How can I configure the wrapper with HikariCP and the IAM plugin enabled?

[felixdo]

Hi, could someone give an example how to use the wrapper with HikariCP + the IAM authentication plugin enabled?

[karenc-bq]

Hi @felixdo, you can enable plugins by specifying the wrapperPlugins parameter.

Here is a simple example:

public static void main(String[] args) throws SQLException {
    try (HikariDataSource ds = new HikariDataSource()) {

      // Configure the connection pool:
      ds.setUsername(IAM_DATABASE_USER);

      // Specify the underlying datasource for HikariCP:
      ds.setDataSourceClassName(AwsWrapperDataSource.class.getName());

      // Configure AwsWrapperDataSource:
      ds.addDataSourceProperty("jdbcProtocol", "jdbc:postgresql:");
      ds.addDataSourceProperty("serverName", "db-identifier.cluster-XYZ.us-east-2.rds.amazonaws.com");
      ds.addDataSourceProperty("serverPort", "5432");
      ds.addDataSourceProperty("database", "postgres");

      // The failover plugin throws failover-related exceptions that need to be handled explicitly by HikariCP,
      // otherwise connections will be closed immediately after failover. Set `ExceptionOverrideClassName` to provide
      // a custom exception class.
      ds.setExceptionOverrideClassName("software.amazon.jdbc.util.HikariCPSQLException");

      // Specify the driver-specific data source for AwsWrapperDataSource:
      ds.addDataSourceProperty("targetDataSourceClassName", "org.postgresql.ds.PGSimpleDataSource");

      Properties targetDataSourceProps = new Properties();

      // Enable the IAM authentication plugin along with failover and host monitoring plugins.
      targetDataSourceProps.setProperty("wrapperPlugins", "iam,failover,efm");

      ds.addDataSourceProperty("targetDataSourceProperties", targetDataSourceProps);

      // Attempt a connection:
      try (final Connection conn = ds.getConnection();
          final Statement statement = conn.createStatement();
          final ResultSet rs = statement.executeQuery("SELECT * from aurora_db_instance_identifier()")) {
        while (rs.next()) {
          System.out.println(rs.getString(1));
        }
      }
    }
  }

This example derives from HikariFailoverExample.java.

[felixdo]

Thanks Karen! I had it all correct except missing the setExceptionOverrideClassName. It seems to work fine, I just saw some strange looking lines when I set the hikari logs to trace/debug:

com.zaxxer.hikari.util.PropertyElf: "Try to create a new instance of \"{wrapperPlugins=iam,efm,failover,auroraConnectionTracker}\""
com.zaxxer.hikari.util.PropertyElf: "Class \"{wrapperPlugins=iam,efm,failover,auroraConnectionTracker}\" not found or could not instantiate it (Default constructor)"
com.zaxxer.hikari.pool.PoolBase: "Failed to set login timeout for data source. (null)"}

and then it starts up nicely though:

com.zaxxer.hikari.pool.HikariPool: "HikariPool-1 - Added connection software.amazon.jdbc.wrapper.ConnectionWrapper@96c840a - org.postgresql.jdbc.PgConnection@5c81ddab"}

[bradperkins-gh]

I tried this suggestion and am getting a PAM authentication error. I am using AWS Aurora Postgres database.

I tried as @felixdo has it, and I also tried assuming a role first. Both had the same PAM authentication error.

{"timestamp":"2023-07-02T20:06:18.296+0000","message":"HikariPool-1 - Exception during pool initialization.","logger":"com.zaxxer.hikari.pool.HikariPool","thread_name":"task-1","level":"ERROR","stack_trace":"org.postgresql.util.PSQLException: FATAL: PAM authentication failed for user

I am able to connect if I assume a role and generate my own token and not use the AwsWrapperDataSource, though.