Skip to content
Fresco BIFresco BIFresco BI Docs

Search is only available in production builds. Try building and previewing the site to test it out locally.

TiDB

TiDB uses the MySQL guide below. What differs:

  • Default port is 4000. SSL modes are the same as MySQL (default required).
  • DirectQuery is not available: tables are imported into a Data Table only.
  • No SSH tunnel: use Cloud with Fresco BI’s outbound IP addresses (the setup guide beside the data source form lists them) allowed, or On-premises (via Gateway).
  • Fresco BI sets no read-only session on TiDB, so the account itself must be read-only: grant only SELECT and SHOW VIEW, as in Step 1.
  • Supported from TiDB 7.5. Each load reads from one consistent snapshot.
  • A running query is stopped with KILL only when enable_global_kill is on; otherwise Fresco BI closes its own connection instead.

Connect a MySQL database to Fresco BI. Fresco BI reads tables and views with a read-only session and loads them into a Data Table (Import) or queries them live (DirectQuery).

Feature Supported
Import Yes
DirectQuery Yes
SSL/TLS preferred, required (default), verify_ca, verify_identity
SSH tunnel Yes
Cloud Yes
On-premises (via Gateway) Yes

Prerequisites

Section titled “Prerequisites”
  • A MySQL server that accepts TCP connections on its port (default 3306).
  • An admin account that can run CREATE USER and GRANT.
  • The name of the database you want to read.
  • SSL enabled on the server is strongly recommended. Fresco BI needs TLS 1.2 or newer.

Step 1: Create a read-only user

Section titled “Step 1: Create a read-only user”

Create a dedicated user that can only read. The host part ('%' below) should be as narrow as possible: one entry per Fresco BI IP address, or the IP of your bastion or Gateway machine.

CREATE USER 'fresco_reader'@'%' IDENTIFIED BY '<strong-password>';
GRANT SELECT, SHOW VIEW ON <database>.* TO 'fresco_reader'@'%';

A grant on <database>.* also covers tables created later in that database, so no extra step is needed for future tables. Repeat the GRANT for every database you want to browse. Fresco BI also opens each session with transaction_read_only = ON, so it never writes even if the account could.

To require TLS for this user (recommended):

ALTER USER 'fresco_reader'@'%' REQUIRE SSL;

Step 2: Allow network access

Section titled “Step 2: Allow network access”

Pick one of these:

  • Cloud (database reachable from the internet). Allow inbound connections from Fresco BI’s outbound IP addresses (the setup guide beside the data source form lists them) on the MySQL port. On AWS RDS, add an inbound rule to the instance’s security group for TCP 3306 from each address. On Google Cloud SQL or Azure, add the addresses to the authorized networks or firewall rules. The MySQL user’s host part must also match these addresses.
  • SSH tunnel. If the database is open only to a bastion host, keep Cloud and turn on the SSH tunnel in the form (Step 3). The database only needs to accept connections from the bastion.
  • On-premises (via Gateway). If the database sits inside a private network, choose On-premises (via Gateway) in the form. The panel switches to the Gateway guide when that option is picked.

Step 3: Fill in the form

Section titled “Step 3: Fill in the form”
  • Connection type: Cloud or On-premises (via Gateway). With On-premises, pick a Gateway cluster.
  • Display name: the name shown in Fresco BI.
  • Host: the server’s DNS name or public IP, for example mydb.abc123.us-east-1.rds.amazonaws.com.
  • Port: filled with 3306; change it if your server listens elsewhere.
  • Database: the database the session opens. You can still browse every other database the user can see.
  • User: fresco_reader.
  • Password: the password from Step 1. It is stored encrypted and never shown again.
  • SSL mode: see the table below. Keep required or stronger.
  • CA certificate (PEM): shown only for verify_ca and verify_identity. Paste your CA (for RDS, the AWS RDS CA bundle); leave it empty to use the system trust store.
  • Connect through an SSH tunnel (bastion): Cloud only. Fill SSH host, SSH port (default 22), SSH user and SSH private key (OpenSSH or PEM) (Ed25519, or RSA of 3072 bits or more), plus Key passphrase (if any). The first test shows the bastion’s host key: compare it with the fingerprint from the bastion’s administrator, click Trust this key, then test again.

Click Test connection, then Save.

SSL modes

Section titled “SSL modes”
Mode What it does
preferred Tries SSL; if the server has no SSL, connects without encryption.
required (default) Always SSL. CA and host name are not checked.
verify_ca Always SSL. Checks the certificate chain, not the host name.
verify_identity Always SSL. Checks the chain and the host name. Most secure.

The CA certificate (PEM) field appears for verify_ca and verify_identity. Without TLS, Fresco BI refuses to send the password with clear-text or public-key exchanges, so MySQL 8 accounts using caching_sha2_password may fail under preferred on a server without SSL.

Troubleshooting

Section titled “Troubleshooting”
  • The server rejected the user name or password. Check the password, and that the user’s host part matches the address Fresco BI connects from (MySQL refuses a host it does not allow with the same error).
  • This MySQL account needs an SSL connection to send its password. Pick SSL mode required or stronger. Enable SSL on the server and choose required, verify_ca or verify_identity.
  • The server refused the connection on this port: nothing listens there or a firewall rejects it. Check the port and that MySQL listens on a public interface (bind-address).
  • The server did not answer in time. Usually a firewall that drops packets, or a wrong host or port. Allow Fresco BI’s outbound IP addresses (the setup guide beside the data source form lists them) in the security group or firewall.
  • The host is in a blocked range (private, loopback or metadata). A database inside a private network needs an On-premises connection through a Gateway. Use a public host name, an SSH tunnel, or On-premises (via Gateway).
  • The server does not support SSL but the chosen mode requires encryption. Enable SSL on the server or pick a mode that does not require it. Turn on SSL in MySQL (recommended) rather than lowering the mode.
  • The server certificate is not signed by a trusted CA. Paste the right CA into the CA certificate field. Paste the CA that signed the server certificate (or the server’s self-signed certificate).
  • The server certificate was not issued for the host name entered. Use the name in the certificate or a mode that checks the CA only. Enter the host exactly as in the certificate, or use verify_ca.
  • The database user cannot read this object. Run the GRANT SELECT, SHOW VIEW from Step 1 for that database.

© 2026 Fresco BI. All rights reserved.