tarantool / tarantool/tarantool
[Upgrade] ER_ACCESS_DENIED: Session access to universe '' is denied for user 'replicator'
Nobody has claimed this yet.
- Dominant language
- Lua
- Stars
- 3.7k
- Forks
- 419
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 88
Description
Tarantool version:
1.6.9-94-ga5da60b (installed using official RPM packages)
OS version:
CentOS Linux release 7.7.1908 (Core)
Bug description:
auth failed after upgrade tarantool instance
Steps to reproduce:
- install tarantool 1.6:
$ cat /etc/yum.repos.d/tarantool_1.6.repo
[tarantool1.6]
name=Tarantool 1.6
baseurl=https://download.tarantool.org/tarantool/1.6/el/7/x86_64/
enabled=1
gpgcheck=0
repo_gpgcheck=0
$ yum install -y tarantool-queue.noarch tarantool.x86_64
- setup a cluster with at least one master and some replicas (see initialization Lua scripts below)
- add yum repo file and upgrade tarantool RPM package using
yum update -y tarantool - try to start new tarantool instance
- new instance failed to join to the cluster:
2020-04-28 12:01:43.493 [10527] main/105/applier/replicator@127.0.0.1:33 I> subscribed
2020-04-28 12:01:43.494 [10527] main/105/applier/replicator@127.0.0.1:33 I> remote vclock {1: 376999} local vclock {1: 375406}
2020-04-28 12:01:43.494 [10527] main/108/applier/replicator@127.0.0.1:33 I> authenticated
2020-04-28 12:01:43.494 [10527] main/108/applier/replicator@127.0.0.1:33 I> subscribed
2020-04-28 12:01:43.494 [10527] main/108/applier/replicator@127.0.0.1:33 I> remote vclock {1: 376999} local vclock {1: 375406}
2020-04-28 12:01:43.495 [10527] main/106/applier/replicator@127.0.0.1:33 I> failed to authenticate
2020-04-28 12:01:43.495 [10527] main/106/applier/replicator@127.0.0.1:33 xrow.c:962 E> ER_ACCESS_DENIED: Session access to universe '' is denied for user 'replicator'
2020-04-28 12:01:43.495 [10527] main/106/applier/replicator@127.0.0.1:33 I> will retry every 1.00 second
2020-04-28 12:01:43.500 [10527] main/107/applier/replicator@127.0.0.1:33 I> failed to authenticate
2020-04-28 12:01:43.500 [10527] main/107/applier/replicator@127.0.0.1:33 xrow.c:962 E> ER_ACCESS_DENIED: Session access to universe '' is denied for user 'replicator'
2020-04-28 12:01:43.500 [10527] main/107/applier/replicator@127.0.0.1:33 I> will retry every 1.00 second
Optional (but very desirable):
master1.6-init.lua:
queue = require('queue')
local fiber = require('fiber')
-- файл экземпляра для мастера
box.cfg{
listen = 3301,
replication_source = {'replicator:password@127.0.0.1:3301',
'replicator:password@127.0.0.1:3302',
'replicator:password@127.0.0.1:3303',
'replicator:password@127.0.0.1:3304',
'replicator:password@127.0.0.1:3305'}
-- slab_alloc_arena = 1,
read_only = false
}
box.once("schema", function()
box.schema.user.create('replicator', {password = 'password'})
box.schema.user.grant('replicator', 'replication') -- настроить роль для репликации
box.schema.space.create("test")
box.space.test:create_index("primary")
print('box.once executed on master')
queue.create_tube('mail_msg', 'fifottl')
end)
local producer = fiber.create(function()
while true do
queue.tube.mail_msg:put('1')
fiber.sleep(0.2)
end
end)
console = require('console')
console.start()
replica1.6-init.lua:
box.cfg{
listen = 3302,
replication_source = {'replicator:password@127.0.0.1:3301',
'replicator:password@127.0.0.1:3303',
'replicator:password@127.0.0.1:3304',
'replicator:password@127.0.0.1:3305'},
slab_alloc_arena = 1,
read_only = true
}
box.once("schema", function()
box.schema.user.create('replicator', {password = 'password'})
box.schema.user.grant('replicator', 'replication') -- настроить роль для репликации
box.schema.space.create("test")
box.space.test:create_index("primary")
print('box.once executed on replica 2')
end)
console = require('console')
console.start()
replica1.10-init.lua
box.cfg{
listen = 3307,
replication = {
'replicator:password@127.0.0.1:3301', -- мастер 1.6
'replicator:password@127.0.0.1:3302', -- реплика 1.6
'replicator:password@127.0.0.1:3303', -- реплика 1.6
'replicator:password@127.0.0.1:3304', -- реплика 1.6
'replicator:password@127.0.0.1:3305', -- реплика 1.6
'replicator:password@127.0.0.1:3304', -- реплика 1.6
'replicator:password@127.0.0.1:3305', -- реплика 1.6
--'replicator:password@127.0.0.1:3306', -- мастер 1.10
--'replicator:password@127.0.0.1:3307', -- реплика 1.10
--'replicator:password@127.0.0.1:3308', -- реплика 1.10
--'replicator:password@127.0.0.1:3309', -- реплика 1.10
--'replicator:password@127.0.0.1:3310'}, -- реплика 1.10
},
slab_alloc_arena = 1,
read_only = true
}
box.once("schema", function()
box.schema.user.create('replicator', {password = 'password'})
box.schema.user.grant('replicator', 'replication') -- настроить роль для репликации
box.schema.space.create("test")
box.space.test:create_index("primary")
print('box.once executed on replica 7')
end)
console = require('console')
console.start()
tarantool 1.10 version:
$ tarantool -v
Tarantool 1.10.6-3-gaacc444
Target: Linux-x86_64-RelWithDebInfo
Build options: cmake . -DCMAKE_INSTALL_PREFIX=/usr -DENABLE_BACKTRACE=ON
Compiler: /opt/rh/devtoolset-8/root/usr/bin/cc /opt/rh/devtoolset-8/root/usr/bin/c++
C_FLAGS:-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fexceptions -funwind-tables -fno-omit-frame-pointer -fno-stack-protector -fno-common -fopenmp -msse2 -std=c11 -Wall -Wextra -Wno-strict-aliasing -Wno-char-subscripts -Wno-format-truncation -fno-gnu89-inline -Wno-cast-function-type
CXX_FLAGS:-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fexceptions -funwind-tables -fno-omit-frame-pointer -fno-stack-protector -fno-common -fopenmp -msse2 -std=c++11 -Wall -Wextra -Wno-strict-aliasing -Wno-char-subscripts -Wno-format-truncation -Wno-invalid-offsetof -Wno-cast-function-type
Optional (but very desirable):
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the upgrade using master1.6-init.lua, replica1.6-init.lua, and replica1.10-init.lua, then inspect the authentication and replication behavior around the reported ER_ACCESS_DENIED error. Done means a new 1.10 instance can authenticate and join the existing 1.6 cluster without repeated failures.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- centos, linux, lua
- Domain
- authentication, databases, distributed-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100