Bug #81424 The proxies_priv table is not replicated
Submitted: 14 May 2016 8:42 Modified: 22 Dec 2017 8:40
Reporter: monty solomon Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server: Documentation Severity:S3 (Non-critical)
Version:5.7.12,5.7.15,5.7.17 OS:CentOS
Assigned to: CPU Architecture:Any
Tags: regression

[14 May 2016 8:42] monty solomon
Description:
Proxies added via the GRANT PROXY statement or via INSERT statements to the proxies_priv table are not replicated to the slaves.

How to repeat:
On both the the master and the slave install the auth_socket auth plugin

install plugin auth_socket SONAME 'auth_socket.so';

on the master

CREATE USER 'employee_ext'@'localhost'
  IDENTIFIED WITH auth_socket AS 'my_auth_string';

CREATE USER 'employee'@'localhost'
  IDENTIFIED BY 'employee_pass';

GRANT PROXY
  ON 'employee'@'localhost'
  TO 'employee_ext'@'localhost';

select * from proxies_priv where Proxied_user='employee'\G
*************************** 1. row ***************************
        Host: localhost
        User: employee_ext
Proxied_host: localhost
Proxied_user: employee
  With_grant: 0
     Grantor: root@localhost
   Timestamp: 0000-00-00 00:00:00
1 row in set (0.00 sec)

on the slave

mysql> select * from proxies_priv where Proxied_user='employee'\G
Empty set (0.00 sec)

Suggested fix:
Fix replication for the proxies_priv table.
[16 May 2016 8:40] MySQL Verification Team
Hello Monty,

Thank you for the report.
Observed this with 5.7.12 build.

Thanks,
Umesh
[16 May 2016 8:41] MySQL Verification Team
test results

Attachment: 81424_5.7.12.results (application/octet-stream, text), 30.35 KiB.

[16 May 2016 8:56] MySQL Verification Team
test results

Attachment: 81424_5.6.30.results (application/octet-stream, text), 18.26 KiB.

[10 Oct 2016 22:05] monty solomon
We are repeatedly affected by this bug.

What are the plans to fix?

Thanks.
[12 Jan 2017 6:10] monty solomon
Fixing the replication discrepancies requires writing to the slave and ensuring that no errant GTID transactions are created.

Sample output comparing the master and slave using pt-table-checksum after making changes on the master.

% pt-table-checksum --no-check-binlog-format -h lingering-math --recursion-method hosts --replicate-check-only 
Differences on dry-puma
TABLE CHUNK CNT_DIFF CRC_DIFF CHUNK_INDEX LOWER_BOUNDARY UPPER_BOUNDARY
mysql.proxies_priv 1 -15 1   

master

mysql> select count(*) from proxies_priv;
+----------+
| count(*) |
+----------+
|       16 |
+----------+
1 row in set (0.00 sec)

slave

mysql> select count(*) from proxies_priv;
+----------+
| count(*) |
+----------+
|        1 |
+----------+
1 row in set (0.01 sec)
[12 Jan 2017 6:12] monty solomon
Adding the missing rows to the slave fails with the strict SQL_MODE due to the use of zero timestamps. See Bug#81425
[12 Mar 2017 23:18] monty solomon
In a comment for bug #85302, Joro wrote that "PROXY is (the only) privilege that has a user account as its object."

Does that have anything to do with why the PROXY privileges are not being replicated?
[4 Dec 2017 6:32] Venkatesh Venugopal
Bug#84564 has been marked as a duplicate of this bug.
[6 Dec 2017 2:01] Paul DuBois
Posted by developer:
 
Fixed in 5.7.19, 8.0.2.

Some PROXY grants were not replicated to slaves, causing incorrect
replication.
[6 Dec 2017 3:39] monty solomon
Paul,

The fix for this bug is not listed in the release notes for versions 5.7.19 or 8.0.2.

I did not know it was fixed until I saw your update to this bug.

Monty
[21 Dec 2017 3:20] monty solomon
Please update the release notes.

Thanks.
[22 Dec 2017 8:40] Erlend Dahl
The entry is in both release notes:

https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-19.html
https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-2.html