Grant managed identity access to mysql flexible server

Anonymous
2024-09-05T02:22:23.03+00:00

Hi,

I was previously instructed to do the following to grant a managed identify access to a db on a mysql flexible server.

  1. Connect to the server:

az account set --subscription XXXXXXXXXXX

az account get-access-token --resource https://ossrdbms-aad.database.windows.net

mysql -h YYYYY-mysql-01.mysql.database.azure.com   --user ******@email.com   --enable-cleartext-plugin   --password=az account get-access-token --resource-type oss-rdbms --output tsv --query accessToken

But this gives the following errors:
WARNING: option '--enable-cleartext-plugin' is obsolete.

ERROR 1045 (28000): Plugin mysql_clear_password could not be loaded: /usr/lib/mysql/plugin/mysql_clear_password.so: cannot open shared object file: No such file or directory

And without the cleartext plugin:
ERROR 1045 (28000): Plugin caching_sha2_password could not be loaded: /usr/lib/mysql/plugin/caching_sha2_password.so: cannot open shared object file: No such file or directory

  1. Once logged in, run the following commands on the mysql server:

SET aad_auth_validate_oids_in_tenant = OFF;

CREATE AADUSER 'myproject_db_mi' IDENTIFIED BY 'XXXXXXXX

GRANT ALL PRIVILEGES ON main_table_prod.* TO 'myproject_db_mi'@'%';

FLUSH PRIVILEGES;

What is now the recommended way to give myproject_db_mi access to main_table_prod?

Thank you.

Azure Database for MySQL
Azure Database for MySQL
An Azure managed MySQL database service for app development and deployment.
994 questions
{count} votes

2 answers

Sort by: Most helpful
  1. Anonymous
    2024-09-05T20:39:15.08+00:00

    Here is how I was able to connect to the server from Azure bash:

    az mysql flexible-server connect -n SERVER_NAME -u ******@email.com -p COPY_PASTE_ACCESS_TOKEN  --interactive

    Once logged in I would able to run the CREATE AADUSER and the GRANT ALL commands.

    0 comments No comments

  2. SSingh-MSFT 16,371 Reputation points Moderator
    2024-09-11T05:19:12.7366667+00:00

    Hi Jean David Ruvini •,

    Thanks for your patience.

    Please use below command to Add user asigned managed identities to the server:

    az mysql flexible-server identity assign --identity --resource-group --server-name [--no-wait]

    Example:

    Add identities 'test-identity' and 'test-identity-2' to server 'testsvr'.

    az mysql flexible-server identity assign -g testgroup -s testsvr --identity test-identity test-identity-2

    Let us know if this works for your server error.

    Thanks

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.