[MXS-287] Access databases from command line failed when grants set with wildcarded hosts Created: 2015-07-27 Updated: 2017-12-01 Resolved: 2017-01-16 |
|
| Status: | Closed |
| Project: | MariaDB MaxScale |
| Component/s: | mariadbclient |
| Affects Version/s: | 1.2.0, 1.4.1 |
| Fix Version/s: | 2.1.0 |
| Type: | New Feature | Priority: | Major |
| Reporter: | Simon Hanmer | Assignee: | Esa Korhonen |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Environment: |
Centos 7.1 |
||
| Issue Links: |
|
||||||||||||
| Sprint: | 2017-25 | ||||||||||||
| Description |
|
We have used the wildcard capability with grants in our current MySQL setup, using grants such as
If we try this with the command line client pointed at a maxscale host, specifying a database gives us an 'access denied' failure.
whereas connecting to one of the Galera nodes directly works
If we explicitly set the grant for a specific database, then the client works
In all cases, connecting without specifying the database and then choosing the database with a use statement works. |
| Comments |
| Comment by markus makela [ 2015-08-06 ] | |||
|
The MySQL command line escapes all underscore characters because if not escaped, they are interpreted as a single character wildcard. MaxScale version 1.2 does not support single character wildcards so if the database name contains an underscore character, the service in question requires the 'strip_db_esc=true' parameter. | |||
| Comment by markus makela [ 2015-08-27 ] | |||
|
simon.hanmer One thing that should be noted when giving grants is that both the host where the client is connecting and MaxScale's host need the grants. Could confirm that both hosts have grants for them? | |||
| Comment by markus makela [ 2015-09-07 ] | |||
|
Without further information about user grants this bug cannot be resolved. More information is needed to verify that this is a bug with MaxScale and not a configuration error. | |||
| Comment by Simon Hanmer [ 2015-09-09 ] | |||
|
@markus makela - it's going to be a few weeks until I can look at this. Not sure if you want to close this and I'll reopen once I can get more information? | |||
| Comment by markus makela [ 2015-09-09 ] | |||
|
Sure, you can reopen this once you get more information. We'll close this for now. | |||
| Comment by Simon Hanmer [ 2015-09-30 ] | |||
|
@markus makela , I've add time for further investigation - I'll try and list the info below, but please let me know if you need anything more. We've create a user called hydra on the databases with the following statement:
I can see this message in the error1.log file:
and in the trace log, I can see:
My maxscale.cnf has the following section:
| |||
| Comment by markus makela [ 2016-01-11 ] | |||
|
Can you test with the 1.3.0 release of MaxScale if the database wildcard grants work? You can find the binaries here: http://maxscale-jenkins.mariadb.com/ci-repository/1.3.0-beta-release/mariadb-maxscale/ | |||
| Comment by Simon Hanmer [ 2016-01-12 ] | |||
|
@markus makela - it'll probably be the week of the 25th before I can test this, but I'll get you an update as soon as I can. | |||
| Comment by Simon Hanmer [ 2016-02-16 ] | |||
|
@markus makela, just tested with the 1.3.0 rpm and the following user setup (the user is the maxscale admin user):
and I get the following message in the maxscale.log file:
| |||
| Comment by markus makela [ 2016-02-16 ] | |||
|
The current version of MaxScale does not yet support wildcards in hostnames: https://github.com/mariadb-corporation/MaxScale/blob/master/Documentation/Getting-Started/Configuration-Guide.md#limitations-1
If possible, please try to convert the hostname to an IP address and see if that fixes the problem. | |||
| Comment by Johan Wikman [ 2016-03-03 ] | |||
|
Removed fix version as this was not fixed for 1.3. | |||
| Comment by markus makela [ 2016-04-05 ] | |||
|
simon.hanmer Have you had a chance to test if IP addresses work properly? I'll change this task to an improvement because based on the information currently available, this seems to be caused by wildcards in hostnames. |