MySQL权限异常排查：用户无法登录或操作的解决方案

CREATE USER 'dev'@'localhost';      -- 仅本机 socket 连接
CREATE USER 'dev'@'192.168.1.%';   -- 192.168.1.0/24 网段
CREATE USER 'dev'@'%';             -- 任意主机（含远程）

ERROR 1045 (28000): Access denied for user 'app_user'@'192.168.1.10' (using password: YES)

-- 以 root 登录后执行
SELECT Host, User FROM mysql.user WHERE User = 'app_user';

-- 查看用户认证方式
SELECT User, Host, plugin FROM mysql.user WHERE User = 'app_user';

SELECT User, Host, account_locked, password_expired 
FROM mysql.user 
WHERE User = 'app_user';

SHOW VARIABLES LIKE 'max_connections';
SHOW STATUS LIKE 'Threads_connected';

-- 查看用户连接限制
SELECT User, Host, max_connections FROM mysql.user WHERE User = 'app_user';

-- 允许从任意 IP 连接（生产环境慎用）
CREATE USER 'app_user'@'%' IDENTIFIED BY 'StrongPass123!';

-- 授予必要权限
GRANT SELECT, INSERT, UPDATE, DELETE ON myapp.* TO 'app_user'@'%';

-- 刷新权限
FLUSH PRIVILEGES;

-- 将用户改为 mysql_native_password（兼容性最好）
ALTER USER 'app_user'@'%' IDENTIFIED WITH mysql_native_password BY 'StrongPass123!';

-- 或创建时指定
CREATE USER 'app_user'@'%' 
IDENTIFIED WITH mysql_native_password BY 'StrongPass123!';

-- 解锁账户
ALTER USER 'app_user'@'%' ACCOUNT UNLOCK;

-- 重置密码（同时解除过期）
ALTER USER 'app_user'@'%' IDENTIFIED BY 'NewPass456!';

-- 或直接设置永不过期
ALTER USER 'app_user'@'%' PASSWORD EXPIRE NEVER;

-- 提高用户最大连接数
ALTER USER 'app_user'@'%' WITH MAX_USER_CONNECTIONS 50;

-- 或全局增加（需重启或动态设置）
SET GLOBAL max_connections = 500;

ERROR 1142 (42000): SELECT command denied to user 'app_user'@'192.168.1.10' for table 'users'

-- 查看用户所有权限
SHOW GRANTS FOR 'app_user'@'%';

-- 查看特定数据库权限
SELECT * FROM mysql.db WHERE User = 'app_user' AND Db = 'mydb';

-- 查看表级权限
SELECT * FROM mysql.tables_priv WHERE User = 'app_user' AND Db = 'mydb';

-- 查看视图定义
SHOW CREATE VIEW v_users;

-- 查看存储过程安全上下文
SELECT security_type, definer FROM information_schema.routines 
WHERE routine_name = 'my_proc';

-- 授予单表权限
GRANT SELECT, INSERT ON mydb.users TO 'app_user'@'%';

-- 授予整个数据库权限
GRANT ALL PRIVILEGES ON myapp.* TO 'app_user'@'%';

-- 授予列级权限（敏感字段保护）
GRANT SELECT (id, name) ON mydb.users TO 'report_user'@'%';

ALTER DEFINER = CURRENT_USER SQL SECURITY INVOKER 
PROCEDURE my_proc();

-- 正确写法
SELECT * FROM `order` WHERE `status` = 'paid';

<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
    <version>8.0.33</version> <!-- 使用 8.0.11+ 支持 caching_sha2_password -->
</dependency>

String url = "jdbc:mysql://192.168.1.100:3306/myapp?" +
             "useSSL=false&" +
             "allowPublicKeyRetrieval=true&" + // 必要时启用（有安全风险）
             "serverTimezone=UTC";

import java.sql.Connection;
import java.sql.SQLException;
import java.sql.Statement;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

public class DatabasePermissionChecker {

    private static final Logger log = LoggerFactory.getLogger(DatabasePermissionChecker.class);

    public void executeQuery(Connection conn, String sql) {
        try (Statement stmt = conn.createStatement()) {
            stmt.executeQuery(sql);
        } catch (SQLException e) {
            int errorCode = e.getErrorCode();
            String sqlState = e.getSQLState();

            if (errorCode == 1045 || "28000".equals(sqlState)) {
                log.error("🚨 LOGIN DENIED: Check username, password, host, or auth plugin.");
                throw new SecurityException("Database login failed", e);
            } 
            else if (errorCode == 1142 || "42000".equals(sqlState)) {
                log.error("🚫 COMMAND DENIED: User lacks privilege for: {}", sql);
                // 可触发告警或返回友好提示
                throw new AccessDeniedException("Insufficient database privileges");
            }
            else {
                throw new RuntimeException("Database error", e);
            }
        }
    }
}

@Component
public class DatabaseHealthCheck implements ApplicationRunner {

    @Autowired
    private DataSource dataSource;

    @Override
    public void run(ApplicationArguments args) throws Exception {
        try (Connection conn = dataSource.getConnection()) {
            // 尝试执行一个需要权限的操作
            try (Statement stmt = conn.createStatement()) {
                stmt.execute("SELECT 1 FROM information_schema.tables LIMIT 1");
            }
            log.info("✅ Database connection and basic permissions verified.");
        } catch (SQLException e) {
            log.error("❌ Database permission or connection check FAILED!", e);
            // 可选择退出应用或进入降级模式
            System.exit(1);
        }
    }
}

spring:
  datasource:
    hikari:
      connection-timeout: 30000
      idle-timeout: 600000
      max-lifetime: 1800000
      maximum-pool-size: 20
      # 关键：验证连接有效性
      connection-test-query: SELECT 1
      # 或 MySQL 专用
      # connection-init-sql: SET NAMES utf8mb4

ALTER USER 'secure_user'@'%' REQUIRE SSL;

String url = "jdbc:mysql://host/db?useSSL=true&requireSSL=true";

ALTER USER 'secure_user'@'%' REQUIRE NONE;

[mysqld]
skip-name-resolve

-- 示例：创建只读报表用户
CREATE USER 'reporter'@'10.0.0.%' IDENTIFIED BY '...';
GRANT SELECT ON sales.orders TO 'reporter'@'10.0.0.%';
GRANT SELECT (id, name) ON hr.employees TO 'reporter'@'10.0.0.%';

-- 创建角色
CREATE ROLE 'app_read', 'app_write';

-- 授予权限给角色
GRANT SELECT ON myapp.* TO 'app_read';
GRANT INSERT, UPDATE, DELETE ON myapp.* TO 'app_write';

-- 用户继承角色
GRANT 'app_read', 'app_write' TO 'app_user'@'%';

-- 激活角色（或设为默认）
SET DEFAULT ROLE 'app_read', 'app_write' TO 'app_user'@'%';

-- 查找拥有 ALL PRIVILEGES 的用户（高危！）
SELECT User, Host FROM mysql.user 
WHERE Select_priv='Y' AND Insert_priv='Y' AND Update_priv='Y' AND Delete_priv='Y' 
AND Drop_priv='Y';

-- 查找可以从任意主机连接的用户
SELECT User, Host FROM mysql.user WHERE Host = '%';