无法通过不同域连接到 MySQL 服务器
我在通过两个不同的受信任域连接到 MySQL 服务器时遇到问题。
我们正在开发一个供内部使用的应用程序，并且到目前为止一直在使用 MySQL。这是一个用 vb.net 编写的桌面应用程序。
到目前为止，所有用户都在同一个域中，没有出现任何问题。就在最近，由于各种原因，高层决定将用户分为 2 个不同的域。
问题是来自新域的用户无法访问服务器。如果这有帮助，管理员告诉我来自两个域的用户都是可信的。两台计算机都运行 Windows Server - 2003 和 2008。
服务器端口已打开，授权都在其中（base_class@%），但在尝试时 -
用户base_class@datablock2 的访问被拒绝。
问题是什么？
I'm having a problem connecting to a MySQL server over two different trusted domains.
We're developing an app for internal use and have been using MySQL till now. It's a desktop app written in vb.net.
Up until now all the users were on the same domain and there were no issues. Just recently there was an higher-level decision to split users in 2 different domains for various reasons.
The problem is that users from the new domain cannot access the server. If that helps, I was told by the administrators that the users from both domains are trusted. Both machines are running Windows Server - 2003 and 2008.
The server port is open, the grants are all in there(base_class@%) but upon attempt -
access denied for user base_class@datablock2.
What is the problem?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
访问被拒绝意味着客户端正在连接，但没有适当的权限。因此，请集中精力为这些用户
授予权限。请注意，mysql 在GRANT查询中使用*作为通配符，而不是%，因此 grant 查询应该是另请注意，如果您使用的是主机名(datablock2) 在您的授权查询中，您需要正确配置 DNS 设置，以便 MySQL 可以将连接 IP 反向查找回主机名。主机名不存在于 TCP/IP 级别，MySQL 只能看到 IP。为了匹配主机名，它必须进行反向查找。如果查找失败，那么它将完全脱离 IP。
Access denied means the clients are connecting, but don't have the appropriate rights. So concentrate on the
grantrights for those users. Note that mysql uses*for wildcards inGRANTqueries, not%, so the grant query should beAlso note that if you're using hostnames (datablock2) in your grant queries, that you'll need a properly configured DNS setup so MySQL can reverse-lookup the connecting IP back to a hostname. hostnames are not present at the TCP/IP level, and MySQL only ever sees an IP. To match for hostnames, it has to do the reverse lookup. If that lookup fails, then it'll go purely off the IP.
IMO，这不是开发任务，而是系统管理员和/或 DBA 任务。因此，使用 MS Query 设计一个测试用例，并将其交给系统管理员/DBA 来解决。例如：一个 ODBC 配置和一个通过 MS Query 运行的 SQL 语句，它（理论上）应该可以工作，并且在拆分之前就可以工作。
证明它适用于旧域的用户。告诉他们当它适用于新域时让您知道。
否则，他们会继续指责您的 VB 应用程序。
IMO, this is not a development task, it's a sysadmin and/or DBA task. So devise a test case using MS Query, and hand it off to sysadmins/DBAs to figure out. ex: an ODBC configuration, and a SQL statement to run through MS Query, which should (in theory) work, and which would have worked before the split.
Prove that it works for users from the old domain. Tell them to let you know when it works for the new domain.
Otherwise, they'll continue to blame your VB app.
在 MySQL 中，权限是按域授予的。也就是说，授予从本地域连接的用户的权限对于从不同域连接的用户来说不存在。从不同域连接的同一用户被视为不同的访问者。原因是为了防止滥用。例如，我个人将我的服务器配置为仅向从本地计算机连接的用户授予潜在危险的权限。您必须物理登录到服务器计算机才能删除关键数据！尝试为每个用户专门登录的每个域的服务器授予权限。根本不要使用通配符。利用额外的安全层来创建一个用于管理的域和一个用于不太重要的任务的域。
In MySQL, permissions are granted on a per-domain basis. That is, permissions granted to a user connecting from the local domain do not exist for a user connecting from a different domain. The same user connecting from a different domain is treated as a different accessor. The reason is to provide protection against misuse. For example, I personally configure my servers to grant potentially dangerous permissions only to users connecting from the local machine. You must be logged in to the server machine physically to delete critical data! Try granting permissions to the server for each user at each domain they will be logging in from specifically. Don't use wild cards at all. Take advantage of the additional layer of security to create a domain for administration and one for less critical tasks.