Bug #82687 group replication should not require root@'%' to exist and have privileges

• Submitted: 23 Aug 2016 1:59
• Modified: 11 Jul 2017 11:52
• Reporter: Ben Krug
• Status: Closed
• Category: MySQL Server: Group Replication
• Severity: S3 (Non-critical)
• OS: Any
• CPU Architecture: Any

[23 Aug 2016 1:59] Ben Krug

Description:
Installing the group replication plugin requires root@'%' to exist, and have  privs with grant option.  This is hard-coded into the installation process, to look for and use this user.  It should be possible to install using any user with appropriate privileges.  Ie, we should not assume root@'%' exists and has the required privs.  (Especially as we might recommend removing such accounts.)

How to repeat:
eg, to show all that is needed, this is run as a user that has all privileges on *.*, with grant option:

mysql> create user root@'%' IDENTIFIED BY 'root';
Query OK, 0 rows affected (0.08 sec)

mysql> grant all privileges on *.* to root@'%';
Query OK, 0 rows affected (0.01 sec)

2016-08-03T18:00:53.005346+01:00 17872 [ERROR] Plugin group_replication reported: 'The internal plugin query 'GRANT SELECT ON performance_schema.replication_connection_status TO _gr_user@localhost' resulted in failure. errno: 1142'
2016-08-03T18:00:53.005443+01:00 17872 [ERROR] Plugin group_replication reported: 'It was not possible to create the group replication user usedby the plugin for internal operations.'
2016-08-03T18:00:53.005459+01:00 17872 [ERROR] Plugin 'group_replication' init function returned error.
2016-08-03T18:00:53.005473+01:00 17872 [Note] Shutting down plugin 'group_replication'
2016-08-03T18:00:53.005490+01:00 17872 [Note] Plugin group_replication reported: 'All Group Replication server observers have been successfully unregistered'

mysql> grant all privileges on *.* to root@'%' with grant option;
Query OK, 0 rows affected (0.00 sec)

mysql> INSTALL PLUGIN group_replication SONAME 'group_replication.so';
Query OK, 0 rows affected (0.00 sec)

Suggested fix:
Allow other users to install group replication, if they have the required privileges.

[11 Jul 2017 11:52] Erlend Dahl

[3 Jul 2017 6:40] David Moss

This is fixed in upcoming versions and the following was added to the 5.7.19
and 8.0.2 change logs:

Incompatible Change: Plugins such as Group Replication and X Plugin now use
the mysql.session account added in this version. If you are upgrading from a
previous version which did not include the mysql.session account you must run
mysql_upgrade to ensure the account is created. If mysql_upgrade is not run,
plugins fail to start with the error message There was an error when trying
to access the server with user: mysql.session@localhost. Make sure the user
is present in the server and that mysql_upgrade was ran after a server
update.