Spring Cloud Azure MySQL support

This article applies to: ✔️ Version 4.19.0 ✔️ Version 5.13.0

Azure Database for MySQL is a relational database service powered by the MySQL community edition. You can use either Single Server or Flexible Server to host a MySQL database in Azure. It's a fully managed database-as-a-service offering that can handle mission-critical workloads with predictable performance and dynamic scalability.

From version 4.5.0, Spring Cloud Azure supports various types of credentials for authentication to Azure Database for MySQL Flexible server.

Supported MySQL version

The current version of the starter should use Azure Database for MySQL Flexible Server version 5.7 or 8.0.

Core features

Passwordless connection

Passwordless connection uses Microsoft Entra authentication for connecting to Azure services without storing any credentials in the application, its configuration files, or in environment variables. Microsoft Entra authentication is a mechanism for connecting to Azure Database for MySQL using identities defined in Microsoft Entra ID. With Microsoft Entra authentication, you can manage database user identities and other Microsoft services in a central location, which simplifies permission management.

How it works

Spring Cloud Azure will first build one of the following types of credentials depending on the application authentication configuration:

• ClientSecretCredential
• ClientCertificateCredential
• UsernamePasswordCredential
• ManagedIdentityCredential
• DefaultAzureCredential

If none of these types of credentials are found, the DefaultAzureCredential credentials will be obtained from application properties, environment variables, managed identities, or the IDE. For more information, see Spring Cloud Azure authentication.

The following high-level diagram summarizes how authentication works using OAuth credential authentication with Azure Database for MySQL. The arrows indicate communication pathways.

Configuration

Spring Cloud Azure for MySQL supports the following two levels of configuration options:

1. The global authentication configuration options of credential and profile with prefixes of spring.cloud.azure.

2. Spring Cloud Azure for MySQL common configuration options.

The following table shows the Spring Cloud Azure for MySQL common configuration options:

Dependency setup

Add the following dependency to your project. This will automatically include the spring-boot-starter dependency in your project transitively.

<dependency>
    <groupId>com.azure.spring</groupId>
    <artifactId>spring-cloud-azure-starter-jdbc-mysql</artifactId>
</dependency>

Basic usage

The following sections show the classic Spring Boot application usage scenarios.

Connect to Azure MySQL locally without password

1. To create users and grant permission, see the Create a MySQL non-admin user and grant permission section of Use Spring Data JDBC with Azure Database for MySQL.

2. Configure the following properties in your application.yml file:

   spring:
     datasource:
       url: jdbc:mysql://${AZURE_MYSQL_SERVER_NAME}.mysql.database.azure.com:3306/${AZURE_MYSQL_DATABASE_NAME}
       username: ${AZURE_MYSQL_AD_NON_ADMIN_USERNAME}
       azure:
         passwordless-enabled: true
   

Connect to Azure MySQL using a service principal

1. Create a Microsoft Entra user for service principal and grant permission.

   1. First, use the following commands to set up some environment variables.

      export AZURE_MYSQL_AZURE_AD_SP_USERID=$(az ad sp list \
          --display-name <service_principal-name> \
          --query '[0].appId' 
          --output tsv)
      export AZURE_MYSQL_AZURE_AD_SP_USERNAME=<YOUR_MYSQL_AZURE_AD_USERNAME>
      export AZURE_MYSQL_SERVER_NAME=<YOUR_MYSQL_SERVER_NAME>
      export AZURE_MYSQL_DATABASE_NAME=<YOUR_MYSQL_DATABASE_NAME>
      export CURRENT_USERNAME=$(az ad signed-in-user show \
          --query userPrincipalName \
          --output tsv)
      

   2. Then, create a SQL script called create_ad_user_sp.sql for creating a non-admin user. Add the following contents and save it locally:

      cat << EOF > create_ad_user_sp.sql
      SET aad_auth_validate_oids_in_tenant = OFF;
      CREATE AADUSER '$AZURE_MYSQL_AZURE_AD_SP_USERNAME' IDENTIFIED BY '$AZURE_MYSQL_AZURE_AD_SP_USERID';
      GRANT ALL PRIVILEGES ON $AZURE_MYSQL_DATABASE_NAME.* TO '$AZURE_MYSQL_AZURE_AD_SP_USERNAME'@'%';
      FLUSH privileges;
      EOF
      

   3. Use the following command to run the SQL script to create the Microsoft Entra non-admin user:

      mysql -h $AZURE_MYSQL_SERVER_NAME.mysql.database.azure.com --user $CURRENT_USERNAME --enable-cleartext-plugin --password=$(az account get-access-token --resource-type oss-rdbms --output tsv --query accessToken) < create_ad_user_sp.sql
      

   4. Now use the following command to remove the temporary SQL script file:

      rm create_ad_user_sp.sql
      

2. Configure the following properties in your application.yml file:

   spring:
     cloud:
       azure:
         credential:
           client-id: ${AZURE_CLIENT_ID}
           client-secret: ${AZURE_CLIENT_SECRET}
         profile:
           tenant-id: <tenant>
     datasource:
       url: jdbc:mysql://${AZURE_MYSQL_SERVER_NAME}.mysql.database.azure.com:3306/${AZURE_MYSQL_DATABASE_NAME}
       username: ${AZURE_MYSQL_AD_SP_USERNAME}
       azure:
         passwordless-enabled: true
   

Connect to Azure MySQL with Managed Identity in Azure Spring Apps

1. To enable managed identity, see the Assign the managed identity using the Azure portal section of Migrate an application to use passwordless connections with Azure Database for MySQL.

2. To grant permissions, see the Assign roles to the managed identity section of Migrate an application to use passwordless connections with Azure Database for MySQL.

3. Configure the following properties in your application.yml file:

   spring:
     datasource:
       url: jdbc:mysql://${AZURE_MYSQL_SERVER_NAME}.mysql.database.azure.com:3306/${AZURE_MYSQL_DATABASE_NAME}
       username: ${AZURE_MYSQL_AD_MI_USERNAME}
       azure:
         passwordless-enabled: true
   

Samples

See the azure-spring-boot-samples repository on GitHub.