Era Host hosting
EraHost – Free Domain, Cheap Hosting!
Client Area
Support 24/7
Menu

Fixing MySqlConnector.MySqlException (0x80004005): Access Denied for User

3 min read
15.01.2026

Verify the Correct Username and Password

First, I check if the credentials in the application's connection string are correct.

MySqlConnector Access Denied
.NET MySQL access denied — auth plugin or bind-address; not credentials.

For other MySQL/MariaDB access topics, see MySQL Error #1227 — SUPER Privilege Required, MySQL native_password Access Denied, and MySql.Data 0x80004005 (.NET classic).

Manual Authentication Test

I try logging into MySQL manually:

mysql -u myuser -p

If authentication fails, I check if the user exists:

SELECT user, host FROM mysql.user;

If myuser is not listed, I create it:

CREATE USER 'myuser'@'localhost' IDENTIFIED BY 'mypassword';
GRANT ALL PRIVILEGES ON *.* TO 'myuser'@'localhost' WITH GRANT OPTION;
FLUSH PRIVILEGES;

If authentication fails but the user exists, I reset the password:

ALTER USER 'myuser'@'localhost' IDENTIFIED BY 'newpassword';
FLUSH PRIVILEGES;

Then, I restart MySQL to ensure changes apply:

sudo systemctl restart mysql

Check Remote Access Settings

If the application connects from another server, MySQL may be blocking the remote connection.

Grant Remote Access

I check if the user is restricted to localhost:

SELECT user, host FROM mysql.user WHERE user = 'myuser';

If the host is localhost, I allow remote access:

GRANT ALL PRIVILEGES ON *.* TO 'myuser'@'%' IDENTIFIED BY 'mypassword';
FLUSH PRIVILEGES;

Check MySQL Bind Address

If MySQL only listens on 127.0.0.1, remote connections won't work. I check my.cnf:

cat /etc/mysql/mysql.conf.d/mysqld.cnf

If I see:

bind-address = 127.0.0.1

I change it to:

bind-address = 0.0.0.0

Then restart MySQL:

sudo systemctl restart mysql

Linux VDS
High performance for your projects
  • Root access and flexible setup
  • Control panel
  • NVMe disks
  • DDR5
Linux VDS

Ensure the Correct Authentication Plugin

Newer MySQL versions (8.0+) use caching_sha2_password, which some connectors don't support. I check:

SELECT user, host, plugin FROM mysql.user WHERE user = 'myuser';

If plugin is caching_sha2_password, but the application requires mysql_native_password, I fix it:

ALTER USER 'myuser'@'%' IDENTIFIED WITH mysql_native_password BY 'mypassword';
FLUSH PRIVILEGES;

Then I update MySQL Connector to ensure compatibility.

Ensure MySQL Connector Is Updated

If the application uses an old MySQL Connector, it may not support the new authentication method. I update the connector:

  • C# (.NET):
    Install-Package MySql.Data -Version 8.0.33
  • Python (MySQL Connector):
    pip install --upgrade mysql-connector-python
  • Node.js:
    npm install mysql2@latest
  • PHP (MySQLi / PDO):
    sudo apt update && sudo apt install php-mysql

Check Firewall and MySQL Port

If MySQL denies access, a firewall might be blocking port 3306. I check with:

sudo ufw status

If it's blocking MySQL, I allow it:

sudo ufw allow 3306/tcp

For iptables, I add:

sudo iptables -A INPUT -p tcp --dport 3306 -j ACCEPT

I also verify MySQL listens on port 3306:

sudo netstat -tulnp | grep mysql

Restart Services and Test the Connection

Once I make changes, I restart MySQL:

sudo systemctl restart mysql

Then I test the connection manually and via the application.

Final Thoughts

If I see "Access Denied for User", I:

  1. Verify username and password.
  2. Grant remote access if needed.
  3. Check authentication plugin compatibility.
  4. Update MySQL Connector.
  5. Check firewall settings.
  6. Restart MySQL and test the connection.

Following these steps always gets MySQL authentication working!

Frequently asked questions
Workbench connects from server localhost; .NET app may connect from different IP. Grants in MySQL are user@host — `app@'localhost'` doesn't cover `app@'192.0.2.5'`. Add: `CREATE USER 'app'@'%' IDENTIFIED BY ''; GRANT ALL ON db.* TO 'app'@'%';`. Or for narrower: replace `%` with the app server IP.
MySqlConnector 1.0+ supports it natively. Older MySqlConnector or MySql.Data classic may not — they expect mysql_native_password. If app is on old .NET MySQL library, either upgrade the library, or downgrade the user's auth: `ALTER USER 'app'@'%' IDENTIFIED WITH mysql_native_password BY '';`.
`/etc/mysql/mysql.conf.d/mysqld.cnf` (or distro path) → `bind-address = 0.0.0.0` allows all IPs. Or specific IP for the app server. Restart MySQL. Then verify with `netstat -tlnp | grep 3306` shows 0.0.0.0:3306. If still 127.0.0.1, config didn't take effect — check exact path of loaded config.
MySqlConnector connection string: `SslMode=Required` (or VerifyCA / VerifyFull). Server-side: `REQUIRE SSL` on the user's grants forces TLS-only. If your app's connection string doesn't include SslMode, it tries plain TCP and gets denied. Set SslMode in conn string to match server's requirements.
Related articles
Using method 'mysql_native_password' failed with message: access denied for user
Updating MySQL Connector for PHP (MySQLi / PDO) to Fix Errors
Fixing MySQL Error #1227: Access Denied for Enabling Event Scheduler