4.3.6 Using OpenID Connect

MySQL Shell supports the OpenID Connect authentication protocol. The plugin, authentication_openid_connect_client, is bundled with MySQL Shell .

For information on OpenID Connect, see openid.net.

Note

OpenID Connect authentication protocol is supported by MySQL Enterprise Edition, only.

To connect to a server using OpenID Connect, you must have an OpenID token file and an OpenID user on the target server.

The user must be defined with the authentication_openid_connect plugin. For example:

CREATE USER 'MySQLUser'@'%' IDENTIFIED WITH 'authentication_openid_connect' 
AS '{"identity_provider":"IdentityProviderName", "user":"UserID"}';

The token file must contain the following:

iss: Issuer Identifier for the Issuer of the response. A case-sensitive URL.
sub: Subject Identifier. A locally unique identifier which is intended to be consumed by the Client. A case-sensitive string of no more than 255 characters (ASCII).
aud: Audience(s) the ID Token is intended for. It must contain the OAuth 2.0 client_id of the Relying Party and may also contain identifiers for other audiences.
exp: Token expiration date and time, after which the token is not accepted.
iat: Token issuing date and time.

See linkToRefman for more information.

Connect using one of the following methods:

A commandline string:

> mysqlsh -u MySQLUser --authentication-openid-connect-client-id-token-file=pathToTokenfile/tokenFilename

A connection data dictionary:

> shell.connect({host: 'localhost', port: 'port', user: 'MySQLUser',
                authentication-openid-connect-client-id-token-file: 'pathToTokenfile/tokenFilename'})

The query section of a URI:

MySQLUser@host?authentication-openid-connect-client-id-token-file=pathToTokenfile/tokenFilename

In the configuration file:

[mysqlsh]
authentication_openid_connect_client_id_token_file=pathToTokenfile/tokenFilename