9

I have created an intranet web application that run on a CentOS web server, the application use another local server (always CentOS) for the MySQL database.

Inside the database I have created routines which always start like this:

CREATE DEFINER='localuser02'@'192.168.0.5' PROCEDURE 'Createuser'

The IP 192.168.0.5 is the IP of the server where application is installed.

Until here all is ok the application is working. Now some days ago as the server that run the application is an old one, to add another server (I mean commodity server), what I was thinking is to do a traffic balance between them.

Now I have setup correctly both servers to run the application, the problem is with the SQL DEFINER which have just one IP.

My servers have now 192.168.0.5 and 192.168.0.6.

Theoretically my new DEFINER should be like this:

CREATE DEFINER='localuser02'@'192.168.0.5, 192.168.0.6' PROCEDURE 'Createuser'

But I don't know how to proceed.


thanks for the answer.

For wildcard I have understand like using with percent like you said 192.168.% or like suggested by eggyal 192.168.0.% my question and concerns in doing this if it will work? Since my network is distributed like this:

192.168.0.1 - router
192.168.0.2 - voip phone
192.168.0.3 - voip phone
192.168.0.4 - firewall
192.168.0.5 - Server 01
192.168.0.6 - Server 02
192.168.0.7 - SQL Server
192.168.0.8 - LAN Printer
192.168.0.9 - First pc
192.168.0.10 - Second pc

My question is having IP from 192.168.0.1 to xxx.10 reserved, if I add wildcard on SQL could be a collision with address I mean could the DEFINER try to authenticate for example on voip phone or a printer or the firewall instead of the two servers exclusively?

Also second question, there is the possibility to list more than one IP to be more tidy like:

CREATE DEFINER='localuser02'@'192.168.0.5, 192.168.0.6' PROCEDURE 'Createuser'

Thanks in advance

3
  • 1
    The DEFINER is simply the user who "owns" the procedure; if the procedure is defined with SQL SECURITY DEFINER, then it will be run with the privileges of that account irrespective of the user who invokes it. The DEFINER credentials should match a valid user account, the host parts of which indicate the machine(s) from which the user can connect. Therefore there's no particular need to change the DEFINER in this case; however, if you wish to enable the localuser02 account to connect from either machine, you might alter their credentials to use a wildcard: @'192.168.0.%'.
    – eggyal
    May 16, 2013 at 18:42
  • Hi Eggyal, thank for your answer. From what I have understanded correct me if I'm wrong the procedure will work either a user is using the application from Server 01 or Server 02 right? I mean on both server the application execute queries and calls on database, so in this case if I use just one IP the one of the first server 192.168.0.5 the user that is using the application on Server 02 (192.168.0.6) will work? I mean user of Server 02 will be authenticated over Server 01 if in the procedure I add IP of the first server? Thanks May 16, 2013 at 19:24
  • For wildcard I have a problem because on my network I have 192.168.0.7 to 192.168.0.10 that are hold by other PC's, than 192.168.0.2 to 192.168.0.3 that are used by voip phones and printer, in teory the SQL will search for IP's that are used by other pc's on my network and will cause errors? Can I add to CREATE DEFINER two IP comma separated? thanks May 16, 2013 at 19:32

1 Answer 1

7

The DEFINER clause controls the account used at execution time, unless you also specify SQL SECURITY INVOKER. As your code is currently written, regardless of which user executes the code at runtime, it will be executed under the security context specified in DEFINER. If you need to specify a broader range of addresses for the definer, use % by itself in the host portion, or use something like 192.168.%

3
  • I add the wildcard, the problem now is that when user is connected to Server01 all works fine, but when he switch to Server02 the application send the user to the login page, like if he wasn't logged. I'm using RoundRobin to balance both server, but it seems like the user can be authenticated on one server once. How can I achieve that user can work on both server indipendently after login? Now in database I have 192.168.0.%. Thanks May 18, 2013 at 11:12
  • This sounds more like an application code issue, rather than a MySQL DEFINER issue, no? Does the application URL change from one IP to the next?
    – udog
    May 20, 2013 at 20:51
  • Marcos, How did you make out with this issue?
    – udog
    May 29, 2013 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.