Connecting a MySQL / MariaDB warehouse

This guide walks you through connecting a MySQL or MariaDB database to Saiku Cloud, end to end. Five minutes if your warehouse is already public; ten if you need to set up a read-only user.

Tier impact: every Saiku Cloud tier (Starter, Team, Business) supports MySQL BYOC.

Driver: Saiku Cloud ships MariaDB Connector/J, which speaks both MySQL and MariaDB wire protocols. You can paste either jdbc:mysql://... or jdbc:mariadb://... and we’ll handle the rest.

What you’ll need

• A MySQL 5.7+ or MariaDB 10.3+ instance reachable from a public IPv4 address. Cloud-hosted Saiku Cloud customers on Starter/Team/Business need this — Enterprise customers running on a private VPC peering setup get private-network reachability instead.
• Admin access to your warehouse so you can create a read-only user (or an existing read-only user’s credentials).
• Five minutes.

Step 1 — Allowlist our egress IP

Saiku Cloud’s queries to your warehouse all originate from a single static IP:

87.99.153.244

Add this to your warehouse’s firewall / security group / network allowlist before testing the connection. Common allowlist places:

• AWS RDS / Aurora MySQL: VPC security group inbound rule → port 3306 → source 87.99.153.244/32.
• Google Cloud SQL: Connectivity → Authorized networks → add 87.99.153.244/32.
• Azure Database for MySQL: Networking → Firewall rules → add a rule allowing 87.99.153.244 to 87.99.153.244.
• PlanetScale: Allowed IPs in the database settings → add 87.99.153.244. PlanetScale also requires ?sslMode=VERIFY_IDENTITY on the JDBC URL — see Step 3.
• Self-hosted: bind-address = 0.0.0.0 (or your public NIC) in my.cnf, the public-firewall rule in front, and a host-level grant pattern that allows the role from 87.99.153.244.

The IP is stable — it survives reboots and image rebuilds. We commit to at least 30 days notice before any rotation. Full policy: our egress-IP stability commitment.

Step 2 — Create a read-only user in MySQL

Saiku Cloud only ever reads from your warehouse — never writes, never alters schemas, never creates objects. The least-privilege shape is a dedicated read-only user:

-- As a MySQL user with the GRANT OPTION privilege:
CREATE USER 'saiku_read'@'%' IDENTIFIED BY 'pick-something-strong-here';

-- Grant SELECT on the database(s) you want Saiku to see. Adjust
-- 'analytics' to the database name in your JDBC URL.
GRANT SELECT ON analytics.* TO 'saiku_read'@'%';

-- Reload the privilege tables.
FLUSH PRIVILEGES;

A few notes:

• The '%' host wildcard lets the user connect from any IP. If your MySQL is locked down to specific source IPs at the user level (in addition to the firewall), use 'saiku_read'@'87.99.153.244' instead.
• If your data is spread across multiple databases, repeat the GRANT SELECT block for each one.
• Aurora MySQL treats grants slightly differently — see the Aurora docs for the equivalent recipe.
• PlanetScale uses its own role system — create a “read-only” role in the PlanetScale console and capture the generated username + password instead of running CREATE USER.

Step 3 — Build the JDBC URL

The shape:

jdbc:mysql://<host>:<port>/<database>?sslMode=REQUIRED&serverTimezone=UTC

Two parameters worth understanding (the wizard’s placeholder includes both):

serverTimezone=UTC

Caution

Always set this, even if your server is configured for UTC already. Without it, MariaDB Connector/J reads the JVM’s default timezone — which in production happens to be UTC, but in some weird corners of the world (Heroku, some Azure regions) it isn’t. Mismatched timezones cause TIMESTAMP values to silently shift by your server’s offset, which is one of the most painful debugging experiences in BI.

sslMode=REQUIRED

Forces TLS for the JDBC connection. Most managed MySQL services enforce TLS server-side anyway; REQUIRED makes the client reject plaintext fallback.

Variants:

• sslMode=REQUIRED — server cert is trusted but not verified for hostname. Good default.
• sslMode=VERIFY_CA — verifies the server cert chains to a CA we trust. Works for managed services using public CAs.
• sslMode=VERIFY_IDENTITY — also verifies the server cert’s hostname matches the JDBC URL’s host. Required for PlanetScale.
• sslMode=DISABLED — plaintext. Don’t.

Concrete examples

• AWS RDS MySQL: jdbc:mysql://mydb.abc123.us-east-1.rds.amazonaws.com:3306/sales?sslMode=REQUIRED&serverTimezone=UTC
• Aurora MySQL: Same shape; use the cluster writer endpoint.
• Google Cloud SQL: jdbc:mysql://1.2.3.4:3306/sales?sslMode=REQUIRED&serverTimezone=UTC (use the Public IP from the Cloud SQL console)
• Azure Database for MySQL: jdbc:mysql://mydb.mysql.database.azure.com:3306/sales?sslMode=REQUIRED&serverTimezone=UTC
• PlanetScale: jdbc:mysql://aws.connect.psdb.cloud:3306/analytics?sslMode=VERIFY_IDENTITY&serverTimezone=UTC
• MariaDB: Use jdbc:mariadb://... if your service uses MariaDB-specific URL parameters; otherwise jdbc:mysql:// works against MariaDB too.
• Self-hosted MySQL/MariaDB: jdbc:mysql://db.yourcompany.com:3306/sales?sslMode=REQUIRED&serverTimezone=UTC

Step 4 — Connect via the Saiku Cloud wizard

1. Sign in at https://cloud.saiku.bi/.

2. Navigate to Connections in the left sidebar.

3. Under 1. Pick warehouse type, click the MySQL / MariaDB tile.

4. Fill in:

   • JDBC URL — the URL from Step 3.
   • Username — saiku_read (or whatever you named the user in Step 2).
   • Password — the password from Step 2.

5. Click Test connection.

If everything’s wired correctly, you’ll see a green outcome banner: ✓ Connection successful plus the detected MySQL/MariaDB version. Proceed to Step 5.

If you see a red outcome banner, see Troubleshooting below.

Step 5 — Save the connection

After a successful test, the wizard renders a 3. Save connection section. Fill in:

• Password (re-enter for save) — the same password you tested with. We don’t store the test-form password to avoid round-tripping a credential through page state.
• Label — a human-readable name like Production warehouse or Marketing analytics. Shown in the connections list + cube designer.

Click Save connection. We’ll redirect you to the schema designer.

Troubleshooting

✗ Connection failed (HOST_UNREACHABLE) or (TIMEOUT)

We couldn’t reach the host on the port you specified. Most common causes:

1. Firewall / allowlist — Step 1 wasn’t done or wasn’t done for the right IP. Confirm 87.99.153.244/32 is in your warehouse’s allowlist + applied.
2. DNS — the hostname in the JDBC URL doesn’t resolve, or resolves to a private IP. Verify from your laptop: nslookup <host>. We refuse to connect to RFC1918 / loopback / link-local addresses for SSRF-protection reasons — HOST_DENIED (not HOST_UNREACHABLE) is the surface in that case.
3. Wrong port — MySQL defaults to 3306. Some managed services use a custom port (PlanetScale’s primary endpoint is 3306, but some regions front a load-balancer on 443 — check the connection-strings page in their console).

✗ Connection failed (AUTH_FAILED)

MySQL error 1045 — username or password is wrong. The wizard intentionally doesn’t distinguish “wrong user” from “wrong password” — that’s defence against credential-stuffing attacks.

• Double-check the username. MySQL user names ARE case-sensitive in standard configurations.
• Confirm the user is allowed from '%' or specifically from '87.99.153.244'. The most common shape of this failure: CREATE USER 'saiku_read'@'localhost' only allows local connections; Saiku Cloud connects from 87.99.153.244, which doesn’t match localhost.
• Try connecting from your laptop with mysql -h <host> -u saiku_read -p <database> to confirm the credentials work outside Saiku.

✗ Connection failed (DATABASE_NOT_FOUND)

MySQL error 1049 — the host accepts your credentials but the database name in the JDBC URL doesn’t exist. Verify it:

-- From mysql CLI, as any user with login:
SHOW DATABASES;

Timestamps shift by some weird number of hours after import

You forgot serverTimezone=UTC. Add it to the JDBC URL (Step 3), test, save. Existing cubes built against the old (wrong) timezone will need a re-render.

Cube renders but with 'NULL' (string literal) instead of actual NULLs

Your MySQL is in ANSI SQL mode + the schema XML has nullValue="" configured. Either:

• Switch the server to TRADITIONAL mode (SET GLOBAL sql_mode = 'TRADITIONAL';), OR
• Edit the schema XML to use nullValue="\\N" per Mondrian’s MySQL-specific guidance.

Anything else

Take a screenshot of the wizard with the red outcome banner visible (Kind: ... line in particular) and send it to support@saiku.bi.

Enterprise: private network

For Enterprise customers running a private network setup, the egress IP rule is replaced by VPC peering or PrivateLink to your MySQL instance. The connection wizard’s flow is otherwise identical. Contact your account team to provision the peering.

Try with FoodMart

Want to test Saiku Cloud with this dialect before connecting your own data? Download the FoodMart sample dataset packaged for MySQL:

FoodMart sample dataset for MySQL