Why I can connect to Azure Database for MySQL - Single Server from Python locally without password(access token)?

Accepted answer

GeethaThatipatri-MSFT 27,722 Reputation points Microsoft Employee

2022-12-22T03:13:28.09+00:00
@Makoto Oda Thanks for the ask and using the Microsoft Q&A platform.
This requires more troubleshooting to isolate the issue, as the error is generic. General reasons for 1045 is outlined in the blog here

Can you connect to MySQL using AAD authentication from client tools like mysql client, workbench etc..

You should be looking at how the host name and user is specified (For single uername@keyman @<servername> is required) ?

If you are receiving the token, then dump that token , Connection object and use client tools like workbench or ADS to connect to the server using the token.

Are the firewall rules in place ?

I hope this information helps to fix your problem.

Regards
Geetha
Please sign in to rate this answer.
GeethaThatipatri-MSFT 27,722 Reputation points Microsoft Employee

2022-12-27T17:21:13.167+00:00

@Makoto Oda We haven't heard back from you. Just wanted to check if you had the chance to check my response.

Regards
Geetha

Makoto Oda 291 Reputation points

2023-01-05T08:41:41.207+00:00

@GeethaThatipatri-MSFT

Thank you for your reply, and I'm sorry for delaying about my slow response.

1) Can you connect to MySQL using AAD authentication from client tools like mysql client, workbench etc..

Yes. However, the behaviour is the same as executing Azure Function.
I can connect to MySQL usging AAD authentication from CLI without access token.
The --password parameter is not needed.
If I set the correct access token with --enable-cleartext-plugin and --password parameters, I get the following error.

ERROR 1045 (28000): Access denied for user '<username>@<domain>'@'<host>' (using password: YES)

I can connect to MySQL using the following command... .\mysql -h <host>.mysql.database.azure.com --user <username>@<domain>@<host> --enable-cleartext-plugin.

2) You should be looking at how the host name and user is specified (For single uername@keyman @<servername> is required) ?

I can connect to MySQL, so I think that the host name and user are correct.

3) If you are receiving the token, then dump that token , Connection object and use client tools like workbench or ADS to connect to the server using the token.

Accecc token is not needed. Why?

4) Are the firewall rules in place ?

Yes. However, I can connect to MySQL without access token, so I think that the firewall rules
are not related to this problem.

GeethaThatipatri-MSFT 27,722 Reputation points Microsoft Employee

2023-01-10T13:28:07.943+00:00

@Makoto Oda Thanks for your response, Thank you for visiting Microsoft QA forums! Please do not forget to "Accept the answer" wherever the information provided helps you to help others in the community

Regards Geetha

Makoto Oda 291 Reputation points

2023-01-11T13:20:02.41+00:00

GeethaThatipatri-MSFT

I answered your questions, but you have not answered my question yet.

So, I'm sorry that I would not accept the answer (because there is no answer to accept).

While this article and this article tell us to specifiy password using access token, why I can connect to Azure Database for MySQL without password (access token)? Other members of our development team can also connect to MySQL without access token.

Please tell us the reason about the above behavior.

GeethaThatipatri-MSFT 27,722 Reputation points Microsoft Employee

2023-01-16T03:42:19.97+00:00

[@Makoto Oda] Sorry, I missed your follow-up question, however, the answer you mentioned is not much clear to me, I would recommend raising a support case with us as It looks some amount of handholding is required. let me know if you need any help in raising a support case.

The logic needs to be the same as mentioned in How to connect to Azure Database for MySQL using Managed Identity of Function App - Microsoft Community Hub

Regards

Geetha
Sign in to comment

Why I can connect to Azure Database for MySQL - Single Server from Python locally without password(access token)?

1 additional answer