Spring Cloud Azure MySQL support

This article explains how to use Spring Cloud Azure MySQL support to connect Spring Boot applications to Azure Database for MySQL with flexible authentication options, including passwordless Microsoft Entra authentication.

From version 4.5.0, Spring Cloud Azure supports various types of credentials for authentication to Azure Database for MySQL Flexible server.

Supported MySQL version

The current version of the starter should use Azure Database for MySQL Flexible Server version 5.7 or 8.0.

Core features

Passwordless connection

Passwordless connection uses Microsoft Entra authentication for connecting to Azure services without storing any credentials in the application, its configuration files, or in environment variables. Microsoft Entra authentication is a mechanism for connecting to Azure Database for MySQL using identities defined in Microsoft Entra ID. By using Microsoft Entra authentication, you can manage database user identities and other Microsoft services in a central location, which simplifies permission management.

How it works

Spring Cloud Azure first builds one of the following types of credentials, depending on the application authentication configuration:

• ClientSecretCredential
• ClientCertificateCredential
• UsernamePasswordCredential
• ManagedIdentityCredential
• DefaultAzureCredential

If the application doesn't find any of these types of credentials, it gets DefaultAzureCredential credentials from application properties, environment variables, managed identities, or the IDE. For more information, see Spring Cloud Azure authentication.

The following high-level diagram summarizes how authentication works by using OAuth credential authentication with Azure Database for MySQL. The arrows indicate communication pathways.

Configuration

Spring Cloud Azure for MySQL supports the following two levels of configuration options:

1. The global authentication configuration options of credential and profile with prefixes of spring.cloud.azure.

2. Spring Cloud Azure for MySQL common configuration options.

The following table shows the Spring Cloud Azure for MySQL common configuration options:

Dependency setup

Add the following dependency to your project. This dependency automatically includes the spring-boot-starter dependency in your project.

<dependency>
    <groupId>com.azure.spring</groupId>
    <artifactId>spring-cloud-azure-starter-jdbc-mysql</artifactId>
</dependency>

Basic usage

The following sections show the classic Spring Boot application usage scenarios.

Connect to Azure MySQL locally without password

1. To create users and grant permission, see the Create a MySQL non-admin user and grant permission section of Use Spring Data JDBC with Azure Database for MySQL.

2. Configure the following properties in your application.yml file:

   spring:
     datasource:
       url: jdbc:mysql://${AZURE_MYSQL_SERVER_NAME}.mysql.database.azure.com:3306/${AZURE_MYSQL_DATABASE_NAME}
       username: ${AZURE_MYSQL_AD_NON_ADMIN_USERNAME}
       azure:
         passwordless-enabled: true
   

Connect to Azure MySQL using a service principal

1. Create a Microsoft Entra user for the service principal and grant permission.

   1. Use the following commands to set up environment variables.

      export AZURE_MYSQL_AZURE_AD_SP_USERID=$(az ad sp list \
          --display-name <service_principal-name> \
          --query '[0].appId' 
          --output tsv)
      export AZURE_MYSQL_AZURE_AD_SP_USERNAME=<YOUR_MYSQL_AZURE_AD_USERNAME>
      export AZURE_MYSQL_SERVER_NAME=<YOUR_MYSQL_SERVER_NAME>
      export AZURE_MYSQL_DATABASE_NAME=<YOUR_MYSQL_DATABASE_NAME>
      export CURRENT_USERNAME=$(az ad signed-in-user show \
          --query userPrincipalName \
          --output tsv)
      

   2. Create a SQL script named create_ad_user_sp.sql for creating a non-admin user. Add the following content and save it locally:

      cat << EOF > create_ad_user_sp.sql
      SET aad_auth_validate_oids_in_tenant = OFF;
      CREATE AADUSER '$AZURE_MYSQL_AZURE_AD_SP_USERNAME' IDENTIFIED BY '$AZURE_MYSQL_AZURE_AD_SP_USERID';
      GRANT ALL PRIVILEGES ON $AZURE_MYSQL_DATABASE_NAME.* TO '$AZURE_MYSQL_AZURE_AD_SP_USERNAME'@'%';
      FLUSH privileges;
      EOF
      

   3. Use the following command to run the SQL script to create the Microsoft Entra non-admin user:

      mysql -h $AZURE_MYSQL_SERVER_NAME.mysql.database.azure.com --user $CURRENT_USERNAME --enable-cleartext-plugin --password=$(az account get-access-token --resource-type oss-rdbms --output tsv --query accessToken) < create_ad_user_sp.sql
      

   4. Use the following command to remove the temporary SQL script file:

      rm create_ad_user_sp.sql
      

2. Configure the following properties in your application.yml file:

   spring:
     cloud:
       azure:
         credential:
           client-id: ${AZURE_CLIENT_ID}
           client-secret: ${AZURE_CLIENT_SECRET}
         profile:
           tenant-id: <tenant>
     datasource:
       url: jdbc:mysql://${AZURE_MYSQL_SERVER_NAME}.mysql.database.azure.com:3306/${AZURE_MYSQL_DATABASE_NAME}
       username: ${AZURE_MYSQL_AD_SP_USERNAME}
       azure:
         passwordless-enabled: true
   

Connect to Azure MySQL with Managed Identity in Azure Spring Apps

1. To enable managed identity, see the Assign the managed identity using the Azure portal section of Migrate an application to use passwordless connections with Azure Database for MySQL.

2. To grant permissions, see the Assign roles to the managed identity section of Migrate an application to use passwordless connections with Azure Database for MySQL.

3. Configure the following properties in your application.yml file:

   spring:
     datasource:
       url: jdbc:mysql://${AZURE_MYSQL_SERVER_NAME}.mysql.database.azure.com:3306/${AZURE_MYSQL_DATABASE_NAME}
       username: ${AZURE_MYSQL_AD_MI_USERNAME}
       azure:
         passwordless-enabled: true
   

Samples

See the azure-spring-boot-samples repository on GitHub.