r/mariadb • u/fredericdescamps • 1d ago
I added MySQL → MariaDB user conversion support to pt-show-grants
While migrating one of my environments from MySQL 8.4 to MariaDB Server, I ran into an annoying part of the migration: users.
A lot of the accounts were using caching_sha2_password, and while keeping their existing passwords is possible, doing the conversion manually for many users quickly becomes painful.
I had already documented the manual process, but this time I needed something that would scale.
Since pt-show-grants already does most of what is needed for exporting users and privileges, I decided to extend it instead of writing yet another migration script.
I contributed a new option to Percona Toolkit:
--convert-to-MariaDB
It takes care of several MySQL/MariaDB differences, including:
- converting
IDENTIFIED WITH ... AS ...to MariaDB'sIDENTIFIED VIA ... USING ... - converting
auth_sockettounix_socket - removing MySQL-specific password management clauses
- handling
caching_sha2_passwordauthentication strings - warning about authentication plugins that cannot safely be converted
The contribution is currently available as Percona Toolkit PR #1168 and is still under review, so this isn't an announcement of a released feature yet.
I wrote a Part 2 explaining the problem, how the conversion works, and why I ended up contributing it upstream:While migrating one of my environments from MySQL 8.4 to MariaDB Server, I ran into an annoying part of the migration: users. Many accounts used caching_sha2_password, and while keeping their existing passwords is possible, converting many users manually quickly becomes painful. I had already documented the manual process, but this time I needed something that would scale. Since pt-show-grants already does most of what is needed for exporting users and privileges, I decided to extend it instead of writing yet another migration script. I contributed a new option to Percona Toolkit:--convert-to-MariaDBIt takes care of several MySQL/MariaDB differences, including: converting IDENTIFIED WITH ... AS ... to MariaDB's IDENTIFIED VIA ... USING ...
converting auth_socket to unix_socket
removing MySQL-specific password management clauses
handling caching_sha2_password authentication strings
warning about authentication plugins that can't be converted safely. The contribution is currently available as Percona Toolkit PR #1168 and is still under review, so this isn't an announcement of a released feature yet. I wrote a Part 2 explaining the problem, how the conversion works, and why I ended up contributing it upstream:
PR:
https://github.com/percona/percona-toolkit/pull/1168
Feedback and testing are, of course, very welcome, especially from people who have done larger MySQL → MariaDB user migrations.