Skip to content

Commit 0cf66e4

Browse files
kbauskarNirbhay Choubey
authored andcommitted
- PXC#460: wsrep_sst_auth don't work in Percona-XtraDB-Cluster-56-5.6.25-25.12.1.el7
Semantics: --------- * Generally end-user will create a separate user with needed privileges for performing DONOR action. * This user credentials are specified using wsrep_sst_auth. * Along with this user there could be other user(s) created on the server that sysadmin may use for normal or other operations * Credentials for these user(s) can be specified in same cluster/server cnf file as part of [client] section When cluster act as DONOR and if wsrep_sst_auth is provided then it should strictly use it for performing SST based action. What if end-user has same credentials for performing both SST action and normal admin work ? * Then end-user can simply specify these credentials as part of [client] section in cnf file and skip providing wsrep_sst_auth. Issue: ----- MySQL client user/password parsing preference order is as follows: * command line (through --user/--password) * cnf file * MYSQL_PWD enviornment variable. Recent change tried passing sst user password through MYSQL_PWD (and user though --user command line param as before). On the system where-in admin had another user for performing non-SST actions, credentials for such user were present in cnf file under [client] section. Due to mysql client preference order, SST user name was used (as it was passed through command line) but password of other user (meant for non-SST) action was being used as it was passed through cnf file. Password passed through MYSQL_PWD was completely ignored causing user-name/password mismatch. Solution: --------- * If user has specified credentials for SST then pass them through command line so that they are used in priority. (There could be security concern on passing things through command line but when I tried passing user-name and password through command line to mysql client and then did ps I saw this ./bin/mysql --user=sstuser --password=x xxxxxxxx -S /tmp/n1.sock so seems like password is not shown)
1 parent 0fd9d5a commit 0cf66e4

File tree

2 files changed

+4
-6
lines changed

2 files changed

+4
-6
lines changed

scripts/wsrep_sst_xtrabackup-v2.sh

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -689,9 +689,8 @@ then
689689
INNOEXTRA+=" --user=$WSREP_SST_OPT_USER"
690690
fi
691691

692-
if [ -n "$WSREP_SST_OPT_PSWD" ]; then
693-
# INNOEXTRA+=" --password=$WSREP_SST_OPT_PSWD"
694-
export MYSQL_PWD="$WSREP_SST_OPT_PSWD"
692+
if [ -n "${WSREP_SST_OPT_PSWD:-}" ]; then
693+
INNOEXTRA+=" --password=$WSREP_SST_OPT_PSWD"
695694
else
696695
# Empty password, used for testing, debugging etc.
697696
INNOEXTRA+=" --password="

scripts/wsrep_sst_xtrabackup.sh

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -442,9 +442,8 @@ then
442442
INNOEXTRA+=" --user=$WSREP_SST_OPT_USER"
443443
fi
444444

445-
if [ -n "$WSREP_SST_OPT_PSWD" ]; then
446-
# INNOEXTRA+=" --password=$WSREP_SST_OPT_PSWD"
447-
export MYSQL_PWD="$WSREP_SST_OPT_PSWD"
445+
if [ -n "${WSREP_SST_OPT_PSWD:-}" ]; then
446+
INNOEXTRA+=" --password=$WSREP_SST_OPT_PSWD"
448447
else
449448
# Empty password, used for testing, debugging etc.
450449
INNOEXTRA+=" --password="

0 commit comments

Comments
 (0)