[MXS-3072] Failed to query server 'server1' for user account info. Wrong number of resultsets to multiquery Created: 2020-07-15  Updated: 2020-07-24  Resolved: 2020-07-15

Status: Closed
Project: MariaDB MaxScale
Component/s: Authenticator
Affects Version/s: 2.5.0
Fix Version/s: 2.5.1

Type: Bug Priority: Major
Reporter: Geoff Montee (Inactive) Assignee: Esa Korhonen
Resolution: Fixed Votes: 0
Labels: None


 Description   

With MaxScale 2.5.0, I am seeing errors like this:

2020-07-15 01:15:39   error  : Failed to query server 'server1' for user account info. Wrong number of resultsets to multiquery 'SELECT * FROM mysql.user; SELECT DISTINCT * FROM ((SELECT a.user, a.host, a.db FROM mysql.db AS a) UNION (SELECT a.user, a.host, a.db FROM mysql.tables_priv AS a) UNION (SELECT a.user, a.host, a.db FROM mysql.columns_priv AS a) ) AS c; SELECT DISTINCT a.user, a.host FROM mysql.proxies_priv AS a WHERE a.proxied_host <> '' AND a.proxied_user <> ''; SHOW DATABASES; SELECT a.user, a.host, a.role FROM mysql.roles_mapping AS a;'. Got 1, expected 5.
2020-07-15 01:15:39   warning: (4) [mariadbclient] Authentication failed for user 'repl'@[::ffff:127.0.0.1] to service 'repl-router'. Originating listener: 'repl-router-listener'. MariaDB error: 'Access denied for user 'repl'@'::ffff:127.0.0.1' (using password: YES)'.

It is unclear why this is happening. If I execute these statements manually with the normal client, then I do see 5 result-sets. However, two of the result-sets are empty.

See here:

MariaDB [(none)]> SELECT * FROM mysql.user; SELECT DISTINCT * FROM ((SELECT a.user, a.host, a.db FROM mysql.db AS a) UNION (SELECT a.user, a.host, a.db FROM mysql.tables_priv AS a) UNION (SELECT a.user, a.host, a.db FROM mysql.columns_priv AS a) ) AS c; SELECT DISTINCT a.user, a.host FROM mysql.proxies_priv AS a WHERE a.proxied_host <> '' AND a.proxied_user <> ''; SHOW DATABASES; SELECT a.user, a.host, a.role FROM mysql.roles_mapping AS a;
+-----------+--------------+-------------------------------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+---------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+----------------------+-----------------------+-------------------------------------------+------------------+---------+--------------+--------------------+
| Host      | User         | Password                                  | Select_priv | Insert_priv | Update_priv | Delete_priv | Create_priv | Drop_priv | Reload_priv | Shutdown_priv | Process_priv | File_priv | Grant_priv | References_priv | Index_priv | Alter_priv | Show_db_priv | Super_priv | Create_tmp_table_priv | Lock_tables_priv | Execute_priv | Repl_slave_priv | Repl_client_priv | Create_view_priv | Show_view_priv | Create_routine_priv | Alter_routine_priv | Create_user_priv | Event_priv | Trigger_priv | Create_tablespace_priv | Delete_history_priv | ssl_type | ssl_cipher | x509_issuer | x509_subject | max_questions | max_updates | max_connections | max_user_connections | plugin                | authentication_string                     | password_expired | is_role | default_role | max_statement_time |
+-----------+--------------+-------------------------------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+---------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+----------------------+-----------------------+-------------------------------------------+------------------+---------+--------------+--------------------+
| localhost | mariadb.sys  |                                           | N           | N           | N           | N           | N           | N         | N           | N             | N            | N         | N          | N               | N          | N          | N            | N          | N                     | N                | N            | N               | N                | N                | N              | N                   | N                  | N                | N          | N            | N                      | N                   |          |            |             |              |             0 |           0 |               0 |                    0 | mysql_native_password |                                           | N                | N       |              |           0.000000 |
| localhost | root         | invalid                                   | Y           | Y           | Y           | Y           | Y           | Y         | Y           | Y             | Y            | Y         | Y          | Y               | Y          | Y          | Y            | Y          | Y                     | Y                | Y            | Y               | Y                | Y                | Y              | Y                   | Y                  | Y                | Y          | Y            | Y                      | Y                   |          |            |             |              |             0 |           0 |               0 |                    0 | mysql_native_password | invalid                                   | N                | N       |              |           0.000000 |
| localhost | mysql        | invalid                                   | Y           | Y           | Y           | Y           | Y           | Y         | Y           | Y             | Y            | Y         | Y          | Y               | Y          | Y          | Y            | Y          | Y                     | Y                | Y            | Y               | Y                | Y                | Y              | Y                   | Y                  | Y                | Y          | Y            | Y                      | Y                   |          |            |             |              |             0 |           0 |               0 |                    0 | mysql_native_password | invalid                                   | N                | N       |              |           0.000000 |
| 127.0.0.1 | cross_engine | *1716578ABE5ABBA5E020CE2EA9C8FDCE11DE7BE3 | Y           | N           | N           | N           | N           | N         | N           | N             | N            | N         | N          | N               | N          | N          | N            | N          | N                     | N                | N            | N               | N                | N                | N              | N                   | N                  | N                | N          | N            | N                      | N                   |          |            |             |              |             0 |           0 |               0 |                    0 | mysql_native_password | *1716578ABE5ABBA5E020CE2EA9C8FDCE11DE7BE3 | N                | N       |              |           0.000000 |
| %         | maxscale     | *79056EDB66388CF5756F81D804E4BF271AACDB9D | N           | N           | N           | N           | N           | N         | Y           | N             | Y            | N         | N          | N               | N          | N          | Y            | Y          | N                     | N                | N            | N               | Y                | N                | N              | N                   | N                  | N                | Y          | N            | N                      | N                   |          |            |             |              |             0 |           0 |               0 |                    0 | mysql_native_password | *79056EDB66388CF5756F81D804E4BF271AACDB9D | N                | N       |              |           0.000000 |
| %         | repl         | *50C610800D1B52DF4C81430612A0A4DF1B5487DE | N           | N           | N           | N           | N           | N         | N           | N             | N            | N         | N          | N               | N          | N          | Y            | N          | N                     | N                | N            | Y               | Y                | N                | N              | N                   | N                  | N                | N          | N            | N                      | N                   |          |            |             |              |             0 |           0 |               0 |                    0 | mysql_native_password | *50C610800D1B52DF4C81430612A0A4DF1B5487DE | N                | N       |              |           0.000000 |
+-----------+--------------+-------------------------------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+---------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+----------------------+-----------------------+-------------------------------------------+------------------+---------+--------------+--------------------+
6 rows in set (0.001 sec)
 
+-------------+-----------+-------+
| user        | host      | db    |
+-------------+-----------+-------+
| maxscale    | %         | mysql |
| repl        | %         | mysql |
| mariadb.sys | localhost | mysql |
+-------------+-----------+-------+
3 rows in set (0.001 sec)
 
Empty set (0.000 sec)
 
+---------------------+
| Database            |
+---------------------+
| calpontsys          |
| columnstore_info    |
| infinidb_querystats |
| information_schema  |
| mysql               |
| performance_schema  |
+---------------------+
6 rows in set (0.000 sec)
 
Empty set (0.000 sec)

This is happening with the following MaxScale configuration:

[server1]
type=server
address=127.0.0.1
port=3306
protocol=MariaDBBackend
 
[repl-monitor]
type             = monitor
module           = mariadbmon
servers          = server1
monitor_interval = 1000ms
user             = repl
password         = repl_passwd
 
[repl-filter]
type         = filter
module       = binlogfilter
match        = /[.]orders/
rewrite_src  = innodb
rewrite_dest = columnstore
 
[repl-router]
type     = service
router   = readconnroute
servers  = server1
user     = repl
password = repl_passwd
filters  = repl-filter
 
[connection-router]
type     = service
router   = readconnroute
servers  = server1
user     = maxscale
password = max_passwd
 
[repl-router-listener]
type     = listener
service  = repl-router
protocol = MariaDBClient
port     = 3309
 
[connection-router-listener]
type     = listener
service  = connection-router
protocol = MariaDBClient
port     = 3307

The back-end MariaDB Server is MariaDB Enterprise Server 10.5.4-2 with ColumnStore 1.5.3.



 Comments   
Comment by markus makela [ 2020-07-15 ]

What are the grants for repl@%?

Comment by Esa Korhonen [ 2020-07-15 ]

Seems to be a grants issue. Try giving the service-user (repl/maxscale) full read rights to the mysql-database, as well as the SHOW DATABASES-privilege. I'll see if the error message can be improved.

Comment by Geoff Montee (Inactive) [ 2020-07-15 ]

It looks like MariaDBAuth requires extra grants starting in 2.5.

The repl@% user already had these grants, which were supposed to be sufficient for MariaDBAuth in 2.4 and before:

MariaDB [(none)]> SHOW GRANTS FOR 'repl'@'%';
+-------------------------------------------------------------------------------------------------------------------------------------------------+
| Grants for repl@%                                                                                                                               |
+-------------------------------------------------------------------------------------------------------------------------------------------------+
| GRANT SHOW DATABASES, REPLICATION SLAVE, BINLOG MONITOR ON *.* TO `repl`@`%` IDENTIFIED BY PASSWORD '*50C610800D1B52DF4C81430612A0A4DF1B5487DE' |
| GRANT SELECT ON `mysql`.`user` TO `repl`@`%`                                                                                                    |
| GRANT SELECT ON `mysql`.`tables_priv` TO `repl`@`%`                                                                                             |
| GRANT SELECT ON `mysql`.`db` TO `repl`@`%`                                                                                                      |
| GRANT SELECT ON `mysql`.`roles_mapping` TO `repl`@`%`                                                                                           |
+-------------------------------------------------------------------------------------------------------------------------------------------------+
5 rows in set (0.000 sec)

Based on the query in the error message, I added SELECT privileges for the columns_priv and proxies_priv tables:

GRANT SELECT ON `mysql`.`columns_priv` TO `repl`@`%`;
GRANT SELECT ON `mysql`.`proxies_priv` TO `repl`@`%`;

This did seem to work.

It looks like these privileges are new requirements for 2.5. As far as I can tell, this new privilege checking query was added as part of MXS-2717 in this commit: https://github.com/mariadb-corporation/MaxScale/commit/f1c97edb24535e50d1b53d2fa39e64c6fb46d0b8

I'll update the documentation to mention these new require privileges.

Thanks!

Comment by Esa Korhonen [ 2020-07-15 ]

Error message improved.

Generated at Thu Feb 08 04:18:45 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.