7.5.10.2 Installing MySQL REST Service Component

Important

If the validate_password component is installed and enabled, it is not possible to install and configure MySQL REST Service component. If you installed MySQL 26.10 from the YUM or SLES repositories, or an RPM package provided by Oracle, validate_password is installed by default.

To workaround this issue, see Special Considerations for MySQL REST Service Component Installation.

Install the component using the following command:

>INSTALL COMPONENT 'file://component_mysql_rest_service';

Installation initiates startup asynchronously. Successful completion means that the component was registered and startup was accepted; it does not mean that the HTTPS listener is operational.

Check startup progress with the following status variable:

SHOW GLOBAL STATUS LIKE 'mysql_rest_service.state';

Startup reaches READY only after the metadata, internal accounts, security contexts, TLS context, and HTTPS listener have been initialized. An unrecoverable startup failure changes the state to ERROR and writes the detailed cause to the MySQL Server error log.

The component creates or validates the following locked internal accounts:

• 'mysql_mrs_metadata'@'localhost' with default role mysql_rest_service_meta_provider.

• 'mysql_mrs_data'@'localhost' with default role mysql_rest_service_data_provider.

The accounts are locked MySQL accounts used as internal authorization identities. They have no passwords and are not intended for client login. Existing accounts are reused only if they are locked, cannot be used for external login, and have the required provider role. An incompatible existing account is not modified automatically; startup fails and requires administrative action.

The component uses MySQL security contexts rather than stored credentials. Metadata SQL executes as mysql_mrs_metadata. Application-data SQL normally executes as mysql_mrs_data; requests configured for MySQL-user passthrough execute with the authenticated MySQL account's security context.

Uninstalling the component stops the HTTPS listener, cancels pending startup, and unregisters the component's system variables, status variables, lifecycle functions, and dynamic privilege. Active REST requests and SQL execution may be interrupted; graceful draining is not guaranteed.

Uninstallation does not remove the mysql_rest_service_metadata schema, REST service definitions, the internal accounts or their role assignments, MRS runtime-registration metadata, or values stored using SET PERSIST or SET PERSIST_ONLY. Persisted variables remain in mysqld-auto.cnf until removed with RESET PERSIST. If the server starts while the component is not installed, retained MySQL REST Service settings produce the normal unknown-variable warnings for persisted component variables.

Special Considerations for MySQL REST Service Component Installation

If the validate_password component is installed and enabled, it is not possible to create the passwordless internal users mysql_mrs_metadata and mysql_mrs_data. The validate_password component does not permit it.

The following workaround exists for this issue:

1. Configure the MRS metadata schema.

   Connect as an administrator using MySQL Shell with MRS SQL support. If the metadata schema has not already been configured, execute:

              CONFIGURE REST METADATA;

   The metadata setup creates the provider roles required by the following account definitions.

2. Create the internal accounts.

   Execute the following statements as an administrator authorized to create accounts and assign the provider roles. These statements apply to accounts that do not already exist.

    CREATE USER 'mysql_mrs_metadata'@'localhost'
     IDENTIFIED WITH caching_sha2_password
       AS '$A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED'
     DEFAULT ROLE 'mysql_rest_service_meta_provider'@'%'
     ACCOUNT LOCK;
     
     CREATE USER 'mysql_mrs_data'@'localhost'
     IDENTIFIED WITH caching_sha2_password
       AS '$A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED'
     DEFAULT ROLE 'mysql_rest_service_data_provider'@'%'
     ACCOUNT LOCK;

   Keep both accounts locked. Do not assign additional roles or direct privileges to these accounts.

3. Install or restart the MRS component.

   If the component is not installed, install it using the instructions in Section 7.5.10.2, “Installing MySQL REST Service Component”.

   If the component is already installed and startup failed, restart it with the following function:

   SELECT mysql_rest_service_restart();

   The account performing the restart must have the MYSQL_REST_SERVICE_ADMIN privilege, including when connected as root. If necessary, an authorized administrator can grant this privilege before executing the restart. For the current account:

   GRANT MYSQL_REST_SERVICE_ADMIN ON *.* TO CURRENT_USER();

4. Verify startup with mysql_rest_service.state:

   SHOW GLOBAL STATUS LIKE 'mysql_rest_service.state';

TLS Configuration

TLS is mandatory. The MRS listener accepts TLS 1.2 and, when supported by the linked TLS library, TLS 1.3. It owns a TLS context separate from the MySQL main and administrative connection interfaces.

Relative certificate and key paths are interpreted relative to the MySQL data directory. The certificate file may contain the server certificate followed by its intermediate certificate chain. The private key must match the certificate, and both files must be readable by the server.

The configured certificate must be trusted by intended REST clients and valid for the hostname used in the REST URL. Assigning a certificate and key does not by itself establish client trust.

mysql_rest_service.ssl_cipher configures only the TLS 1.2 cipher list. TLS 1.3 ciphersuites use the linked TLS library's default policy. The component does not inherit tls_version or tls_ciphersuites, and it does not expose separate TLS 1.3 ciphersuite, key-exchange, or post-quantum configuration.

Mutual TLS authentication is not supported. The listener does not request or verify client certificates and therefore does not expose MRS-specific CA or certificate-revocation variables.

TLS session caching, session tickets, and TLS compression are disabled. The process-wide `ssl_fips_mode` setting affects the MRS TLS context indirectly.

ALTER INSTANCE RELOAD TLS` reloads the MySQL protocol-channel TLS contexts; it does not reload the MRS listener. To apply new MRS certificate, key, or cipher settings, restart MRS:

SET PERSIST mysql_rest_service.ssl_cert = '/path/to/mrs-cert.pem';
SET PERSIST mysql_rest_service.ssl_key = '/path/to/mrs-key.pem';
SELECT mysql_rest_service_restart();

Restarting interrupts existing MRS connections and invalidates component-issued session state.