CData Cloud offers access to MySQL across several standard services and protocols, in a cloud-hosted solution. Any application that can connect to a MySQL or SQL Server database can connect to MySQL through CData Cloud.
CData Cloud allows you to standardize and configure connections to MySQL as though it were any other OData endpoint, or standard SQL Server/MySQL database.
This page provides a guide to Establishing a Connection to MySQL in CData Cloud, as well as information on the available resources, and a reference to the available connection properties.
Establishing a Connection shows how to authenticate to MySQL and configure any necessary connection properties to create a database in CData Cloud
Accessing data from MySQL through the available standard services and CData Cloud administration is documented in further details in the CData Cloud Documentation.
Connect to MySQL by selecting the corresponding icon in the Database tab. Required properties are listed under Settings. The Advanced tab lists connection properties that are not typically required.
By default, the Cloud determines user credentials and the NTLM domain automatically, using either the domain of the PC it is running on or the domain used by the machine running the MySQL instance. To discover the user credentials, the Cloud reads the current NTLM user.
If you want to specify a different domain, provide different login credentials, or change the target NTLM version via any or all of the following optional properties:
Your LDAP credentials are auto-detected by default. If you want to designate a different user and account, set the following optional properties:
| Parameter | Set To... | Notes | |
| Azure AD user | AzureTenant | The Microsoft Online tenant where MySQL is located. | See Note 1. |
| AuthScheme | AzureAD | See Note 2. | |
| Azure MSI | AzureTenant | The Microsoft Online tenant where MySQL is located. | See Note 1. |
| AuthScheme | AzureMSI | Most often used when MySQL is running on an Azure VM. | |
| OAuthClientId | Managed identity's client_identity | Required to obtain a token for a managed identity or if the VM has multiple user-assigned managed identities. | |
| Azure Password | AuthScheme | AzurePassword | To connect directly using your Azure credentials, specify the User and Password of the account you use to connect to Azure. |
Notes
When OAuthGrantType is set to CODE (the default), AzureTenant is usually not needed unless the user belongs to multiple tenants. When OAuthGrantType is set to CLIENT, AzureTenant is required.
You can connect to a MySQL database hosted on AWS using either IAM roles or EC2 roles.
Set AuthScheme to AwsIAMRoles.
In many situations, it may be preferable to use an IAM role for authentication instead of the direct security credentials of an AWS root user. If you are specifying the AWSAccessKey and AWSSecretKey of an AWS root user, you may not use roles.
To authenticate as an AWS role, set these properties:
If multi-factor authentication is required, specify the following:
Note: If you want to control the duration of the temporary credentials, set the TemporaryTokenDuration property (default: 3600 seconds).
Set AuthScheme to AwsEC2Roles.
If you are using the Cloud from an EC2 Instance and have an IAM Role assigned to the instance, you can use the IAM Role to authenticate. Since the Cloud automatically obtains your IAM Role credentials and authenticates with them, it is not necessary to specify AWSAccessKey and AWSSecretKey.
If you are also using an IAM role to authenticate, you must additionally set AWSRoleARN to the Role ARN for the role you want to authenticate with.
The MySQL Cloud now supports IMDSv2. Unlike IMDSv1, the new version requires an authentication token. Endpoints and response are the same in both versions.
In IMDSv2, the MySQL Cloud first attempts to retrieve the IMDSv2 metadata token and then uses it to call AWS metadata endpoints. If it is unable to retrieve the token, the Cloud reverts to IMDSv1.
By default, the Cloud attempts to negotiate TLS with the server. The server certificate is validated against the default system trusted certificate store. You can override how the certificate gets validated using the SSLServerCert connection property.
To specify another certificate, see the SSLServerCert connection property.
The MySQL Cloud also supports setting client certificates. Set the following to connect using a client certificate.
Set the following properties:
The connection string properties are the various options that can be used to establish a connection. This section provides a complete list of the options you can configure in the connection string for this provider. Click the links for further details.
For more information on establishing a connection, see Establishing a Connection.
| Property | Description |
| AuthScheme | The scheme used for authentication. Accepted entries are Password, AzureAD, AzurePassword, AzureMSI, AwsIAMRoles, AwsEC2Roles, LDAP. |
| Server | The host name or IP address of the server. Supports cluster servers, for example '192.168.0.1,192.168.0.2'. |
| Port | The port of the MySQL server. Supports cluster servers, for example: '3306, 3307', the number of the port should match with Servers. |
| User | Specifies the user ID of the authenticating MySQL user account. |
| Password | Specifies the password of the authenticating user account. |
| Database | The name of the MySQL database. |
| Domain | The name of the domain for a Windows (NTLM) security login. |
| NTLMVersion | The NTLM version. |
| IntegratedUser | The user that is authenticating to the Windows. |
| UseSSL | This field sets whether SSL is enabled. |
| Property | Description |
| AWSAccessKey | Specifies your AWS account access key. This value is accessible from your AWS security credentials page. |
| AWSSecretKey | Your AWS account secret key. This value is accessible from your AWS security credentials page. |
| AWSRoleARN | The Amazon Resource Name of the role to use when authenticating. |
| Property | Description |
| AzureTenant | Identifies the MySQL tenant being used to access data, either by name (for example, contoso.omnicrosoft.com) or ID. (Conditional). |
| Property | Description |
| OAuthClientId | Specifies the client Id that was assigned the custom OAuth application was created. (Also known as the consumer key.) This ID registers the custom application with the OAuth authorization server. |
| OAuthClientSecret | Specifies the client secret that was assigned when the custom OAuth application was created. (Also known as the consumer secret ). This secret registers the custom application with the OAuth authorization server. |
| Property | Description |
| SSLServerCert | Specifies the certificate to be accepted from the server when connecting using TLS/SSL. |
| Property | Description |
| SSHAuthMode | The authentication method used when establishing an SSH Tunnel to the service. |
| SSHClientCert | A certificate to be used for authenticating the SSHUser. |
| SSHClientCertPassword | The password of the SSHClientCert key if it has one. |
| SSHClientCertSubject | The subject of the SSH client certificate. |
| SSHClientCertType | The type of SSHClientCert private key. |
| SSHServer | The SSH server. |
| SSHPort | The SSH port. |
| SSHUser | The SSH user. |
| SSHPassword | The SSH password. |
| SSHServerFingerprint | The SSH server fingerprint. |
| UseSSH | Whether to tunnel the MySQL connection over SSH. Use SSH. |
| Property | Description |
| Verbosity | Specifies the verbosity level of the log file, which controls the amount of detail logged. Supported values range from 1 to 5. |
| Property | Description |
| BrowsableSchemas | Optional setting that restricts the schemas reported to a subset of all available schemas. For example, BrowsableSchemas=SchemaA,SchemaB,SchemaC . |
| Property | Description |
| AllowUserVariables | When set to True, user variables (prefixed by an @) can be used in SQL queries. |
| Characterset | The default client character set used by the provider. For example, 'utf8'. |
| EnsureKeepAlive | When set to True, a COM_PING is sent to check if the server is alive. |
| MaxRows | Specifies the maximum rows returned for queries without aggregation or GROUP BY. |
| ServerTimeZone | Specify a specific server time zone id of current platform(.Net or Java) by user. |
| Timeout | The value in seconds until the connection timeout error is thrown. |
| TinyInt1Type | The TinyInt1 Type. |
| ZeroDatesToNull | Whether or not to return Date and DateTime values consisting of all zeros as NULL. |
This section provides a complete list of the Authentication properties you can configure in the connection string for this provider.
| Property | Description |
| AuthScheme | The scheme used for authentication. Accepted entries are Password, AzureAD, AzurePassword, AzureMSI, AwsIAMRoles, AwsEC2Roles, LDAP. |
| Server | The host name or IP address of the server. Supports cluster servers, for example '192.168.0.1,192.168.0.2'. |
| Port | The port of the MySQL server. Supports cluster servers, for example: '3306, 3307', the number of the port should match with Servers. |
| User | Specifies the user ID of the authenticating MySQL user account. |
| Password | Specifies the password of the authenticating user account. |
| Database | The name of the MySQL database. |
| Domain | The name of the domain for a Windows (NTLM) security login. |
| NTLMVersion | The NTLM version. |
| IntegratedUser | The user that is authenticating to the Windows. |
| UseSSL | This field sets whether SSL is enabled. |
The scheme used for authentication. Accepted entries are Password, AzureAD, AzurePassword, AzureMSI, AwsIAMRoles, AwsEC2Roles, LDAP.
string
"Password"
The scheme used for authentication. Accepted entries are Password, AzureAD, AzurePassword, AzureMSI, AwsIAMRoles, AwsEC2Roles, LDAP.
The host name or IP address of the server. Supports cluster servers, for example '192.168.0.1,192.168.0.2'.
string
""
The host name or IP of the server hosting the MySQL database.
The port of the MySQL server. Supports cluster servers, for example: '3306, 3307', the number of the port should match with Servers.
string
"3306"
The port of the server hosting the MySQL database.
Specifies the user ID of the authenticating MySQL user account.
string
""
The authenticating server requires both User and Password to validate the user's identity.
Specifies the password of the authenticating user account.
string
""
The authenticating server requires both User and Password to validate the user's identity.
The name of the MySQL database.
string
""
The default database to connect to when connecting to the MySQL Server. If this is not set, tables from all databases will be returned.
The name of the domain for a Windows (NTLM) security login.
string
""
By default, the Cloud uses the domain of the PC it is running on or the domain used by the machine running the MySQL instance.
The NTLM version.
string
"1"
This property specifies the NTLM version to use.
The user that is authenticating to the Windows.
string
""
The user that is authenticating to the Windows.
This field sets whether SSL is enabled.
bool
false
This field sets whether the Cloud will attempt to negotiate TLS/SSL connections to the server. By default, the Cloud checks the server's certificate against the system's trusted certificate store. To specify another certificate, set SSLServerCert.
This section provides a complete list of the AWS Authentication properties you can configure in the connection string for this provider.
| Property | Description |
| AWSAccessKey | Specifies your AWS account access key. This value is accessible from your AWS security credentials page. |
| AWSSecretKey | Your AWS account secret key. This value is accessible from your AWS security credentials page. |
| AWSRoleARN | The Amazon Resource Name of the role to use when authenticating. |
Specifies your AWS account access key. This value is accessible from your AWS security credentials page.
string
""
To find your AWS account access key:
Your AWS account secret key. This value is accessible from your AWS security credentials page.
string
""
Your AWS account secret key. This value is accessible from your AWS security credentials page:
The Amazon Resource Name of the role to use when authenticating.
string
""
When authenticating outside of AWS, it is common to use a Role for authentication instead of your direct AWS account credentials. Entering the AWSRoleARN will cause the CData Cloud to perform a role based authentication instead of using the AWSAccessKey and AWSSecretKey directly. The AWSAccessKey and AWSSecretKey must still be specified to perform this authentication. You cannot use the credentials of an AWS root user when setting RoleARN. The AWSAccessKey and AWSSecretKey must be those of an IAM user.
This section provides a complete list of the Azure Authentication properties you can configure in the connection string for this provider.
| Property | Description |
| AzureTenant | Identifies the MySQL tenant being used to access data, either by name (for example, contoso.omnicrosoft.com) or ID. (Conditional). |
Identifies the MySQL tenant being used to access data, either by name (for example, contoso.omnicrosoft.com) or ID. (Conditional).
string
""
A tenant is a digital representation of your organization, primarily associated with a domain (for example, microsoft.com). The tenant is managed through a Tenant ID (also known as the directory ID), which is specified whenever you assign users permissions to access or manage Azure resources.
To locate the directory ID in the Azure Portal, navigate to Azure Active Directory > Properties.
Specifying AzureTenant is required when AuthScheme = either AzureServicePrincipal or AzureServicePrincipalCert, or if AuthScheme = AzureAD and the user belongs to more than one tenant.
This section provides a complete list of the OAuth properties you can configure in the connection string for this provider.
| Property | Description |
| OAuthClientId | Specifies the client Id that was assigned the custom OAuth application was created. (Also known as the consumer key.) This ID registers the custom application with the OAuth authorization server. |
| OAuthClientSecret | Specifies the client secret that was assigned when the custom OAuth application was created. (Also known as the consumer secret ). This secret registers the custom application with the OAuth authorization server. |
Specifies the client Id that was assigned the custom OAuth application was created. (Also known as the consumer key.) This ID registers the custom application with the OAuth authorization server.
string
""
OAuthClientId is one of a handful of connection parameters that need to be set before users can authenticate via OAuth. For details, see Establishing a Connection.
Specifies the client secret that was assigned when the custom OAuth application was created. (Also known as the consumer secret ). This secret registers the custom application with the OAuth authorization server.
string
""
OAuthClientSecret is one of a handful of connection parameters that need to be set before users can authenticate via OAuth. For details, see Establishing a Connection.
This section provides a complete list of the SSL properties you can configure in the connection string for this provider.
| Property | Description |
| SSLServerCert | Specifies the certificate to be accepted from the server when connecting using TLS/SSL. |
Specifies the certificate to be accepted from the server when connecting using TLS/SSL.
string
""
If using a TLS/SSL connection, this property can be used to specify the TLS/SSL certificate to be accepted from the server. Any other certificate that is not trusted by the machine is rejected.
This property can take the following forms:
| Description | Example |
| A full PEM Certificate (example shortened for brevity) | -----BEGIN CERTIFICATE----- MIIChTCCAe4CAQAwDQYJKoZIhv......Qw== -----END CERTIFICATE----- |
| A path to a local file containing the certificate | C:\cert.cer |
| The public key (example shortened for brevity) | -----BEGIN RSA PUBLIC KEY----- MIGfMA0GCSq......AQAB -----END RSA PUBLIC KEY----- |
| The MD5 Thumbprint (hex values can also be either space or colon separated) | ecadbdda5a1529c58a1e9e09828d70e4 |
| The SHA1 Thumbprint (hex values can also be either space or colon separated) | 34a929226ae0819f2ec14b4a3d904f801cbb150d |
If not specified, any certificate trusted by the machine is accepted.
Use '*' to signify to accept all certificates. Note that this is not recommended due to security concerns.
This section provides a complete list of the SSH properties you can configure in the connection string for this provider.
| Property | Description |
| SSHAuthMode | The authentication method used when establishing an SSH Tunnel to the service. |
| SSHClientCert | A certificate to be used for authenticating the SSHUser. |
| SSHClientCertPassword | The password of the SSHClientCert key if it has one. |
| SSHClientCertSubject | The subject of the SSH client certificate. |
| SSHClientCertType | The type of SSHClientCert private key. |
| SSHServer | The SSH server. |
| SSHPort | The SSH port. |
| SSHUser | The SSH user. |
| SSHPassword | The SSH password. |
| SSHServerFingerprint | The SSH server fingerprint. |
| UseSSH | Whether to tunnel the MySQL connection over SSH. Use SSH. |
The authentication method used when establishing an SSH Tunnel to the service.
string
"Password"
A certificate to be used for authenticating the SSHUser.
string
""
SSHClientCert must contain a valid private key in order to use public key authentication. A public key is optional, if one is not included then the Cloud generates it from the private key. The Cloud sends the public key to the server and the connection is allowed if the user has authorized the public key.
The SSHClientCertType field specifies the type of the key store specified by SSHClientCert. If the store is password protected, specify the password in SSHClientCertPassword.
Some types of key stores are containers which may include multiple keys. By default the Cloud will select the first key in the store, but you can specify a specific key using SSHClientCertSubject.
The password of the SSHClientCert key if it has one.
string
""
This property is required for SSH tunneling when using certificate-based authentication. If the SSH certificate is in a password-protected key store, provide the password using this property to access the certificate.
The subject of the SSH client certificate.
string
"*"
When loading a certificate the subject is used to locate the certificate in the store.
If an exact match is not found, the store is searched for subjects containing the value of the property.
If a match is still not found, the property is set to an empty string, and no certificate is selected.
The special value "*" picks the first certificate in the certificate store.
The certificate subject is a comma separated list of distinguished name fields and values. For instance "CN=www.server.com, OU=test, C=US, [email protected]". Common fields and their meanings are displayed below.
| Field | Meaning |
| CN | Common Name. This is commonly a host name like www.server.com. |
| O | Organization |
| OU | Organizational Unit |
| L | Locality |
| S | State |
| C | Country |
| E | Email Address |
If a field value contains a comma it must be quoted.
The type of SSHClientCert private key.
string
"PEMKEY_BLOB"
This property can take one of the following values:
| Types | Description | Allowed Blob Values |
| MACHINE/USER | Blob values are not supported. | |
| JKSFILE/JKSBLOB | base64-only | |
| PFXFILE/PFXBLOB | A PKCS12-format (.pfx) file. Must contain both a certificate and a private key. | base64-only |
| PEMKEY_FILE/PEMKEY_BLOB | A PEM-format file. Must contain an RSA, DSA, or OPENSSH private key. Can optionally contain a certificate matching the private key. | base64 or plain text. Newlines may be replaced with spaces when providing the blob as text. |
| PPKFILE/PPKBLOB | A PuTTY-format private key created using the puttygen tool. | base64-only |
| XMLFILE/XMLBLOB | An XML key in the format generated by the .NET RSA class: RSA.ToXmlString(true). | base64 or plain text. |
The SSH server.
string
""
The SSH server.
The SSH port.
string
"22"
The SSH port.
The SSH user.
string
""
The SSH user.
The SSH password.
string
""
The SSH password.
The SSH server fingerprint.
string
""
The SSH server fingerprint.
Whether to tunnel the MySQL connection over SSH. Use SSH.
bool
false
By default the Cloud will attempt to connect directly to MySQL. When this option is enabled, the Cloud will instead establish an SSH connection with the SSHServer and tunnel the connection to MySQL through it.
This section provides a complete list of the Logging properties you can configure in the connection string for this provider.
| Property | Description |
| Verbosity | Specifies the verbosity level of the log file, which controls the amount of detail logged. Supported values range from 1 to 5. |
Specifies the verbosity level of the log file, which controls the amount of detail logged. Supported values range from 1 to 5.
string
"1"
This property defines the level of detail the Cloud includes in the log file. Higher verbosity levels increase the detail of the logged information, but may also result in larger log files and slower performance due to the additional data being captured.
The default verbosity level is 1, which is recommended for regular operation. Higher verbosity levels are primarily intended for debugging purposes. For more information on each level, refer to Logging.
When combined with the LogModules property, Verbosity can refine logging to specific categories of information.
This section provides a complete list of the Schema properties you can configure in the connection string for this provider.
| Property | Description |
| BrowsableSchemas | Optional setting that restricts the schemas reported to a subset of all available schemas. For example, BrowsableSchemas=SchemaA,SchemaB,SchemaC . |
Optional setting that restricts the schemas reported to a subset of all available schemas. For example, BrowsableSchemas=SchemaA,SchemaB,SchemaC .
string
""
Listing all available database schemas can take extra time, thus degrading performance. Providing a list of schemas in the connection string saves time and improves performance.
This section provides a complete list of the Miscellaneous properties you can configure in the connection string for this provider.
| Property | Description |
| AllowUserVariables | When set to True, user variables (prefixed by an @) can be used in SQL queries. |
| Characterset | The default client character set used by the provider. For example, 'utf8'. |
| EnsureKeepAlive | When set to True, a COM_PING is sent to check if the server is alive. |
| MaxRows | Specifies the maximum rows returned for queries without aggregation or GROUP BY. |
| ServerTimeZone | Specify a specific server time zone id of current platform(.Net or Java) by user. |
| Timeout | The value in seconds until the connection timeout error is thrown. |
| TinyInt1Type | The TinyInt1 Type. |
| ZeroDatesToNull | Whether or not to return Date and DateTime values consisting of all zeros as NULL. |
When set to True, user variables (prefixed by an @) can be used in SQL queries.
bool
false
When set to True, user variables (prefixed by an @) can be used in SQL queries. The default behavior is to treat identifiers prefixed with @ as command parameters.
The default client character set used by the provider. For example, 'utf8'.
string
""
By default the client character set is determined from the server's language settings, but you can override that value by setting this option. This can be useful if you need to use a specific encoding or collation in your queries.
When set to True, a COM_PING is sent to check if the server is alive.
bool
false
When set to True, a COM_PING is sent to check if the server is alive. The default behavior is to not send a COM_PING.
Specifies the maximum rows returned for queries without aggregation or GROUP BY.
int
-1
This property sets an upper limit on the number of rows the Cloud returns for queries that do not include aggregation or GROUP BY clauses. This limit ensures that queries do not return excessively large result sets by default.
When a query includes a LIMIT clause, the value specified in the query takes precedence over the MaxRows setting. If MaxRows is set to "-1", no row limit is enforced unless a LIMIT clause is explicitly included in the query.
This property is useful for optimizing performance and preventing excessive resource consumption when executing queries that could otherwise return very large datasets.
Specify a specific server time zone id of current platform(.Net or Java) by user.
string
""
Specify a specific server time zone id of current platform(.Net or Java) by user. When set to LOCAL, we assume the server timezone is the same as local, and don't apply any timezone conversion.
The value in seconds until the connection timeout error is thrown.
int
30
If Timeout is 0, operations do not time out. The operations run until they complete successfully or until they encounter an error condition.
If Timeout expires and the operation is not yet complete, the Cloud throws an exception.
The TinyInt1 Type.
string
"TINYINT"
This property specifies the TinyInt1 type to use.
Whether or not to return Date and DateTime values consisting of all zeros as NULL.
bool
true
Whether or not to return Date and DateTime values consisting of all zeros as NULL. A value of all zeros indicates an invalid Date or DateTime value in MySQL. Retrieving such a value may cause parsing errors unless you set this property to True.