Comments on: Centralized authentication with mysql

By: www.hottubchoices.com

www.hottubchoices.com — Fri, 13 Jan 2012 12:40:34 +0000

Do not know how I get pulled into reading through all these kind of comments, but it is naturally great to learn that men and women can make them from the get go. I Really appreciate the read and carry on writing, I may get motivated to do exactly the same at some point.

By: Matthew Montgomery

Matthew Montgomery — Mon, 11 Apr 2011 18:19:56 +0000

I have some great news. A year and half after this thread started, the first release with officially supported privilege tables stored in NDBCLUSTER engine is available!

Please check it out!
http://dev.mysql.com/doc/refman/5.1/en/mysql-cluster-privilege-distribution.html

By: Deb

Deb — Tue, 04 Jan 2011 20:44:01 +0000

@istvan good point but it is possible. Read again to see what I mean.

By: istvan_podor

istvan_podor — Fri, 02 Oct 2009 21:12:07 +0000

@Sheeri

No it’s not, but why would you need it if you point in the connection part of the federated table’s definition to the VIP of the masters?

By: Sheeri

Sheeri — Fri, 02 Oct 2009 21:08:35 +0000

Does the MMM tool support changing the federated table definition when you promote a slave to the master (say, if you’re doing a rolling maintenance?)

By: istvan_podor

istvan_podor — Fri, 02 Oct 2009 19:36:55 +0000

@Matthew

Exactly, I already had some issues with grants system myself. I always find a way to workaround. Would be great if mysql would support this.

And I also forget to mention to upload the tables in my example like you did

By: Matthew Montgomery

Matthew Montgomery — Fri, 02 Oct 2009 19:30:10 +0000

However, there is the potential for some profound badness with in either of these approaches. The grants system does not use SQL to query the grants tables and load the results into the cache, rather it uses HANDLER calls which is really are only safe with MyISAM. Perhaps Sinisa could/should elaborate.

By: Matthew Montgomery

Matthew Montgomery — Fri, 02 Oct 2009 17:17:08 +0000

Though it’s not officially supported you could also place most of the grants tables into NDB cluster, Things that won’t work in the cluster are stored procedures, triggers and events. These still would need to be created in each mysqld node individually.

## NDB GRANTS – RUN ON ALL SQL NODES ##

RENAME TABLE mysql.user TO mysql.user_myi;
CREATE TABLE IF NOT EXISTS mysql.user LIKE mysql.user_myi;
ALTER TABLE mysql.user ENGINE=NDBCLUSTER;
INSERT IGNORE INTO mysql.user SELECT * FROM mysql.user_myi;

RENAME TABLE mysql.db TO mysql.db_myi;
CREATE TABLE IF NOT EXISTS mysql.db LIKE mysql.db_myi;
ALTER TABLE mysql.db ENGINE=NDBCLUSTER;
INSERT IGNORE INTO mysql.db SELECT * FROM mysql.db_myi;

RENAME TABLE mysql.host TO mysql.host_myi;
CREATE TABLE IF NOT EXISTS mysql.host LIKE mysql.host_myi;
ALTER TABLE mysql.host ENGINE=NDBCLUSTER;
INSERT IGNORE INTO mysql.host SELECT * FROM mysql.host_myi;

RENAME TABLE mysql.tables_priv TO mysql.tables_priv_myi;
CREATE TABLE IF NOT EXISTS mysql.tables_priv LIKE mysql.tables_priv_myi;
ALTER TABLE mysql.tables_priv ENGINE=NDBCLUSTER;
INSERT IGNORE INTO mysql.tables_priv SELECT * FROM mysql.tables_priv_myi;

RENAME TABLE mysql.columns_priv TO mysql.columns_priv_myi;
CREATE TABLE IF NOT EXISTS mysql.columns_priv LIKE mysql.columns_priv_myi;
ALTER TABLE mysql.columns_priv ENGINE=NDBCLUSTER;
INSERT IGNORE INTO mysql.columns_priv SELECT * FROM mysql.columns_priv_myi;

SET GLOBAL event_scheduler=1;
SELECT “REMEMBER TO set event_scheduler=1 in the my.cnf” as WARNING;
CREATE EVENT `mysql`.`flush_priv_tables` ON SCHEDULE EVERY 30 second ON COMPLETION PRESERVE DO FLUSH PRIVILEGES;

# Revert to default MYISAM GRANTS tables

DROP TABLE IF EXISTS mysql.user, mysql.db, mysql.host, mysql.tables_priv, mysql.columns_priv;
RENAME TABLE mysql.user_my TO mysql.user;
RENAME TABLE mysql.db_my TO mysql.db;
RENAME TABLE mysql.host_my TO mysql.host;
RENAME TABLE mysql.tables_priv_my TO mysql.tables_priv;
RENAME TABLE mysql.columns_priv_my TO mysql.columns_priv;
DROP EVENT `mysql`.`flush_priv_tables`;
SET GLOBAL event_scheduler=0;