Openstack数据库初始化时为何要重复授权

问题;

为什么Openstack在创建数据库时要同时赋予用户在%和localhost登陆的权限而在MySQL中的%已经包含了localhost?

要回答这个问题我们可以先看看不这样做会怎样;

openstack-db --init --service keystone --pass keystone做了三件事情：

1、mysql> CREATE DATABASE keystone;

2、mysql> GRANT ALL ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystone';

3、mysql> GRANT ALL ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'keystone';

我们看看不做第三步会发生什么：

mysql> create database keystone;
Query OK, 1 row affected (0.01 sec)
mysql> GRANT ALL ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystone';
Query OK, 0 rows affected (0.00 sec)
mysql> flush privileges;
Query OK, 0 rows affected (0.00 sec)
mysql> select user,host,password from mysql.user;
+----------+-----------+-------------------------------------------+
| user     | host      | password                                  |
+----------+-----------+-------------------------------------------+
| root     | localhost |                                           |
| root     | db1       |                                           |
| root     | 127.0.0.1 |                                           |
|          | localhost |                                           |
|          | db1       |                                           |
| keystone | %         | *936E8F7AB2E21B47F6C9A7E5D9FE14DBA2255E5A |
+----------+-----------+-------------------------------------------+
6 rows in set (0.00 sec)

模拟登陆：

[root@db1 ~]# mysql -u keystone -pkeystone
ERROR 1045 (28000): Access denied for user 'keystone'@'localhost' (using password: YES)

被拒绝登陆了

用空密码尝试登陆：

[root@db1 ~]# mysql -u keystone
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 14
Server version: 5.1.52-log Source distribution
Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
This software comes with ABSOLUTELY NO WARRANTY. This is free software,
and you are welcome to modify and redistribute it under the GPL v2 license
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| test               |
+--------------------+
2 rows in set (0.00 sec)

登陆成功，不过不能显示keystone数据库

那么执行第三步会怎样呢？

mysql> GRANT ALL ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'keystone';
Query OK, 0 rows affected (0.01 sec)

再次模拟登陆：

[root@db1 ~]# mysql -u keystone -pkeystone
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 11
Server version: 5.1.52-log Source distribution
Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
This software comes with ABSOLUTELY NO WARRANTY. This is free software,
and you are welcome to modify and redistribute it under the GPL v2 license
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| keystone           |
| test               |
+--------------------+
3 rows in set (0.01 sec)

登陆成功了

分析：

执行第三步前：

mysql> select user,host,password from mysql.user;
+----------+-----------+-------------------------------------------+
| user     | host      | password                                  |
+----------+-----------+-------------------------------------------+
| root     | localhost |                                           |
| root     | db1       |                                           |
| root     | 127.0.0.1 |                                           |
|          | localhost |                                           |
|          | db1       |                                           |
| keystone | %         | *936E8F7AB2E21B47F6C9A7E5D9FE14DBA2255E5A |
+----------+-----------+-------------------------------------------+
6 rows in set (0.00 sec)

mysql -u keystone -pkeystone使用的用户是keystone@localhost,此时的权限表里并没有明确匹配这一用户的授权，于是MySQL将优先查找host='localhost,'的权限，这里匹配到了''@'localhost'密码为空，而mysql -u keystone -pkeystone提交的密码是keystone,MySQL认为密码不匹配于是拒绝登陆.而mysql -u keystone使用空密码恰好能匹配上于是反而空密码能登陆，不过由于''@'localhost'不具有keystone数据库的访问权限，所以登陆后看不到keystone库。

为了安全考虑应该移除该权限，那么openstack初始化数据库时可以不用重复授权