[CONJ-952] Aurora IAM credentialType=AWS-IAM - Access denied for user (using password: YES) Created: 2022-03-31  Updated: 2022-08-16

Status: Open
Project: MariaDB Connector/J
Component/s: aurora
Affects Version/s: 2.7.3
Fix Version/s: None

Type: Bug Priority: Major
Reporter: Liju Assignee: Diego Dupin
Resolution: Unresolved Votes: 0
Labels: None
Environment:

Java 11, Hikari Connection Pool, AWS



 Description   

We use MariaDB driver 2.7.3 & Hikari Datasource in the Java 11 application to connect to the AWS Aurora database. Intermittently we are getting Access denied to user
(using password: YES) error in the error log files. The following is the JDBC URL used in the application.
```
jdbc:mariadb:aurora://<DB writer endpoint>:port,<DB reader endpoint>:port/<DB name>?credentialType=AWS-IAM&useSSL=true&verifyServerCertificate=true&serverSslCert=rds-combined-ca-bundle.pem&autoReconnect=true&fastConnect=true&tcpNoDelay=true&socketTimeout=0
```

credentialType=AWS-IAM will use the RDS token as the password. From the error message, it looks like the expired token is used to get a database connection by the MariaDB driver. Can you please check if this is a bug in the MariaDB driver? Let us know if there is anything else we need to do from an application end? These are the properties set from the application.

spring.datasource.driver-class-name=org.mariadb.jdbc.Driver
spring.datasource.hikari.minimum-idle=5
spring.datasource.hikari.maximum-pool-size=60
spring.datasource.hikari.idle-timeout=600000
spring.datasource.hikari.connection-timeout=3000
spring.datasource.hikari.validation-timeout=1000
spring.datasource.hikari.login-timeout=2000
spring.datasource.hikari.max-lifetime=180000
spring.datasource.hikari.data-source-properties.cachePrepStmts=true
spring.datasource.hikari.data-source-properties.prepStmtCacheSize=1000
spring.datasource.hikari.data-source-properties.prepStmtCacheSqlLimit=2048
spring.datasource.hikari.data-source-properties.useServerPrepStmts=true



 Comments   
Comment by Liju [ 2022-04-01 ]

Any suggestions on this issue ?

Comment by Diego Dupin [ 2022-08-16 ]

I cannot tell, java connector use a 10 TTL cache. AWS indicate that those are valid for 15 minutes.
Could you indicate the return error ?
All i can do here is help identifying the issue, maybe by adding that token comes from cache, and since when it was in cache

Generated at Thu Feb 08 03:19:31 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.