Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40940

MaxScale Loads Incomplete User Metadata Resulting in Authentication Failures and Backend Auth Errors

    XMLWordPrintable

Details

    • Not for Release Notes
    • Hide
      Environment
      SIT2
      MariaDB Enterprise 11.8.6
      MaxScale 25.10.2
      Show
      Environment SIT2 MariaDB Enterprise 11.8.6 MaxScale 25.10.2

    Description

      During Kea DHCP startup troubleshooting, authentication failures were observed through MaxScale despite valid database users and successful direct MariaDB authentication.
      Investigation identified discrepancies between user metadata visible in mysql.global_priv and the user information being loaded by MaxScale.

      *Observations*
      MariaDB contained expected users:

      SELECT COUNT FROM mysql.global_priv;

      Result:

      15 users

      However:

      SELECT COUNT FROM mysql.user;

      Result:

      1

      And:

      SELECT User,Host FROM mysql.user;

      Result:

      1 | 1

      MaxScale logs reported:

      Read 1 user@host entries from 'mariadb-0'

      Authentication failures were observed:

      Authentication failed for user 'kea'

      A newly created test user also failed through MaxScale despite successful direct database authentication.
      Additional Findings
      MaxScale backend servers entered:

      Auth Error

      state:

      mariadb-0 : Auth Error

      mariadb-1 : Auth Error

      mariadb-2 : Auth Error

      resulting in:

      Could not find valid server for target type TARGET_ALL

      and application failures:

      MySQLdb.OperationalError: (2013, 'Lost connection to MySQL server during query')

      Troubleshooting Performed
      Reviewed MariaDB and MaxScale logs.
      Corrected grants for:
      maxscale-server
      maxscale-sync
      maxscale-monitor
      Recreated mariadb.sys.
      Investigated mysql.user inconsistencies.
      Validated MaxScale configuration and user synchronization behavior.
      Worked with MariaDB Support.
      Impact
      Kea DHCP startup failure.
      Application database connectivity failure.
      MaxScale unable to properly authenticate users.
      SIT2 testing blocked.
      Expected Result
      MaxScale should load all database users and successfully authenticate valid accounts.
      Actual Result
      MaxScale loads incomplete user information and backend servers enter Auth Error state, causing authentication and connectivity failures.
      Requested Investigation
      Validate why MaxScale only loads a subset of available users.
      Investigate synchronization between mysql.global_priv and mysql.user.
      Validate whether the issue is related to system schema corruption, MaxScale metadata loading, or restore activity.
      Provide root cause and permanent fix.
      These two defects clearly separate:
      Restore-induced mariadb.sys / database corruption issue
      MaxScale user sync/authentication issue
      which will make tracking and RCA much easier.

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              debashisapatra Debashisa Patra
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.