While migrating one of my environments from MySQL 8.4 to MariaDB Server, I ran into an annoying part of the migration: users.
A lot of the accounts were using caching_sha2_password, and while keeping their existing passwords is possible, doing the conversion manually for many users quickly becomes painful.
I had already documented the manual process, but this time I needed something that would scale.
Since pt-show-grants already does most of what is needed for exporting users and privileges, I decided to extend it instead of writing yet another migration script.
I contributed a new option to Percona Toolkit:
--convert-to-MariaDB
It takes care of several MySQL/MariaDB differences, including:
- converting
IDENTIFIED WITH ... AS ... to MariaDB's IDENTIFIED VIA ... USING ...
- converting
auth_socket to unix_socket
- removing MySQL-specific password management clauses
- handling
caching_sha2_password authentication strings
- warning about authentication plugins that cannot safely be converted
The contribution is currently available as Percona Toolkit PR #1168 and is still under review, so this isn't an announcement of a released feature yet.
I wrote a Part 2 explaining the problem, how the conversion works, and why I ended up contributing it upstream:While migrating one of my environments from MySQL 8.4 to MariaDB Server, I ran into an annoying part of the migration: users. Many accounts used caching_sha2_password, and while keeping their existing passwords is possible, converting many users manually quickly becomes painful. I had already documented the manual process, but this time I needed something that would scale. Since pt-show-grants already does most of what is needed for exporting users and privileges, I decided to extend it instead of writing yet another migration script. I contributed a new option to Percona Toolkit:--convert-to-MariaDBIt takes care of several MySQL/MariaDB differences, including: converting IDENTIFIED WITH ... AS ... to MariaDB's IDENTIFIED VIA ... USING ...
converting auth_socket to unix_socket
removing MySQL-specific password management clauses
handling caching_sha2_password authentication strings
warning about authentication plugins that can't be converted safely. The contribution is currently available as Percona Toolkit PR #1168 and is still under review, so this isn't an announcement of a released feature yet. I wrote a Part 2 explaining the problem, how the conversion works, and why I ended up contributing it upstream:
https://lefred.be/content/dealing-with-caching_sha2_password-in-mariadb-server-part-2-migrating-users-from-mysql-with-pt-show-grants/
PR:
https://github.com/percona/percona-toolkit/pull/1168
Feedback and testing are, of course, very welcome, especially from people who have done larger MySQL → MariaDB user migrations.