to false.

/cc @bgrainger

[bgrainger]

But if you called it with an already existing connection object, it will retrieve the connection string used for this original connection object from the object itself at the point in time when the temporary connection object needs to be created.

MySqlConnection.Clone was implemented in 0.60.0: https://github.com/mysql-net/MySqlConnector/issues/720

This should copy the original connection string, including authentication information. If you have code that looks like:

var newConnection = new MySqlConnection(existingConnection.ConnectionString);
await newConnection.OpenAsync();

with 0.60.0, you may be able to replace it with:

var newConnection = existingConnection.Clone();
await newConnection.OpenAsync();

Would this fix the problem here?

[lauxjpn]

@bgrainger Yes, that will work!

[bgrainger]

FWIW, I just realised there's a potential problem with Clone (related to getting the connection password): https://github.com/mysql-net/MySqlConnector/issues/735

I don't think it's serious, since any code that can call Clone has other ways (e.g., reflection) to get at that data. But you may want to wait until 0.60.4 is released (later today) if it's a concern.

[lauxjpn]

I think https://github.com/mysql-net/MySqlConnector/issues/735 would remove the possibility again for us to change the connection string settings for a cloned connection and still keep sensitive information, am I right?

The implementation I would have used for the pre 735 fix would have been the following:

```c#
public virtual IMySqlRelationalConnection CreateMasterConnection()
{
var relationalOptions = RelationalOptionsExtension.Extract(Dependencies.ContextOptions);

MySqlConnection connection;
string connectionString;

// Make sure to get the original connection string including sensitive information.
if (relationalOptions.Connection == null)
{
    connection = null;
    connectionString = ConnectionString;
}
else
{
    connection = ((MySqlConnection)DbConnection).Clone(); // <-- Clone the connection
    connectionString = connection.ConnectionString; // <-- Connection string with password
}

// Add master connection specific options.
var csb = new MySqlConnectionStringBuilder(connectionString) {
    Database = string.Empty,
    Pooling = false
};

// Apply modified connection string.
if (connection == null)
{
    relationalOptions = relationalOptions.WithConnectionString(csb.ConnectionString);
}
else
{
    connection.ConnectionString = csb.ConnectionString;
    relationalOptions = relationalOptions.WithConnection(connection);
}

var optionsBuilder = new DbContextOptionsBuilder();
((IDbContextOptionsBuilderInfrastructure)optionsBuilder)
    .AddOrUpdateExtension(relationalOptions);

return new MySqlRelationalConnection(
    Dependencies.With(optionsBuilder.Options),
    _serviceProvider)
{
    IsMasterConnection = true
};

}

I agree though, that MySqlConnector's current implementation does allow to directly retrieve the password, which would violate the whole idea of stripping it from the string in the first place.

If MySqlConnector would implement a method (or overload) like @roji's `CloneWith(string connectionString)`, that takes a connection string as an argument and merges it with its internal one, we would be able to supply different options without the need to access security sensitive information.

https://github.com/npgsql/efcore.pg/blob/55bc10d0c131afea18fd9e820d5924c464910afb/src/EFCore.PG/Storage/Internal/NpgsqlRelationalConnection.cs#L60

```c#
relationalOptions.WithConnection(((NpgsqlConnection)DbConnection).CloneWith(connectionString))

[bgrainger]

Yes, MySqlConnector 0.60.4 will remove the loophole that the code above is (planning on) relying on.

Adding CloneWith seems like the best way to solve this problem. Opened https://github.com/mysql-net/MySqlConnector/issues/736.

[bgrainger]

CloneWith is now available in 0.61.0. I think the code to use it would be a bit shorter and look like this:

    // Get current connection string.
    string connectionString = relationalOptions.Connection?.ConnectionString ?? ConnectionString;

    // Add master connection specific options.
    var csb = new MySqlConnectionStringBuilder(connectionString) {
        Database = "",
        Pooling = false,
    };

    // Apply modified connection string.
    if (relationalOptions.Connection is null)
    {
        relationalOptions = relationalOptions.WithConnectionString(csb.ConnectionString);
    }
    else
    {
        var connection = relationalOptions.Connection.CloneWith(csb.ConnectionString);
        relationalOptions = relationalOptions.WithConnection(connection);
    }

[lauxjpn]

@waseemdev Thanks you for taking the time to report this issue!
And special thanks to @bgrainger and @roji for your work and input on this issue and its solution.

This is fixed with #916.