Ramachandran Krishnan created RANGER-5736:
---------------------------------------------
Summary: Ranger Admin setup fails on MariaDB with MySQL error 1133
during dba_script.py grant to host-specific user
Key: RANGER-5736
URL: https://issues.apache.org/jira/browse/RANGER-5736
Project: Ranger
Issue Type: Bug
Components: Ranger
Affects Versions: 3.0.0
Reporter: Ramachandran Krishnan
Assignee: Ramachandran Krishnan
h2. Summary
Ranger Admin database setup fails on MariaDB (used by the Docker MYSQL flavor)
when {{dba_script.py}} grants privileges to the admin user for the application
DB host (e.g. {{'rangeradmin'@'ranger-db'}}). MySQL returns error 1133: *Can't
find any matching row in the user table*.
Oracle MySQL and other Ranger-supported DB flavors (PostgreSQL, Oracle, SQL
Server) are not affected.
h2. Environment
* DB flavor: {{DB_FLAVOR=MYSQL}} (Docker uses MariaDB, e.g. {{mariadb:10.7.3}})
* Script: {{security-admin/scripts/dba_script.py}}
* Typical host: {{db_host=ranger-db}} (from
{{ranger-admin-install-mysql.properties}})
h2. Steps to Reproduce
# Start Ranger Docker stack with MYSQL/MariaDB and fresh DB volume
# Run Ranger Admin install / {{dba_script.py -q}} with standard mysql install
properties
# Observe failure during grant step:
{code}
GRANT ALL ON ranger.* TO 'rangeradmin'@'ranger-db' WITH GRANT OPTION
→ Error 1133: Can't find any matching row in the user table
{code}
h2. Root Cause
In {{MysqlConf.grant_xa_db_user()}}, grants are applied in order {{@'%'}} →
{{@'localhost'}} → {{@db_host}}, with {{FLUSH PRIVILEGES}} after each grant.
On MariaDB (tested on 10.7.3 and 10.11), after wildcard/localhost grants and
flush, the grant to the host-specific account ({{@'ranger-db'}}) fails with
error 1133 even when the user row exists (from {{init_mysql.sql}} or prior
CREATE USER in the same run).
Note: Ranger Docker "MYSQL" flavor runs MariaDB ({{Dockerfile.ranger-mysql}}),
not Oracle MySQL Server. Oracle MySQL 8.x does not reproduce this failure with
the original grant sequence.
h2. Proposed Fix
Update {{MysqlConf}} in {{dba_script.py}} only (Postgres/Oracle/MSSQL/SQLA
unchanged):
# Detect MariaDB via {{SELECT VERSION()}} (output contains {{mariadb}})
# *MariaDB only:*
#* Grant {{@db_host}} before {{@'%'}} / {{@'localhost'}}
#* Run {{FLUSH PRIVILEGES}} once at the end (not after each grant)
#* On grant failure, drop/recreate user for that host and retry once
# *Non-MariaDB MySQL (Oracle MySQL):* keep original grant order and
flush-after-each-grant behavior
No change to {{init_mysql.sql}} required.
h2. Testing
Verified {{dba_script.py -q}} against:
|| Flavor || Server || Result ||
| MYSQL (MariaDB path) | MariaDB 10.7.3 | PASS |
| MYSQL (non-MariaDB) | Oracle MySQL 8.0.36 | PASS (original behavior
preserved) |
| POSTGRES | PostgreSQL 13.16 | PASS |
| MSSQL | SQL Server 2022 | PASS |
| ORACLE | Oracle Free 23 | PASS |
| SQLA | — | Not tested (no Docker image in ranger-docker) |
h2. Impact
* Fixes Ranger Admin setup failure in Docker and other MariaDB deployments
* No behavior change for Oracle MySQL or non-MySQL DB flavors
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
