MySQL Bugs: #71448: group add fails if account has no access to mysql schema

Bug #71448	group add fails if account has no access to mysql schema
Submitted:	21 Jan 2014 16:54	Modified:	28 Feb 2014 1:11
Reporter:	Jan Kneschke	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Fabric	Severity:	S2 (Serious)
Version:	1.4.1	OS:	Any
Assigned to:	Alfranio Tavares Correia Junior	CPU Architecture:	Any

Description:
The connection the mysql-server is opened with the "mysql" schema as default-schema.

If the 'fabric' account has no access to that schema, the login will fail even if that schema is never used.

How to repeat:
Follow 

http://dev.mysql.com/doc/mysql-utilities/1.4/en/fabric-quick-start-sharding-scenario.html

-> Registering the servers.

and use accounts created according to:

http://dev.mysql.com/doc/mysql-utilities/1.4/en/fabric-create-user.html

Suggested fix:
In mysql/fabric/server.py, _do_connection():

change the

  ..., database="mysql",

to 

  ..., database=None,

Verified as described. Thank you for the report!

Posted by developer:
 
Fabric requires a user with all privileges granted on *.* in order to add a
server into a group. This is necessary because some provisioning operations
in the shard sub-system dump and restore all databases including MYSQL.

In particular, Fabric was reporting an error while adding a server to a group
if a user had no access to the MYSQL schema because we were running some
"SELECT"s to check whether the user had appropriate permissions or not.
We have substituted the "SELECT"s to "SHOW GRANTS" which does not require access
to the MYSQL schema though. This allows us to check whether users have the
appropriate permissions and print out a "detailed" error message.

Fixed as of the upcoming MySQL Utilities 1.4.2 release, and here's the changelog entry:

When checking for proper permissions, Fabric would execute several
"SELECT" statements against the '"mysql"' database, which caused the login
mechanism to fail if the user lacked access. This mechanism now uses
'"SHOW GRANTS"' statements instead, and now prints out a detailed error
message when access is unavailable.

Thank you for the bug report.