[MXS-287] Access databases from command line failed when grants set with wildcarded hosts Created: 2015-07-27  Updated: 2017-12-01  Resolved: 2017-01-16

Status: Closed
Project: MariaDB MaxScale
Component/s: mariadbclient
Affects Version/s: 1.2.0, 1.4.1
Fix Version/s: 2.1.0

Type: New Feature Priority: Major
Reporter: Simon Hanmer Assignee: Esa Korhonen
Resolution: Fixed Votes: 0
Labels: None
Environment:

Centos 7.1


Issue Links:
Relates
relates to MXS-391 Add support for wildcards in hostnames Closed
relates to MXS-510 Wildcards in host names are not suppo... Closed
Sprint: 2017-25

 Description   

We have used the wildcard capability with grants in our current MySQL setup, using grants such as

grant all on `%user%`.* to 'user'@'%' identified by 'somepassword';

If we try this with the command line client pointed at a maxscale host, specifying a database gives us an 'access denied' failure.

mysql -h maxscale_host -u user -p user_db

whereas connecting to one of the Galera nodes directly works

mysql -h galera_host -u user -p user_db

If we explicitly set the grant for a specific database, then the client works

grant all on `user_db`.* to 'user'@'%' identified by 'somepassword';

In all cases, connecting without specifying the database and then choosing the database with a use statement works.



 Comments   
Comment by markus makela [ 2015-08-06 ]

The MySQL command line escapes all underscore characters because if not escaped, they are interpreted as a single character wildcard. MaxScale version 1.2 does not support single character wildcards so if the database name contains an underscore character, the service in question requires the 'strip_db_esc=true' parameter.

Comment by markus makela [ 2015-08-27 ]

simon.hanmer One thing that should be noted when giving grants is that both the host where the client is connecting and MaxScale's host need the grants.

Could confirm that both hosts have grants for them?

Comment by markus makela [ 2015-09-07 ]

Without further information about user grants this bug cannot be resolved. More information is needed to verify that this is a bug with MaxScale and not a configuration error.

Comment by Simon Hanmer [ 2015-09-09 ]

@markus makela - it's going to be a few weeks until I can look at this. Not sure if you want to close this and I'll reopen once I can get more information?

Comment by markus makela [ 2015-09-09 ]

Sure, you can reopen this once you get more information. We'll close this for now.

Comment by Simon Hanmer [ 2015-09-30 ]

@markus makela , I've add time for further investigation - I'll try and list the info below, but please let me know if you need anything more.

We've create a user called hydra on the databases with the following statement:

grant all on `_hydra_%`.* to hydra@'%' identified by 'somepassword';

I can see this message in the error1.log file:

2015-09-30 12:13:25 Warning: Failed to add user hydra@% for service [Splitter Service]. This user will be unavailable via MaxScale.

and in the trace log, I can see:

2015-09-30 12:13:25 Splitter Service: Converted '_hydra_%' to 0 individual database grants.
2015-09-30 12:13:25 Warning: Failed to add user hydra@% for service [Splitter Service]. This user will be unavailable via MaxScale.

My maxscale.cnf has the following section:

[Splitter Service]
type=service
router=readwritesplit
servers=host1,host2,host3
user=****
passwd=****
max_slave_connections=100%
router_options=slave_selection_criteria=LEAST_CURRENT_OPERATIONS
strip_db_esc=true
optimize_wildcard=true

Comment by markus makela [ 2016-01-11 ]

Can you test with the 1.3.0 release of MaxScale if the database wildcard grants work? You can find the binaries here: http://maxscale-jenkins.mariadb.com/ci-repository/1.3.0-beta-release/mariadb-maxscale/

Comment by Simon Hanmer [ 2016-01-12 ]

@markus makela - it'll probably be the week of the 25th before I can test this, but I'll get you an update as soon as I can.

Comment by Simon Hanmer [ 2016-02-16 ]

@markus makela, just tested with the 1.3.0 rpm and the following user setup (the user is the maxscale admin user):

 create user 'maxscale_dba'@`cisvirmdb-max0%.int.dur.ac.uk` identified by '5e&zf^4wlooigGrYQN%#';

and I get the following message in the maxscale.log file:

2016-02-16 10:42:05   error  : Failed to obtain address for host cisvirmdb-max0%.int.dur.ac.uk, Name or service not known
2016-02-16 10:42:05   warning: Failed to add user maxscale_dba@cisvirmdb-max0%.int.dur.ac.uk for service [Splitter Service]. This user will be unavailable via MaxScale.

Comment by markus makela [ 2016-02-16 ]

The current version of MaxScale does not yet support wildcards in hostnames: https://github.com/mariadb-corporation/MaxScale/blob/master/Documentation/Getting-Started/Configuration-Guide.md#limitations-1

Note that currently wildcards are only supported in conjunction with IP-addresses, not with domain names.

If possible, please try to convert the hostname to an IP address and see if that fixes the problem.

Comment by Johan Wikman [ 2016-03-03 ]

Removed fix version as this was not fixed for 1.3.

Comment by markus makela [ 2016-04-05 ]

simon.hanmer Have you had a chance to test if IP addresses work properly?

I'll change this task to an improvement because based on the information currently available, this seems to be caused by wildcards in hostnames.

Generated at Thu Feb 08 03:58:10 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.