Firebird authentication error no matching plugins on server

Jaybird Frequently Asked Questions

1. Where do I get Jaybird?

1.1. Maven

1.1.1. Jaybird 5

Jaybird 5 is available on Maven Central:

5.0.0. (where is java11 or java8 )

Contrary to Jaybird 4, a Maven relocation artifact with artifact id jaybird-XX (with XX jdk17 , jdk18 ) is no longer provided. Please make sure you use the jaybird artifactId.

For example, for Java 11:

If you want to use Type 2 support (native or embedded), you need to explicitly include JNA 5.12.1 as a dependency:

1.1.2. Jaybird 4

Jaybird 4 is available from Maven Central:

4.0.8. (where is java11 , java8 or java7 )

For backwards compatibility, we also provide a Maven relocation artifact with artifact id jaybird-XX (with XX jdk17 or jdk18 . However, we recommend switching to the jaybird artifact.

For example, for Java 11:

If your application is deployed to a Java EE application server, you will need to exclude the javax.resource:connector-api dependency, and add it as a provided dependency:

If you want to use Type 2 support (native, local or embedded), you need to explicitly include JNA 5.5.0 as a dependency:

1.1.3. Jaybird 3

Jaybird 3 is end-of-life and will receive no further updates. We recommend upgrading to Jaybird 4.

Jaybird 3 is available from Maven Central:

jaybird-XX (where XX is jdk18 or jdk17 )

For ease of use, we also provide a Maven relocation artifact with artifact id jaybird . For Jaybird 3 this relocation artifact points to jaybird-jdk18 .

For example, for Java 8:

If your application is deployed to a Java EE application server, you will need to exclude the javax.resource:connector-api dependency, and add it as a provided dependency:

If you want to use Type 2 support (native, local or embedded), you need to explicitly include JNA 4.4.0 as a dependency:

1.1.4. Jaybird 2.2

Jaybird 2.2 is end-of-life and will receive no further updates. We recommend upgrading to Jaybird 4.

1.2. Download

Firebird can be downloaded from the Firebird website, under Downloads, JDBC Driver.

Alternatively, you can go directly to GitHub and download Jaybird from the jaybird releases.

2. Where can I get the sourcecode?

All Jaybird distribution zips contain a jaybird- -sources.zip with the sources used for that specific version. The full Jaybird sourcecode is also available from GitHub in the jaybird repository:

Each release is also tagged in the repository.

3. How is Jaybird licensed?

Jaybird JDBC driver is distributed under the GNU Lesser General Public License (LGPL). Text of the license can be obtained from http://www.gnu.org/copyleft/lesser.html.

Using Jaybird (by importing Jaybird’s public interfaces in your Java code), and extending Jaybird by subclassing or implementation of an extension interface (but not abstract or concrete class) is considered by the authors of Jaybird to be dynamic linking. Hence, our interpretation of the LGPL is that the use of the unmodified Jaybird source does not affect the license of your application code.

Even more, all extension interfaces to which an application might want to link are released under dual LGPL/modified BSD license. Latter is basically «AS IS» license that allows any kind of use of that source code. Jaybird should be viewed as an implementation of that interfaces and the LGPL section for dynamic linking is applicable in this case.

3.1. Which version of the LGPL applies?

Current releases of Jaybird do not explicitly specify an LGPL version. This means that you can choose which version applies. Future versions of Jaybird may specify an explicit version, or be released under a different license.

4. Which Java versions are supported?

Jaybird 5

Jaybird 5 supports Java 8, 11 and 17. Support for Java 9 and higher is limited to Java 11, 17 and the most recent LTS version after Java 17 and the latest Java release. Currently, that means we support Java 8, 11, 17 and 19.

Jaybird 5 is the last version to support Java 8 and 11, support will be dropped with Jaybird 6, raising the minimum supported version to Java 17.

Jaybird 5 will serve as a form of long-term support for Java 8 and 11, with maintenance releases guaranteed at least until the release of Jaybird 7.

Jaybird 4

Jaybird 4 supports Java 7, 8, 11 and 17. Support for Java 9 and higher is limited to Java 11, 17 and the most recent LTS version after Java 17 and the latest Java release. Currently, that means we support Java 7, 8, 11, 17 and 19.

Jaybird 4 is the last version to support Java 7, support will be dropped with Jaybird 5.

Jaybird 3

Jaybird 3.0 supports Java 7 and 8 and has basic support for Java 9 and higher using the Java 8 version of the driver. Support for Java 9 and higher is limited to the latest LTS and current latest release, but in practice Jaybird should work on all Java 9+ versions. Jaybird 3.0.12 is that last release of Jaybird 3.0, and is end-of-life. We recommend upgrading to Jaybird 4.

Jaybird 2.2

Jaybird 2.2 supports Java 6, 7 and 8. Jaybird 2.2.15 is that last release of Jaybird 2.2, and is end-of-life. We recommend upgrading to Jaybird 4.

Jaybird 2.2.4 added basic support for Java 8 (JDBC 4.2), although not all JDBC 4.2 features are supported or fully implemented.

Jaybird 2.2.7 is the last version to support Java 5, support has been dropped with Jaybird 2.2.8.

Jaybird 2.2 is the last version to support Java 6, support has been dropped with Jaybird 3.0.

5. What is the Java 9 module name for Jaybird?

Jaybird itself is not (yet) modularized. To ensure a stable module name, Jaybird, since 2.2.14 and 3.0.3, declares the automatic module name org.firebirdsql.jaybird .

6. Which Firebird versions are supported?

Jaybird 5

Jaybird 5 supports Firebird version 2.5, 3.0 and 4.0, and provides tentative support for Firebird 5.0. Firebird 5.0 will become fully supported in the first release after Firebird 5.0.0.

Jaybird 5 is the last version to support Firebird 2.5. Future versions of Jaybird are not guaranteed to work with version 2.5 and earlier.

Jaybird 4

Jaybird 4 supports Firebird version 2.5, 3.0 and 4.0, and introduces support for Firebird 4.0 types DECLOAT , extended precision of NUMERIC and DECIMAL , and time zone types ( TIME WITH TIME ZONE and TIMESTAMP WITH TIME ZONE ).

Jaybird 4 only provides partial support for Firebird 5.0, and the generated-keys support does not work in all cases due to Firebird 5.0 now supporting multi-row RETURNING . Full Firebird 5.0 support will become available in Jaybird 5.

Jaybird 3

Jaybird 3 supports Firebird versions 2.0 — 4.0. Support for Firebird 4.0 is limited to the Firebird 3.0 feature set. Formally, Firebird 5.0 is not supported, though in practice the problems are similar as for Jaybird 4.

Jaybird 3 is the last version to support Firebird 2.0 and 2.1. Future versions of Jaybird are not guaranteed to work with version 2.1 and earlier.

Jaybird 2.2

Jaybird 2.2 supports Firebird versions 1.0 — 4.0. Jaybird 2.2.4 added support for new features of Firebird 3.0 (e.g. BOOLEAN support). Support for Firebird 4 is limited to the Firebird 3.0 feature set.

Jaybird 2.2 is the last version to support Firebird 1.0 and 1.5. Future versions of Jaybird are not guaranteed to work with these versions.

7. Can Jaybird connect to Interbase?

Jaybird does not support Interbase, and as far as we know connecting to Interbase 6.0 and later will fail due to Firebird specific changes in the implementation.

8. Can Jaybird be used on Android

Jaybird does not work on Android. It uses classes and Java features which are not available on Android.

Instead, we recommend building a webservice (e.g. REST-based) to mediate between your Android application and the database.

Documentation and Support

9. Where to get more information on Jaybird

Apart from this FAQ, you can get additional information from:

For version specific details, consult the release notes

10. Where to get help

On Stack Overflow, please tag your questions with jaybird and firebird

You can subscribe to the mailing list by sending an email to [email protected]

Looking for professional support of Jaybird? Jaybird is now part of the Tidelift subscription.

Firebird support and other Firebird mailing lists for questions not directly related to Jaybird and java.

11. Contributing

There are several ways you can contribute to Jaybird or Firebird in general:

Report bugs or submit patches on the tracker (see Reporting Bugs)

Become a developer (for Jaybird contact us on firebird-java, for Firebird in general, use the Firebird-devel mailing list)

Become a paying member or sponsor of the Firebird Foundation (see https://www.firebirdsql.org/en/firebird-foundation/)

12. Reporting Bugs

The developers follow the firebird-java Google Group. Join the list and post information about suspected bugs. List members may be able to help out to determine if it is an actual bug, provide a workaround and get you going again, whereas bug fixes might take a while.

You can report bugs in the Firebird bug tracker, https://github.com/FirebirdSQL/jaybird/issues/.

When reporting bugs, please provide a minimal, but complete reproduction, including databases and sourcecode to reproduce the problem. Patches to fix bugs are also appreciated. Make sure the patch is against a recent master version of the code. You can also fork the jaybird repository and create pull requests.

Connecting to Firebird

13. JDBC URLs ( java.sql.DriverManager )

13.1. Pure Java (default)

Default URL format:

This will connect to the database using the Type 4 JDBC driver using the Java implementation of the Firebird wire-protocol. This is best suited for client-server applications with dedicated database server. Port can be omitted (default value is 3050 ), host name must be present.

The part is either the hostname, the IPv4 address, or the IPv6 address in brackets (eg [::1] ). Use of IPv6 address literals is only supported in Jaybird 3 or newer with Firebird 3 or newer.

The part should be replaced with the database alias or the path to the database. In general, it is advisable to use database aliases instead of the path of the database file as it hides implementation details like file locations and OS type.

On Linux the root / should be included in the path. A database located on /opt/firebird/db.fdb should use (note the double slash after port!):

Deprecated, but still supported legacy URL format:

The legacy URL format does not support IPv6 address literals.

Jaybird 4 and higher also support:

13.2. Open Office/Libre Office (Pure Java)

Jaybird 5 and earlier can be used together with OpenOffice and LibreOffice Base. To address some compatibility issues (and differences in interpretation of JDBC specifications) a separate sub-protocol is used:

Jaybird 4 and higher also support:

This URL format is deprecated with jaybird 5 and will be removed in Jaybird 6. As a replacement, use the “Firebird External” option in LibreOffice Base.

13.3. Native (using Firebird client library)

Default URL format:

Legacy URL format:

Type 2 driver, will connect to the database using client library ( fbclient.dll on Windows, and libfbclient.so on Linux). Requires correct installation of the client library and — for Jaybird 2.2 or earlier — the Jaybird native library, or — for Jaybird 3.0 and higher — the JNA jar file.

Type 2 driver in local mode. Uses client library as in previous case, however will not use socket communication, but rather access database directly. Requires correct installation of the client library and — for Jaybird 2.2 or earlier — the Jaybird native library, or — for Jaybird 3.0 and higher — the JNA jar file.

Jaybird 4 and higher also support:

As of Jaybird 5, the separate “LOCAL” protocol implementation has been removed. The JDBC URL sub-protocol jdbc:firebirdsql:local and jdbc:firebird:local are still supported but are now simply aliases for “ native ”.

13.4. Embedded Server

Similar to the Firebird client library, however fbembed.dll on Windows and libfbembed.so on Linux are used, falling back to fbclient.dll / libfbclient.so under the assumption it provides Embedded functionality. Requires correctly installed and configured Firebird embedded library and — for Jaybird 2.2 or earlier — the Jaybird native library, or — for Jaybird 3.0 and higher — the JNA jar file.

Jaybird 4 and higher also support:

14. Character sets

14.1. How can I specify the connection character set?

Jaybird provides two connection properties to specify the connection character set:

charSet with a Java character set name (alias: localEncoding )

The Java character set name must map to an equivalent Firebird character set.

encoding with a Firebird character set name (alias: lc_ctype )

The Firebird character set name — except NONE — must map to an equivalent Java character set.

For most applications, use only one of these two properties.

For special situations it is possible to specify both charSet and encoding to convert/reinterpret a character set into another character set, this is usually only necessary to fix data problems.

To phrase differently:

encoding= : use connection encoding and interpret in the equivalent Java character set

charSet= : use Firebird equivalent of as connection encoding and interpret in

encoding= &charSet= : use connection encoding , but interpret in

The handling of Firebird character set NONE is slightly different, see below.

14.2. How does character set NONE work?

The Firebird character set NONE is a special case, it essentially means “no character set”. You can store anything in it, but conversions to or from this character set are not defined.

Using character set NONE can result in incorrect character set handling when the database is used from different locales.

When used as a connection character set, Jaybird handles NONE as follows:

14.2.1. Jaybird 3.0 and higher

encoding=NONE means connection encoding NONE and interpret columns with character set NONE using the default JVM encoding, and interpret columns with an explicit character set in their equivalent Java character set

encoding=NONE&charSet=ISO-8859-1 the same, but instead of the JVM default, use ISO-8859-1

14.2.2. Jaybird 2.2 and earlier

encoding=NONE means use connection encoding NONE and interpret everything using the default JVM encoding

encoding=NONE&charSet=ISO-8859-1 the same, but instead of the JVM default, use ISO-8859-1

14.3. What happens if no connection character set is specified?

When no character set has been specified explicitly, Jaybird 2.2 and earlier, and Jaybird 3.0.2 and higher default to connection character set NONE . See How does character set NONE work? for details on character set NONE .

In Jaybird 3 it is possible to override the default connection character set by specifying system property org.firebirdsql.jdbc.defaultConnectionEncoding with a valid Firebird character set name.

Jaybird 3.0.2 introduces the system property org.firebirdsql.jdbc.requireConnectionEncoding , which — when set to true — will reject connections without a character set (which was the default behavior in Jaybird 3.0.0 and 3.0.1).

14.4. How can I solve the error «Connection rejected: No connection character set specified»

If no character set has been set, Jaybird 3 will reject the connection with an SQLNonTransientConnectionException with message «Connection rejected: No connection character set specified (property lc_ctype, encoding, charSet or localEncoding). Please specify a connection character set (e.g. property charSet=utf-8) or consult the Jaybird documentation for more information.»

In Jaybird 3.0.0 and 3.0.1 this error will be thrown if the character set has not been set explicitly. In Jaybird 3.0.2 and higher this error will only be thrown if system property org.firebirdsql.jdbc.requireConnectionEncoding has been set to true .

To address this error, you can set the default connection character set using one of the following options:

Use connection property encoding (alias: lc_ctype ) with a Firebird character set name.

Use encoding=NONE for the default behavior (with some caveats, see How does character set NONE work?).

Use connection property charSet (alias: localEncoding ) with a Java character set name.

Use a combination of encoding and charSet , if you want to reinterpret a Firebird character set in a Java character set other than the default mapping.

By providing a default Firebird character set with system property org.firebirdsql.jdbc.defaultConnectionEncoding . Jaybird will apply the specified character set as the default when no character set is specified in the connection properties.

This property only supports Firebird character set names.

Use -Dorg.firebirdsql.jdbc.defaultConnectionEncoding=NONE to revert to the default behavior (with some caveats, see How does character set NONE work?). With Jaybird 3.0.2 or higher, it is better to just not set system property org.firebirdsql.jdbc.requireConnectionEncoding if you want to apply NONE .

15. How can I enable the Windows «TCP Loopback Fast Path» introduced in Firebird 3.0.2?

Microsoft has deprecated the SIO_LOOPBACK_FAST_PATH and recommends not to use it.

Firebird 3.0.2 adds support for “TCP Loopback Fast Path” ( SIO_LOOPBACK_FAST_PATH socket option). This is available in Windows 8 / Windows Server 2012 and higher. This feature enables performance optimizations when connecting through localhost (127.0.0.1 / ::1). It requires support on both client and server side.

Java support for «TCP Loopback Fast Path» was introduced in Java 8 update 60, it can be enabled by specifying the system property jdk.net.useFastTcpLoopback with value true (e.g. specify -Djdk.net.useFastTcpLoopback=true in your Java commandline).

Unfortunately, Java only has an ‘all-or-nothing’ support for the “TCP Loopback Fast Path”, so Jaybird cannot enable this for you: you must specify this property on JVM startup. On the other hand, this has the benefit that this works for all Jaybird versions, as long as you use Java 8 update 60 or higher (and Firebird 3.0.2 or higher).

16. Common connection errors

16.1. Your user name and password are not defined. Ask your database administrator to set up a Firebird login. (335544472)

This error means that the user does not exist, or that the specified password is not correct.

When connecting to Firebird 3.0 and higher, this error can also mean that the user does exist (with that password), but not for the authentication plugins tried for this connection.

For example, Jaybird 2.2.x and earlier only support legacy authentication, if you try to log in as a user created for SRP authentication, you will get the same error.

16.2. Incompatible wire encryption levels requested on client and server (335545064)

With Jaybird 3.0.0 — 3.0.3 connecting to Firebird 3.0 or higher, this usually means that the setting WireCrypt is set to its (default) value of Required .

Upgrade to Jaybird 3.0.4 or higher, or relax this setting (in firebird.conf ) to WireCrypt = Enabled .

With Jaybird 3.0.4 or higher, or Jaybird 4, this error means that you have requested a connection with a mismatch in encryption settings. For example, you specified connection property wireCrypt=required while Firebird is set to WireCrypt = Disabled (or vice versa).

16.3. connection rejected by remote interface (335544421)

In general this error means that Jaybird requested a connection with properties not supported by Firebird. It can have other causes than described below.

16.3.1. Cause: username or password is null

With Jaybird 3 and Jaybird 4 connecting to Firebird 3.0 or higher, leaving username or password null will lead to Jaybird not trying any authentication plugin, and as a result Firebird will reject the connection.

With Firebird 2.5 and earlier, or Jaybird 2.2 or earlier, or Jaybird 5 or higher, this situation will yield error “Your user name and password are not defined. Ask your database administrator to set up a Firebird login.”

16.3.2. Cause: wirecrypt required

With Jaybird 2.2.x connecting to Firebird 3.0 or higher, this usually means that the setting WireCrypt is set to its (default) value of Required .

Relax this setting (in firebird.conf ) to WireCrypt = Enabled .

Make sure you check the other settings mentioned in that article, otherwise you’ll get the next error.

16.4. Error occurred during login, please check server firebird.log for details (335545106)

If the logging contains something like

With Jaybird 2.2 connecting to Firebird 3.0 or higher, this means that the setting AuthServer does not include the Legacy_Auth plugin.

Enable Legacy_Auth (in firebird.conf ) by adding this value to the property AuthServer , for example: AuthServer = Srp, Legacy_Auth .

With Jaybird 4 and higher, this can also mean that none of the default authentication plugins, or those specified using connection property authPlugins , are listed in the AuthServer setting. Either revise the Firebird configuration, or explicitly configure connection property authPlugins with authentication plugins that are configured in Firebird.

You also need to make sure your user is created with the legacy user manager, see Jaybird Wiki — Jaybird and Firebird 3 for details.

16.5. Encryption key did not meet algorithm requirements of Symmetric/Arc4 (337248282)

If the exception cause is java.security.InvalidKeyException: Illegal key size or default parameters, this means that your Java installation applies a security policy that does not allow ARCFOUR with a 160 bit encryption key.

If wireCrypt=ENABLED (the default), this is just logged as a warning. The connection will succeed, but it does mean that the connection will not be encrypted. If wireCrypt=REQUIRED , this is thrown as an exception, and the connection will fail.

This could indicate that your Java version applies the limited strength Cryptographic Jurisdiction Policy (this was the default in Java 8 Update 152 and earlier), or has been explicitly configured to apply the limited policy, or has a custom security policy to restrict the cryptographic key size.

Solutions and workarounds:

Apply the unlimited Cryptographic Jurisdiction Policy, see this Stack Overflow answer

Relax your custom security policy to allow 160 bit keys for ARCFOUR

Disable wire encryption for Firebird by setting WireCrypt = Disabled in firebird.conf

Set wireCrypt=DISABLED in the connection properties

Be aware that the first two options may have legal implications depending on the local law in your country regarding cryptography.

JDBC Support

17. How much of JDBC is supported by Jaybird?

WARNING The information in this section is not 100% up-to-date

Jaybird 4 follows the JDBC 4.3 specification with some features and methods not implemented as they are not supported by Firebird.

Most useful JDBC functionality (“useful” in the opinion of the developers).

XA transactions with true two phase commit when used via javax.sql.XADataSource implementation org.firebirdsql.ds.FBXADataSource .

ObjectFactory implementation org.firebirdsql.ds.DataSourceFactory for use in environments with JNDI but no TransactionManager .

DataSource implementation org.firebirdsql.ds.FBSimpleDataSource (no pooling).

ConnectionPoolDataSource implementation org.firebirdsql.ds.FBConnectionPoolDataSource (please be aware, contrary to suggested by the naming, this does not provide connection pooling, this is intended as a factory of connections for use by a connection pool, e.g. as provided by a Java EE/Jakarta EE application server)

Complete access to all Firebird database parameter block and transaction parameter block settings.

JMX mbean for database management (so far just database create and drop).

18. What parts of JDBC are NOT supported by Jaybird?

WARNING The information in this section is outdated

The following optional features are NOT supported:

The following optional features and the methods that support it are not implemented:

Ref and Array types.

setRef(int i, Ref x)

setArray(int i, Array x)

User Defined Types/Type Maps.

getObject(int i, java.util.Map map)

getObject(String columnName, java.util.Map map)

Excluding the unsupported features, the following methods are not yet implemented:

getBytes(long pos, int length)

position(byte pattern[], long start)

position(Blob pattern, long start)

getBinaryStream(long pos, long length)

Methods with a position ( pos ) parameter with a value greater than 1

position(String searchstr, long start)

position(Clob searchstr, long start)

getCharacterStream(long pos, long length)

Methods with a position ( pos ) parameter with a value greater than 1

The following methods are implemented, but do not work as expected:

get/setMaxFieldSize does nothing

get/setQueryTimeout supported since Jaybird 4 with Firebird 4.0 and higher

setObject(index,object,type) This method is implemented but behaves as setObject(index,object)

setObject(index,object,type,scale) This method is implemented but behaves as setObject(index,object)

getBigDecimal(index,scale) This method is implemented but behaves as getBigDecimal(index) . The method is deprecated, and we suggest using getBigDecimal(index) and adjust the scale of the returned BigDecimal using BigDecimal.setScale(newScale,roundingMode)

isReadOnly(i) always returns false

isWritable(i) always returns true

isDefinitivelyWritable(i) always returns true

getBigDecimal(index,scale) This method is implemented but behaves as getBigDecimal(index) . The method is deprecated, and we suggest using getBigDecimal(index) and adjust the scale of the returned BigDecimal using BigDecimal.setScale(newScale,roundingMode)

Features

19. Does Jaybird support connection pooling?

Jaybird itself no longer provides connection pooling. Earlier versions had a DataSource implementation with connection pooling, but this implementation had severe bugs. This implementation (and all other classes in org.firebirdsql.pool ) was deprecated in Jaybird 2.2 and dropped in Jaybird 3.

Jaybird provides a basic DataSource implementation and a ConnectionPoolDataSource implementation. Contrary to its name the latter does not provide a connection pool, but is intended to be used by a connection pool (as implemented in an application server) to create connections for the connection pool.

If your application is built on a Java EE/Jakarta EE application server, we suggest you use the connection pooling provided by the application server using the javax.sql.ConnectionPoolDataSource implementation org.firebirdsql.ds.FBConnectionPoolDataSource , or using the javax.sql.XADataSource implementation org.firebirdsql.ds.FBXADataSource .

If you develop standalone applications, or you use an application server without connection pooling, we suggest you use third-party libraries like:

Источник

I just upgraded my DB to Firebird 4.0 and all seems to work when connecting to the DB using a database management tool.

So now I try to connect, after making sure I’ve upgarded my ADO.Net to FirebirdSql.Data.FirebirdClient v8.0.1 (latest).

Here is how I create my connection string (yes, db path exists and I made sure that users have modification rights):

 FbConnectionStringBuilder cs = new FbConnectionStringBuilder();
 cs.Database = @"C:/myPath/MyDB.FDB";
 cs.DataSource = "localhost";
 cs.UserID = "sysdba";
 cs.Password = "masterkey";
 cs.Dialect = 3;
 cs.Pooling = false;
 cs.ServerType = FbServerType.Default;
 // --- Omitted at first - any of the 3 types leads to errors!
 //cs.WireCrypt = FbWireCrypt.Disabled;
 var DBConn = new FbConnection(cs.ConnectionString);
 DBConn.Open();

Now, notice I left out WireCrypt option (on purpose to start with). My error is:

Error occurred during login, please check server firebird.log for details

firebird.log says:

Authentication error No matching plugins on server

So I googled around and found hints it may come from wire encryption. Well ok, so I did try all 3 versions of wire encryption — if I use Required or Enabled, I get the above error. If I use the Disabled , I get

Incompatible wire encryption levels requested on client and server

Furthermore, I tried setting WireCrypt = Disabled in firebird.conf and in my code, restarted the service and tested again — now I have the same result as with the first two cases:

Authentication error No matching plugins on server

So I guess I’m missing something here about the encryption plugins — but I couldn’t find any valuable information there, thanks for helping out!

UPDATE: here are the settings I tried and the error I got:

Attempt 1: all firebird.conf defaults (I posted it here to keep things short here):

Connection string 1:

character set=NONE;data source=localhost;initial catalog=C:UsersDBAccessMYDB.FDB;user id=SYSDBA;password=masterkey;wire crypt=Disabled

Incompatible wire encryption levels requested on client and server

Connection string 2 (wire crypt=Enabled or Required)

Authentication error No matching plugins on server

Attempt 2:

WireCrypt = Disabled

Connection string 1:

character set=NONE;data source=localhost;initial catalog=C:UsersDBAccessMYDB.FDB;user id=SYSDBA;password=masterkey;wire crypt=Disabled

Authentication error No matching plugins on server

Connection string 2 (wire crypt=Enabled) => same error!

Attempt 3:

AuthClient = Srp256, Srp
UserManager = Srp

Connection string 1:

character set=NONE;data source=localhost;initial catalog=C:UsersDBAccessMYDB.FDB;user id=SYSDBA;password=masterkey;wire crypt=Disabled

Incompatible wire encryption levels requested on client and server

Connection string 2 (wire crypt=Enabled or Required)

Authentication error No matching plugins on server

Attempt 4:

AuthClient = Srp256, Srp
UserManager = Srp
WireCryptPlugin = ChaCha, Arc4
WireCrypt = Enabled
ServerMode = Super

Connection string (same result with any wire crypt option in the connection string):

character set=NONE;data source=localhost;initial catalog=C:UsersDBAccessMYDB.FDB;user id=SYSDBA;password=masterkey;wire crypt=Enabled

Authentication error No matching plugins on server

NOTE: I also see the following message in firebird.log, which is possibly due to the service restart…

inet_error: read errno = 10054, client host = DESKTOP-1234, address = 127.0.0.1/60348, user = myusername

Submitted by: @pavel-zotov

Attachments:
logs-with-failed-first-attempt-to-connect.7z
c5050-upd.7z

1. Create SQL script (I’ve named it ‘c4868.sql’ because this is next step of investigation core-4868 issues):

set term ^;
create or alter procedure sys_get_fb_arch (
a_connect_with_usr varchar(31) default ‘SYSDBA’
,a_connect_with_pwd varchar(31) default ‘masterke’
) returns(
fb_arch varchar(50)
) as
declare cur_server_pid int;
declare ext_server_pid int;
declare att_protocol varchar(255);
declare v_test_sttm varchar(255);
declare v_fetches_beg bigint;
declare v_fetches_end bigint;
begin

-- Aux SP for detect FB architecture.

select a.mon$server_pid, a.mon$remote_protocol
from mon$attachments a
where a.mon$attachment_id = current_connection
into cur_server_pid, att_protocol;

if ( att_protocol is null ) then
    fb_arch = 'Embedded';
else if ( upper(current_user) = upper('SYSDBA')
          and rdb$get_context('SYSTEM','ENGINE_VERSION') NOT starting with '2.5' 
          and exists(select * from mon$attachments a 
                     where a.mon$remote_protocol is null
                           and upper(a.mon$user) in ( upper('Cache Writer'), upper('Garbage Collector'))
                    ) 
        ) then
    fb_arch = 'SuperServer';
else
    begin
        v_test_sttm =
            'select a.mon$server_pid + 0*(select 1 from rdb$database)'
            ||' from mon$attachments a '
            ||' where a.mon$attachment_id = current_connection';

        select i.mon$page_fetches
        from mon$io_stats i
        where i.mon$stat_group = 0  -- db_level
        into v_fetches_beg;
    
        execute statement v_test_sttm
        on external
             'localhost:' || rdb$get_context('SYSTEM', 'DB_NAME')
        as
             user a_connect_with_usr
             password a_connect_with_pwd
             role left('R' || replace(uuid_to_char(gen_uuid()),'-',''),31)
        into ext_server_pid;
    
        in autonomous transaction do
        select i.mon$page_fetches
        from mon$io_stats i
        where i.mon$stat_group = 0  -- db_level
        into v_fetches_end;
    
        fb_arch = iif( cur_server_pid is distinct from ext_server_pid, 
                       'Classic', 
                       iif( v_fetches_beg is not distinct from v_fetches_end, 
                            'SuperClassic', 
                            'SuperServer'
                          ) 
                     );
    end

fb_arch = fb_arch || ' ' || rdb$get_context('SYSTEM','ENGINE_VERSION');

suspend;

end

^ — sys_get_fb_arch
set term ;^
commit;

create or alter view v_info as
select
mon$user as who_ami,
mon$auth_method as my_auth,
rdb$get_context(‘SYSTEM’,’CLIENT_PROCESS’) as my_exe,
mon$client_version as my_fbdll,
current_connection as my_attach,
p.fb_arch
from mon$attachments
left join sys_get_fb_arch(‘SYSDBA’, ‘masterke’) p on 1=1
where mon$attachment_id = current_connection
;

set list on;

set term ^;
execute block returns(
msg varchar(50),
fb_arch type of column v_info.fb_arch,
who_ami type of column v_info.who_ami,
my_auth type of column v_info.my_auth,
my_exe type of column v_info.my_exe,
my_fbdll type of column v_info.my_fbdll,
my_attach type of column v_info.my_attach
) as
begin

for
select ‘From main connection’, fb_arch, who_ami, my_auth, my_exe, my_fbdll, my_attach
from v_info
into msg, fb_arch, who_ami, my_auth, my_exe, my_fbdll, my_attach
do
suspend;

for
execute statement
‘select »From connection via ES/EDS», fb_arch, who_ami, my_auth, my_exe, my_fbdll, my_attach ‘
||’ from v_info’
on external ‘localhost:’ || rdb$get_context(‘SYSTEM’,’DB_NAME’)
as user ‘SYSDBA’ password ‘masterke’
into msg, fb_arch, who_ami, my_auth, my_exe, my_fbdll, my_attach
do
suspend;
end
^
set term ;^
rollback;

2. Create batch file with name that is matched to SQL (except extension, of course; so, its name here is: ‘c4868.bat’):

@echo off
setlocal enabledelayedexpansion enableextensions

@Rem path to ISQL on client machine:
set fbc=C:MIXfirebirdfb30

@Rem Remote host, port and DB alias:
set host=192.168.0.220
set port=3333
set dbnm=e30

set pbak=%path%
set path=%fbc%;%pbak%

@Rem Define current timestamp in order to add its value to LOGS:
set vbs=%~n0.tmp.vbs
del %vbs% 2>nul
(
echo strDate = DatePart(«yyyy»,Date^) _
echo ^& Right(«0» ^& DatePart(«m»,Date^), 2^) _
echo ^& Right(«0» ^& DatePart(«d»,Date^), 2^)
echo strTime = Right(«0» ^& Hour(Now^), 2^) _
echo ^& Right(«0» ^& Minute(Now^), 2^)
@Rem echo ^& Right(«0» ^& Second(Now^), 2^)
echo Wscript.Echo( strDate ^& «_» ^& strTime^)
) >>%vbs%

for /f %%i in (‘cscript /nologo %vbs%’) do set dts=%%i
del %vbs% 2>nul

set log=%~n0.%dts%.log
set err=%~n0.%dts%.err
set tmp=%~n0.tmp
del %log% 2>nul
del %err% 2>nul

echo Starting probes at !time!
set k=0
:m1
set /a k=!k!+1
set msg=!time!. Probe #⁠ !k!

echo !msg!
echo !msg!>>%log%

%fbc%\isql %host%/%port%:%dbnm% -z -i %~n0.sql 1>>%log% 2>>%tmp%

findstr /i SYSDBA %log% >nul
if not errorlevel 1 goto end

for /f "tokens=*" %%a in ('findstr /i /c:"statement failed" %tmp%') do (
  echo !time! %%a >>%err%
)
del %tmp% 2>nul

echo !time!. FAILED.

ping -n 1 127.0.0.1 >nul

goto :m1

:end
if not exist %err% (
echo !time!. Got connection at FIRST attempt, no logs required.
type %log%
del %log%
) else (
echo !time! Got connection only at !k!th attempt, check %err%
)
del %tmp% 2>nul
set path=%pbak%

3. Replace in batch settings of: FBC, HOST, PORT and DBNM to yours.

4. Change firebird.conf on server to:

AuthClient = Srp,Legacy_Auth,Win_Sspi
AuthServer = Srp,Legacy_Auth
BugCheckAbort=1
ExternalFileAccess = Restrict /var/db/fb30
FileSystemCacheThreshold = 65536K
LockHashSlots = 22111
LockMemSize = 64M
MaxUserTraceLogSize = 99999
RemoteServicePort = 3333
Servermode = Classic
TempCacheLimit = 2147483647
TempDirectories = /tmp/firebird
UserManager = Srp
WireCrypt = Disabled

NOTE: ‘Srp’ must be at 1st position in Auth* lists.
Client-side firebird.conf can be with either ‘Legacy’ or ‘Srp’ in 1st position of plugins — this seems has no matter.

5. Open two console windows: 1) on server host (I use FB on Linux, so get this via Putty); 2) on client machine (Windows XP).

6. Switch to client console and type: C4868.BAT — but do NOT press Enter now.
7. Stop FB if it is running as service. Type in command prompt: /opt/fb30/bin/firebird — but also do NOT press Enter for now.

8. Check that when you will press Alt-Tab then Windows will switch between server & client console windows and do not ‘jumps’ to some other window (if exists).

9. Switch to server console and press Enter.
10. Swicth === !! AS FAST AS YOU CAN !! == to client console (by pressing Alt-Tab) and press Enter there.

When FB is launched as Classic (as it show above) one may to get almost in every 3/4 runs following (in the client console):

Starting probes at 13:13:54,80
13:13:54,80. Probe #⁠ 1
13:13:55,97. FAILED.
13:13:56,00. Probe #⁠ 2
13:13:57,18. FAILED.
13:13:57,21. Probe #⁠ 3
13:13:58,38. FAILED.
13:13:58,39. Probe #⁠ 4
13:13:59,58. FAILED.
13:13:59,60. Probe #⁠ 5
13:14:00,80. FAILED.
13:14:00,82. Probe #⁠ 6
13:14:02,00. FAILED.
13:14:02,02. Probe #⁠ 7
13:14:03,21. FAILED.
13:14:03,22. Probe #⁠ 8
13:14:04,60 Got connection only at 8th attempt, check c4868.20151219_1313.err

Most often there are 25 attempts before connection can be established (for Classic).

When FB is launched as SuperClassic this strange behaviour is harder to reproduce, and it seems that one may to get it only at FIRST running since parameter ‘Servermode’ was changed to SC. Any subsequent launched of batch will report that connection is established immediatelly, at 1st attempt.

When FB is launched as SuperServer this effect could not be reproduced by me.

When ‘Legacy’ is placed at 1st position on server firebird.conf this effect does not appear.

When FB is running as service this effect also does not appear.

IMPORTANT NOTES.

1. *** WAIT *** at least 20-30 seconds after FB application process is stopped (by pressing Ctrl-C). Do not launch it again just after you change config if this time was not elapsed yet!

2. If you change Servermode to SuperClassic you will be able to get failed attempts only ONCE, even if later you will stop FB application and wait more than several minutes. You have to change Servermode to Classic and do at least one launch before change it back to SuperClassic. MISTERIOUS but this is what I’ve got on my environment.

3. When you will play only with Servermode = Classic you will get failed attempts almost every time (I got approx. in 75% of cases), so you can leave config unchanged. But remember: you have to WAIT at least 20-30 seconds before subsequent run of batch.

Bulk of logs with failed 1st and subsequent attaches see in attached file.

PS. It’s very pity that one may not to obtain actual server config parameters in ISQL (by some new fields in rdb$database ?) and log them

I just upgraded my DB to Firebird 4.0 and all seems to work when connecting to the DB using a database management tool.

So now I try to connect, after making sure I’ve upgarded my ADO.Net to FirebirdSql.Data.FirebirdClient v8.0.1 (latest).

Here is how I create my connection string (yes, db path exists and I made sure that users have modification rights):

 FbConnectionStringBuilder cs = new FbConnectionStringBuilder();
 cs.Database = @"C:/myPath/MyDB.FDB";
 cs.DataSource = "localhost";
 cs.UserID = "sysdba";
 cs.Password = "masterkey";
 cs.Dialect = 3;
 cs.Pooling = false;
 cs.ServerType = FbServerType.Default;
 // --- Omitted at first - any of the 3 types leads to errors!
 //cs.WireCrypt = FbWireCrypt.Disabled;
 var DBConn = new FbConnection(cs.ConnectionString);
 DBConn.Open();

Now, notice I left out

option (on purpose to start with). My error is:

Error occurred during login, please check server firebird.log for details

says:

Authentication error No matching plugins on server

So I googled around and found hints it may come from wire encryption. Well ok, so I did try all 3 versions of wire encryption – if I use

or

, I get the above error. If I use the

, I get

Incompatible wire encryption levels requested on client and server

Furthermore, I tried setting

in

and in my code, restarted the service and tested again – now I have the same result as with the first two cases:

Authentication error No matching plugins on server

So I guess I’m missing something here about the encryption plugins – but I couldn’t find any valuable information there, thanks for helping out!

UPDATE: here are the settings I tried and the error I got:

Attempt 1: all

defaults (I posted it here to keep things short here):

Connection string 1:

character set=NONE;data source=localhost;initial catalog=C:UsersDBAccessMYDB.FDB;user id=SYSDBA;password=masterkey;wire crypt=Disabled

Incompatible wire encryption levels requested on client and server

Connection string 2 (wire crypt=Enabled or Required)

Authentication error No matching plugins on server

Attempt 2:

Connection string 1:

character set=NONE;data source=localhost;initial catalog=C:UsersDBAccessMYDB.FDB;user id=SYSDBA;password=masterkey;wire crypt=Disabled

Authentication error No matching plugins on server

Connection string 2 (wire crypt=Enabled) => same error!

Attempt 3:

AuthClient = Srp256, Srp
UserManager = Srp

Connection string 1:

character set=NONE;data source=localhost;initial catalog=C:UsersDBAccessMYDB.FDB;user id=SYSDBA;password=masterkey;wire crypt=Disabled

Incompatible wire encryption levels requested on client and server

Connection string 2 (wire crypt=Enabled or Required)

Authentication error No matching plugins on server

Attempt 4:

AuthClient = Srp256, Srp
UserManager = Srp
WireCryptPlugin = ChaCha, Arc4
WireCrypt = Enabled
ServerMode = Super

Connection string (same result with any wire crypt option in the connection string):

character set=NONE;data source=localhost;initial catalog=C:UsersDBAccessMYDB.FDB;user id=SYSDBA;password=masterkey;wire crypt=Enabled

Authentication error No matching plugins on server

NOTE: I also see the following message in

, which is possibly due to the service restart…

inet_error: read errno = 10054, client host = DESKTOP-1234, address = 127.0.0.1/60348, user = myusername