Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Access denied for user '***'@'%' to database 'prisma' #4520

Open
fEyebrow opened this issue May 10, 2019 · 14 comments
Open

Access denied for user '***'@'%' to database 'prisma' #4520

fEyebrow opened this issue May 10, 2019 · 14 comments

Comments

@fEyebrow
Copy link

@fEyebrow fEyebrow commented May 10, 2019

Describe the bug
When the elevated database user account does not have permission to create a schema, it cannot establish a connection with an existing database.

But when I provided the root account, I successfully established a connection with the database, but prisma created a schema called prisma.
Look like this:
image

To Reproduce
Steps to reproduce the behavior:

  1. init prisma and see a error info:
    Exception in thread "main" java.lang.RuntimeException: Unable to load Prisma config: com.prisma.config.InvalidConfiguration: Only Postgres connectors specify a schema. If they do they also need to specify a database. Other connectors only specify a database.
  2. I tried specifying database instead of schema and see the other error info:
    Exception in thread "main" java.sql.SQLSyntaxErrorException: (conn=8356231) Access denied for user 'nuggets'@'%' to database 'prisma'

Expected behavior
why prisma created a database called prisma in my mysql server. Is there a way to not create this database? What is the role of this database?

Versions (please complete the following information):
I am using Prisma CLI version prisma/1.32.2 node-v11.10.1 on macOS 10.13.6

@pantharshit00
Copy link
Member

@pantharshit00 pantharshit00 commented May 10, 2019

Can you please share your docker-compose file(redact any sensitive information)?

For first error is related to specifying a schema property in the MySQL or Mongo connector which is not supported by them as there is no concept of schema in those database servers. So this issue will be a duplicate of https://github.com/prisma/prisma/issues/4434

For the second issue, please make sure that the user you are using to connect prisma to your database has sufficient right for the creation of new databases and it can also read the existing one. In the above error, Prisma is trying to connect to the "prisma" database which it uses to store metadata information about the datamodel and the migrations that it has applied. Make sure your user has those permissions.

@fEyebrow
Copy link
Author

@fEyebrow fEyebrow commented May 11, 2019

this is my docker-compose.
image

Can you give more info about the "prisma" database?I need to convince my backend to allow me to connect to his database via prisma. Whether prisma will affect their existing services. I want to know the specific process of prisma connecting to an existing database. Can you give me some links to resources that contain this information?Thanks.
@pantharshit00

@pantharshit00
Copy link
Member

@pantharshit00 pantharshit00 commented May 13, 2019

"prisma" database stores metadata information about the migrations performed on the server. It also stores some internal tokens. It is not documented as it is an implementation detail. Basically, we query that database and apply the migration accordingly.

So please give your user access to this database so that prisma can work correctly.

@fEyebrow
Copy link
Author

@fEyebrow fEyebrow commented May 14, 2019

@pantharshit00
what is internal token?

@pantharshit00
Copy link
Member

@pantharshit00 pantharshit00 commented May 14, 2019

It was a legacy feature that we still need to support for compatibility. You can generate the cluster token using prisma cluster-token that is stored in that table to authenticate yourself with the management API.

@chemicalkosek
Copy link

@chemicalkosek chemicalkosek commented May 14, 2019

"prisma" database stores metadata information about the migrations performed on the server. It also stores some internal tokens. It is not documented as it is an implementation detail. Basically, we query that database and apply the migration accordingly.

So please give your user access to this database so that prisma can work correctly.

Is the 'prisma' database just that?
I have deployed Prisma Server through Dokku like this:
https://www.prisma.io/tutorials/deploy-prisma-to-dokku-ct15
But I have named the postgres service 'prismadb' not 'prisma-server-db' - it didn't allow dashes.
Dokku postgres plugin creates a database named the same as the postgres service. So in this case 'prismadb'.
Prisma during deploy creates a 'prisma' database.
I have checked and nothing is stored in the 'prismadb' database. Everything, including my data, is stored in the 'prisma' database.

dokku postgres:connect prismadb
prismadb-# \l
                                 List of databases
   Name    |  Owner   | Encoding |  Collate   |   Ctype    |   Access privileges
   
-----------+----------+----------+------------+------------+--------------------
---
 postgres  | postgres | UTF8     | en_US.utf8 | en_US.utf8 | 
 prisma    | postgres | UTF8     | en_US.utf8 | en_US.utf8 | 
 prismadb  | postgres | UTF8     | en_US.utf8 | en_US.utf8 | 
 template0 | postgres | UTF8     | en_US.utf8 | en_US.utf8 | =c/postgres        
  +
           |          |          |            |            | postgres=CTc/postgr
es
 template1 | postgres | UTF8     | en_US.utf8 | en_US.utf8 | =c/postgres        
  +
           |          |          |            |            | postgres=CTc/postgr
es
(5 rows)
prismadb-# \c prisma
You are now connected to database "prisma" as user "postgres".
prisma-# \dn
        List of schemas
        Name        |  Owner   
--------------------+----------
 booking-check$prod | postgres
 booking-dev$prod   | postgres
 management         | postgres
 public             | postgres
(4 rows)

prisma-# \dt *.*
                        List of relations
       Schema       |          Name           | Type  |  Owner   
--------------------+-------------------------+-------+----------
 booking-check$prod | Account                 | table | postgres
 booking-check$prod | Booking                 | table | postgres
 booking-check$prod | Group                   | table | postgres
 booking-check$prod | Membership              | table | postgres
 booking-check$prod | Room                    | table | postgres
 booking-check$prod | User                    | table | postgres
 booking-check$prod | _AccountOnMembership    | table | postgres
 booking-check$prod | _AccountToGroup         | table | postgres
 booking-check$prod | _BookingToRoom          | table | postgres
 booking-check$prod | _RelayId                | table | postgres
 booking-check$prod | _UserOnMembership       | table | postgres
 booking-dev$prod   | Account                 | table | postgres
 booking-dev$prod   | Booking                 | table | postgres
 booking-dev$prod   | Group                   | table | postgres
 booking-dev$prod   | Membership              | table | postgres
 booking-dev$prod   | Room                    | table | postgres
 booking-dev$prod   | User                    | table | postgres
 booking-dev$prod   | _AccountOnMembership    | table | postgres
 booking-dev$prod   | _AccountToGroup         | table | postgres
 booking-dev$prod   | _BookingToRoom          | table | postgres
 booking-dev$prod   | _RelayId                | table | postgres
 booking-dev$prod   | _UserOnMembership       | table | postgres
 information_schema | sql_features            | table | postgres
 information_schema | sql_implementation_info | table | postgres
 information_schema | sql_languages           | table | postgres
 information_schema | sql_packages            | table | postgres
 information_schema | sql_parts               | table | postgres
 information_schema | sql_sizing              | table | postgres
 information_schema | sql_sizing_profiles     | table | postgres
 management         | CloudSecret             | table | postgres
 management         | InternalMigration       | table | postgres
 management         | Migration               | table | postgres
 management         | Project                 | table | postgres
 management         | TelemetryInfo           | table | postgres
 pg_catalog         | pg_aggregate            | table | postgres
 pg_catalog         | pg_am                   | table | postgres
 pg_catalog         | pg_amop                 | table | postgres
 pg_catalog         | pg_amproc               | table | postgres
 pg_catalog         | pg_attrdef              | table | postgres
 pg_catalog         | pg_attribute            | table | postgres
 pg_catalog         | pg_auth_members         | table | postgres
 pg_catalog         | pg_authid               | table | postgres
 pg_catalog         | pg_cast                 | table | postgres
 pg_catalog         | pg_class                | table | postgres
 pg_catalog         | pg_collation            | table | postgres
 pg_catalog         | pg_constraint           | table | postgres
 pg_catalog         | pg_conversion           | table | postgres
 pg_catalog         | pg_database             | table | postgres
 pg_catalog         | pg_db_role_setting      | table | postgres
 pg_catalog         | pg_default_acl          | table | postgres
 pg_catalog         | pg_depend               | table | postgres
 pg_catalog         | pg_description          | table | postgres
 pg_catalog         | pg_enum                 | table | postgres
 pg_catalog         | pg_event_trigger        | table | postgres
 pg_catalog         | pg_extension            | table | postgres
 pg_catalog         | pg_foreign_data_wrapper | table | postgres
 pg_catalog         | pg_foreign_server       | table | postgres
 pg_catalog         | pg_foreign_table        | table | postgres
 pg_catalog         | pg_index                | table | postgres
 pg_catalog         | pg_inherits             | table | postgres
 pg_catalog         | pg_init_privs           | table | postgres
 pg_catalog         | pg_language             | table | postgres
 pg_catalog         | pg_largeobject          | table | postgres
 pg_catalog         | pg_largeobject_metadata | table | postgres
 pg_catalog         | pg_namespace            | table | postgres
 pg_catalog         | pg_opclass              | table | postgres
 pg_catalog         | pg_operator             | table | postgres
 pg_catalog         | pg_opfamily             | table | postgres
 pg_catalog         | pg_partitioned_table    | table | postgres
 pg_catalog         | pg_pltemplate           | table | postgres
 pg_catalog         | pg_policy               | table | postgres
 pg_catalog         | pg_proc                 | table | postgres
 pg_catalog         | pg_publication          | table | postgres
 pg_catalog         | pg_publication_rel      | table | postgres
 pg_catalog         | pg_range                | table | postgres
 pg_catalog         | pg_replication_origin   | table | postgres
 pg_catalog         | pg_rewrite              | table | postgres
 pg_catalog         | pg_seclabel             | table | postgres
 pg_catalog         | pg_sequence             | table | postgres
 pg_catalog         | pg_shdepend             | table | postgres
 pg_catalog         | pg_shdescription        | table | postgres
 pg_catalog         | pg_shseclabel           | table | postgres
 pg_catalog         | pg_statistic            | table | postgres
 pg_catalog         | pg_statistic_ext        | table | postgres
 pg_catalog         | pg_subscription         | table | postgres
 pg_catalog         | pg_subscription_rel     | table | postgres
 pg_catalog         | pg_tablespace           | table | postgres
 pg_catalog         | pg_transform            | table | postgres
 pg_catalog         | pg_trigger              | table | postgres
 pg_catalog         | pg_ts_config            | table | postgres
 pg_catalog         | pg_ts_config_map        | table | postgres
 pg_catalog         | pg_ts_dict              | table | postgres
 pg_catalog         | pg_ts_parser            | table | postgres
 pg_catalog         | pg_ts_template          | table | postgres
 pg_catalog         | pg_type                 | table | postgres
 pg_catalog         | pg_user_mapping         | table | postgres
(96 rows)




@pantharshit00
Copy link
Member

@pantharshit00 pantharshit00 commented May 14, 2019

@chemicalkosek

It is the management schema in postgres.

image

You have two services and the management schema which stores metadata about them

@ChukkyKatz
Copy link

@ChukkyKatz ChukkyKatz commented May 22, 2019

image
I have already created schema "managment" in my database and granted all permissions to my user, but I stiil receive:

prisma-server_1 | Exception in thread "main" org.postgresql.util.PSQLException: ERROR: permission denied for database mydatabase.

Should I create "prisma" database and create "management" schema in it?

UPD:
I created this database and schema in it and granted permissions,

CREATE DATABASE prisma;
GRANT CONNECT on DATABASE prisma TO testuser;
CREATE SCHEMA IF NOT EXISTS management AUTHORIZATION testuser;
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA management TO testuser;

but I still receive:

Exception in thread "main" org.postgresql.util.PSQLException: ERROR: permission denied for database mydatabase
Exception in thread "main" org.postgresql.util.PSQLException: ERROR: permission denied for database prisma

@ChukkyKatz
Copy link

@ChukkyKatz ChukkyKatz commented May 22, 2019

@chemicalkosek

It is the management schema in postgres.

There is no such schema by default in postgres

@ChukkyKatz
Copy link

@ChukkyKatz ChukkyKatz commented May 24, 2019

I have solution:

CREATE DATABASE prisma;

ALTER USER testuser CREATEDB

-- switch to database "prisma" --

GRANT CONNECT ON DATABASE prisma TO testuser;
CREATE SCHEMA IF NOT EXISTS management AUTHORIZATION testuser;
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA management TO testuser;

Now it works for me. Could you specify somewhere in documentation, that user must have permission to create database?

Снимок

@pantharshit00
Copy link
Member

@pantharshit00 pantharshit00 commented May 28, 2019

Yes. cc @nikolasburk

@fEyebrow
Copy link
Author

@fEyebrow fEyebrow commented Jun 10, 2019

�I only want to query the existing database. Can I adjust the configuration of the Prisma and connect to the Prisma with lower permission? I can't get the root access to the database.
@pantharshit00

@pantharshit00
Copy link
Member

@pantharshit00 pantharshit00 commented Jun 11, 2019

User should have permission for the creation of the database so that it can create the database for your service.

You can also predict the database name that you will need permission for by looking at the URL in your prisma.yml file. For example:
http://myserver.com/backend/prod

So if you on MySQL database name will be backend@prod and you can give the user permission on prisma and backend@prod db.

On postgres, we will create a schema called backend$prod. Give your user permission on management schema and backend$prod schema.

@SEALiu
Copy link

@SEALiu SEALiu commented Feb 18, 2020

"prisma" database stores metadata information about the migrations performed on the server. It also stores some internal tokens. It is not documented as it is an implementation detail. Basically, we query that database and apply the migration accordingly.

So please give your user access to this database so that prisma can work correctly.

@pantharshit00
If I only access the existing database and create datamodel.prisma manually, is there any method to avoid to create "prisma" database ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
5 participants
You can’t perform that action at this time.