Fix authentication with MySQL 5.1 and older clients

server/conn.go

@@ -729,6 +729,20 @@ func (cc *clientConn) handleAuthPlugin(ctx context.Context, resp *handshakeRespo
 		}
 	} else {
 		logutil.Logger(ctx).Warn("Client without Auth Plugin support; Please upgrade client")
+		if cc.ctx == nil {
+			err := cc.openSession()
+			if err != nil {
+				return err
+			}
+		}
+		userplugin, err := cc.ctx.AuthPluginForUser(&auth.UserIdentity{Username: cc.user, Hostname: cc.peerHost})
+		if err != nil {
+			return err
+		}
+		if userplugin != mysql.AuthNativePassword && userplugin != "" {
+			return errNotSupportedAuthMode
+		}
+		resp.AuthPlugin = mysql.AuthNativePassword
 	}
 	return nil
 }

server/server.go

@@ -102,6 +102,7 @@ var (
 	errSecureTransportRequired = dbterror.ClassServer.NewStd(errno.ErrSecureTransportRequired)
 	errMultiStatementDisabled  = dbterror.ClassServer.NewStd(errno.ErrMultiStatementDisabled)
 	errNewAbortingConnection   = dbterror.ClassServer.NewStd(errno.ErrNewAbortingConnection)
+	errNotSupportedAuthMode    = dbterror.ClassServer.NewStd(errno.ErrNotSupportedAuthMode)
 )
 
 // DefaultCapability is the capability of the server when it is created using the default configuration.