saltstack / saltstack/salt

[BUG] mysql_user fails using non-default auth_plugin

Open
#62,079 2 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs-triage
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Not sure if this is technically a bug or a feature request to support caching_sha2_password as an auth_plugin so apologies in advance.

Description
Adding multiple mysql users with any auth_plugin that it not native_myql_password results in the first user being created and subsequent users are not processed.

Talking to @myii on slack, he was able to determine the cause. He found that this auth plugin conditional results in an error (when not using native_myql_password), which is added to the context. The prevents further processing. I will allow him to expand upon this rather than my own garbled quoting

Setup

Salt version: 3003.4
Minion Description: Ubuntu 20.04.4 LTS (focal)
Mysql Version: mysql Ver 8.0.27-26.9 for Linux on x86_64 (MySQL Wsrep Server - GPL) (using SSL)

Steps to Reproduce the behavior

Create and apply a state such as:
users.sls:

user_1:
  mysql_user.present:
    - name: user1
    - host: localhost
    - auth_plugin: caching_sha2_password
    - password: test_pass
    - connection_pass: root_pass
    - connection_user: root

user_2:
  mysql_user.present:
    - name: user2
    - host: localhost
    - auth_plugin: caching_sha2_password
    - password: test_pass2
    - connection_pass: root_pass
    - connection_user: root

user_3:
  mysql_user.present:
    - name: user3
    - host: localhost
    - auth_plugin: caching_sha2_password
    - password: test_pass3
    - connection_pass: root_pass
    - connection_user: root

user_4:
  mysql_user.present:
    - name: user4
    - host: localhost
    - auth_plugin: caching_sha2_password
    - password: test_pass4
    - connection_pass: root_pass
    - connection_user: root

Expected behavior
Users should be created successfully

Actual behavior
user_1 is created, user_2 fails, user_3 is created, user_4 fails

----------
          ID: user_1
    Function: mysql_user.present
        Name: user1
      Result: True
     Comment: The user user1@localhost has been added
     Started: 15:17:55.297996
    Duration: 40.123 ms
     Changes:   
              ----------
              user1:
                  Present
----------
          ID: user_2
    Function: mysql_user.present
        Name: user2
      Result: False
     Comment: Unable to verify password.
     Started: 15:17:55.338310
    Duration: 5.172 ms
     Changes:   
----------
          ID: user_3
    Function: mysql_user.present
        Name: user3
      Result: True
     Comment: The user user3@localhost has been added
     Started: 15:17:55.343721
    Duration: 29.049 ms
     Changes:   
              ----------
              user3:
                  Present
----------
          ID: user_4
    Function: mysql_user.present
        Name: user4
      Result: False
     Comment: Unable to verify password.
     Started: 15:17:55.373006
    Duration: 5.645 ms
     Changes:   

Versions Report

salt --versions-report
Salt Version:
          Salt: 3003.4
 
Dependency Versions:
          cffi: Not Installed
      cherrypy: Not Installed
      dateutil: 2.6.1
     docker-py: Not Installed
         gitdb: 2.0.3
     gitpython: 2.1.8
        Jinja2: 2.10
       libgit2: Not Installed
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 0.5.6
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     pycparser: Not Installed
      pycrypto: 2.6.1
  pycryptodome: 3.4.7
        pygit2: Not Installed
        Python: 3.6.9 (default, Mar 15 2022, 13:55:28)
  python-gnupg: 0.4.1
        PyYAML: 3.12
         PyZMQ: 17.1.2
         smmap: 2.0.3
       timelib: Not Installed
       Tornado: 4.5.3
           ZMQ: 4.2.5
 
System Versions:
          dist: ubuntu 18.04 Bionic Beaver
        locale: UTF-8
       machine: x86_64
       release: 4.15.0-143-generic
        system: Linux
       version: Ubuntu 18.04 Bionic Beaver

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in salt/modules/mysql.py at the auth plugin conditional around lines 1385-1392 and reproduce the behavior with the supplied users.sls state using caching_sha2_password. Trace why password verification prevents alternate users from being processed, then verify that all four users are created successfully without the reported failures.

Written by the indexing model from the issue text.

Assessment

Tech stack
mysql, python
Domain
database
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.