Issues with Azure Postgres Flexible server connect with Azure AD service principal

[vivekyad4v]

Teleport version - 16.4.3
psql - 16.0

Followed this doc - https://goteleport.com/docs/enroll-resources/database-access/enroll-azure-databases/azure-postgres-mysql/

Logs on kube agent DB service (kube-agent helm chart)-

2024-10-24T06:32:27Z DEBU [DB:SERVIC] Accepted connection. addr:10.151.0.222:36232 db/server.go:979
2024-10-24T06:32:27Z DEBU [DB:SERVIC] Client identity authorized. identity:{vivek [admin] [] [usage:db] [vivek teleport azureuser teleport-db-user -teleport-internal-join] [] [*] 2024-10-24 18:32:27 +0000 UTC foo.bar map[] { } foo.bar Database(Service=foo.bar-3b1d297a-c2d7-4313-ba35-3141ab8d5891, Protocol=postgres, Username=teleport, Database=postgres, Roles=[]) [*] [teleport teleport-db-user vivek] 0001-01-01 00:00:00 +0000 UTC 10.151.0.222 [] [] [] [] false false 0 [] none { } } db/server.go:1186
2024-10-24T06:32:27Z DEBU [DB:SERVIC] Will connect to database. db:foo.bar uri:foo.bar:5432 db/server.go:1199
2024-10-24T06:32:27Z DEBU [DB:SERVIC] Created session context. session:db[foo.bar-3b1d297a-c2d7-4313-ba35-3141ab8d5891] identity[vivek] dbUser[teleport] dbName[postgres] autoCreate[DB_USER_MODE_KEEP] dbRoles[] db/server.go:1219
2024-10-24T06:32:27Z DEBU [DB:SERVIC] Creating session tracker. session:a34fa435-66d3-47ce-9cbb-240ec686642c db/server.go:1273
2024-10-24T06:32:27Z DEBU [DB:SERVIC] Received startup message. id:a34fa435-66d3-47ce-9cbb-240ec686642c db:foo.bar-3b1d297a-c2d7-4313-ba35-3141ab8d5891 message:&{196608 map[application_name:psql client_encoding:UTF8 database:postgres user:teleport]} postgres/engine.go:204

Client side error -

tsh db connect foo-bar-3b1d297a-c2d7-4313-ba35-3141ab8d5891 --db-user=teleport --db-name=postgres        
psql: error: connection to server at "localhost" (::1), port 57676 failed: Connection refused
	Is the server running on that host and accepting TCP/IP connections?
connection to server at "localhost" (127.0.0.1), port 57676 failed: please use your Teleport username ("vivek") to connect instead of "teleport"
ERROR: exit status 2

Error, If i try with my teleport user -

tsh db connect foo-bar-3b1d297a-c2d7-4313-ba35-3141ab8d5891 --db-user=vivek --db-name=postgres         1 err  12:06:47 
psql: error: connection to server at "localhost" (::1), port 50442 failed: Connection refused
	Is the server running on that host and accepting TCP/IP connections?
connection to server at "localhost" (127.0.0.1), port 50442 failed: your Teleport role requires automatic database user provisioning but this database doesn't support it, contact your Teleport administrator
ERROR: exit status 2

DB discovery etc working fine, issue is only while connecting from the user.

[stevenGravy]

Hi, as it state this is trying to do automatic provisioning which is not support for the Azure postgres yet. Please check if you put create_db_user_mode: keep in the user role. This would need to be turned off for these dbs.

[vivekyad4v]

Yes, i had kept it to "true" unknowingly, might have copied whole snippet. Removing it worked for me.