[
https://issues.apache.org/jira/browse/RANGER-5736?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18104752#comment-18104752
]
Ramachandran Krishnan commented on RANGER-5736:
-----------------------------------------------
Committed to Ranger master branch .Commit
detail:https://github.com/apache/ranger/commit/06c44cbeb99509f1e70fc2776b2b0abb251a9520
> Ranger Admin setup fails on MariaDB with MySQL error 1133 during
> dba_script.py grant to host-specific user
> ----------------------------------------------------------------------------------------------------------
>
> Key: RANGER-5736
> URL: https://issues.apache.org/jira/browse/RANGER-5736
> Project: Ranger
> Issue Type: Bug
> Components: Ranger
> Affects Versions: 3.0.0
> Reporter: Ramachandran Krishnan
> Assignee: Ramachandran Krishnan
> Priority: Major
> Time Spent: 20m
> Remaining Estimate: 0h
>
> h2. Summary
> Ranger Admin database setup fails on MariaDB (used by the Docker MYSQL
> flavor) when {{dba_script.py}} grants privileges to the admin user for the
> application DB host (e.g. {{'rangeradmin'@'ranger-db'}}). MySQL returns error
> 1133: *Can't find any matching row in the user table*.
> Oracle MySQL and other Ranger-supported DB flavors (PostgreSQL, Oracle, SQL
> Server) are not affected.
> h2. Environment
> * DB flavor: {{DB_FLAVOR=MYSQL}} (Docker uses MariaDB, e.g.
> {{mariadb:10.7.3}})
> * Script: {{security-admin/scripts/dba_script.py}}
> * Typical host: {{db_host=ranger-db}} (from
> {{ranger-admin-install-mysql.properties}})
> h2. Steps to Reproduce
> # Start Ranger Docker stack with MYSQL/MariaDB and fresh DB volume
> # Run Ranger Admin install / {{dba_script.py -q}} with standard mysql install
> properties
> # Observe failure during grant step:
> {code}
> GRANT ALL ON ranger.* TO 'rangeradmin'@'ranger-db' WITH GRANT OPTION
> → Error 1133: Can't find any matching row in the user table
> {code}
> h2. Root Cause
> In {{MysqlConf.grant_xa_db_user()}}, grants are applied in order {{@'%'}} →
> {{@'localhost'}} → {{@db_host}}, with {{FLUSH PRIVILEGES}} after each grant.
> On MariaDB (tested on 10.7.3 and 10.11), after wildcard/localhost grants and
> flush, the grant to the host-specific account ({{@'ranger-db'}}) fails with
> error 1133 even when the user row exists (from {{init_mysql.sql}} or prior
> CREATE USER in the same run).
> Note: Ranger Docker "MYSQL" flavor runs MariaDB
> ({{Dockerfile.ranger-mysql}}), not Oracle MySQL Server. Oracle MySQL 8.x does
> not reproduce this failure with the original grant sequence.
> h2. Proposed Fix
> Update {{MysqlConf}} in {{dba_script.py}} only (Postgres/Oracle/MSSQL/SQLA
> unchanged):
> # Detect MariaDB via {{SELECT VERSION()}} (output contains {{mariadb}})
> # *MariaDB only:*
> #* Grant {{@db_host}} before {{@'%'}} / {{@'localhost'}}
> #* Run {{FLUSH PRIVILEGES}} once at the end (not after each grant)
> #* On grant failure, drop/recreate user for that host and retry once
> # *Non-MariaDB MySQL (Oracle MySQL):* keep original grant order and
> flush-after-each-grant behavior
> No change to {{init_mysql.sql}} required.
> h2. Testing
> Verified {{dba_script.py -q}} against:
> || Flavor || Server || Result ||
> | MYSQL (MariaDB path) | MariaDB 10.7.3 | PASS |
> | MYSQL (non-MariaDB) | Oracle MySQL 8.0.36 | PASS (original behavior
> preserved) |
> | POSTGRES | PostgreSQL 13.16 | PASS |
> | MSSQL | SQL Server 2022 | PASS |
> | ORACLE | Oracle Free 23 | PASS |
> | SQLA | — | Not tested (no Docker image in ranger-docker) |
> h2. Impact
> * Fixes Ranger Admin setup failure in Docker and other MariaDB deployments
> * No behavior change for Oracle MySQL or non-MySQL DB flavors
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
