<h5 dir="auto">ISSUE TYPE</h5>
<p dir="auto">Feature Idea</p>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto"><code class="notranslate">mysql_user</code></p>
<h5 dir="auto">ANSIBLE VERSION</h5>
<div class="highlight highlight-source-shell notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="ansible 2.3.0.0
  config file =
  configured module search path = Default w/o overrides"><pre class="notranslate">ansible 2.3.0.0
  config file =
  configured module search path = Default w/o overrides</pre></div>
<h5 dir="auto">CONFIGURATION</h5>
<p dir="auto">Default configuration</p>
<h5 dir="auto">OS / ENVIRONMENT</h5>
<p dir="auto">N/A</p>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">From the MySQL 5.7 what's new page:</p>
<blockquote>
<p dir="auto">The server now requires account rows in the mysql.user table to have a nonempty plugin column value and disables accounts with an empty value.</p>
</blockquote>
<p dir="auto">On a fresh installation of MySQL 5.7 the <code class="notranslate">root</code> user for host <code class="notranslate">localhost</code> is now configured with a plugin value of <code class="notranslate">auth_socket</code>. This prevents users other then root to connect as root using the <code class="notranslate">mysql</code>client utility:</p>
<div class="highlight highlight-source-shell notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="user@server$ mysql -u root -pP4ssw0rd
ERROR 1698 (28000): Access denied for user 'root'@'localhost'"><pre class="notranslate">user@server$ mysql -u root -pP4ssw0rd
ERROR 1698 (28000): Access denied <span class="pl-k">for</span> user <span class="pl-s"><span class="pl-pds">'</span>root<span class="pl-pds">'</span></span>@<span class="pl-s"><span class="pl-pds">'</span>localhost<span class="pl-pds">'</span></span></pre></div>
<p dir="auto">While as root this works:</p>
<div class="highlight highlight-source-shell notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="root@server# mysql"><pre class="notranslate">root@server# mysql</pre></div>
<p dir="auto">Currently, this cannot be done with Ansible.</p>
<p dir="auto">References:</p>
<ul dir="auto">
<li><a href="https://dev.mysql.com/doc/refman/5.7/en/socket-pluggable-authentication.html" rel="nofollow">https://dev.mysql.com/doc/refman/5.7/en/socket-pluggable-authentication.html</a></li>
<li><a href="https://www.slideshare.net/ottokekalainen/passwordless-login-with-unix-authsocket" rel="nofollow">https://www.slideshare.net/ottokekalainen/passwordless-login-with-unix-authsocket</a></li>
</ul>
<h5 dir="auto">STEPS TO REPRODUCE</h5>
<p dir="auto">It would be nice to introduce a new parameter to this module which accepts all possible plugin values (defaulting to <code class="notranslate">mysql_native_password</code>) , e.g.:</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="mysql_user: name=root password=abc123 plugin=mysql_native_password
mysql_user: name=root plugin=auth_socket"><pre class="notranslate"><span class="pl-ent">mysql_user</span>: <span class="pl-s">name=root password=abc123 plugin=mysql_native_password</span>
<span class="pl-ent">mysql_user</span>: <span class="pl-s">name=root plugin=auth_socket</span></pre></div>
<h5 dir="auto">EXPECTED RESULTS</h5>
<p dir="auto">N/A</p>
<h5 dir="auto">ACTUAL RESULTS</h5>
<p dir="auto">N/A</p>
<h5 dir="auto">CHALLENGES</h5>
<ul dir="auto">
<li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/oscherler/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/oscherler">@oscherler</a> noted that the syntax varies between MySQL and MariaDB: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="152740604" data-permission-text="Title is private" data-url="https://github.com/ansible/ansible-modules-core/issues/3587" data-hovercard-type="pull_request" data-hovercard-url="/ansible/ansible-modules-core/pull/3587/hovercard?comment_id=227364601&amp;comment_type=issue_comment" href="https://github.com/ansible/ansible-modules-core/pull/3587#issuecomment-227364601">ansible/ansible-modules-core#3587 (comment)</a></li>
<li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/wouteroostervld/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/wouteroostervld">@wouteroostervld</a> added that you have to change the plugin and password in one action, to avoid exposure: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="132725635" data-permission-text="Title is private" data-url="https://github.com/ansible/ansible-modules-core/issues/3003" data-hovercard-type="issue" data-hovercard-url="/ansible/ansible-modules-core/issues/3003/hovercard?comment_id=256328101&amp;comment_type=issue_comment" href="https://github.com/ansible/ansible-modules-core/issues/3003#issuecomment-256328101">ansible/ansible-modules-core#3003 (comment)</a></li>
</ul>
<h5 dir="auto">NOTES</h5>
<ul dir="auto">
<li>Issue migrated from <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="132725635" data-permission-text="Title is private" data-url="https://github.com/ansible/ansible-modules-core/issues/3003" data-hovercard-type="issue" data-hovercard-url="/ansible/ansible-modules-core/issues/3003/hovercard" href="https://github.com/ansible/ansible-modules-core/issues/3003">ansible/ansible-modules-core#3003</a></li>
<li>Releated PR: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="152740604" data-permission-text="Title is private" data-url="https://github.com/ansible/ansible-modules-core/issues/3587" data-hovercard-type="pull_request" data-hovercard-url="/ansible/ansible-modules-core/pull/3587/hovercard" href="https://github.com/ansible/ansible-modules-core/pull/3587">ansible/ansible-modules-core#3587</a></li>
</ul>
<p dir="auto">I changed a few details:</p>
<ul dir="auto">
<li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/verwilst/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/verwilst">@verwilst</a> mentioned that you can use either a password or auth_socket not both: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="132725635" data-permission-text="Title is private" data-url="https://github.com/ansible/ansible-modules-core/issues/3003" data-hovercard-type="issue" data-hovercard-url="/ansible/ansible-modules-core/issues/3003/hovercard?comment_id=199799891&amp;comment_type=issue_comment" href="https://github.com/ansible/ansible-modules-core/issues/3003#issuecomment-199799891">ansible/ansible-modules-core#3003 (comment)</a></li>
<li>I updated the format to follow the latest one</li>
<li>I updated the ansible version output, even if not very usefull in this case</li>
<li>I also added some references and a challenges section</li>
</ul>
<p dir="auto">For instance, in a role's vars/main.yml, I have the following:</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="luks_dev: &quot;{{ luks_device | mandatory }}&quot;"><pre class="notranslate"><span class="pl-ent">luks_dev</span>: <span class="pl-s"><span class="pl-pds">"</span>{{ luks_device | mandatory }}<span class="pl-pds">"</span></span></pre></div>
<p dir="auto">I then have a task that uses this variable in its name:</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="- name: initialize luks in &quot;{{ luks_dev }}&quot;"><pre class="notranslate">- <span class="pl-ent">name</span>: <span class="pl-s">initialize luks in "{{ luks_dev }}"</span></pre></div>
<p dir="auto">This produces the following output:</p>
<div class="highlight highlight-source-shell notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="TASK: [luks | initialize luks in &quot;{{ luks_device | mandatory }}&quot;] *************"><pre class="notranslate">TASK: [luks <span class="pl-k">|</span> initialize luks <span class="pl-k">in</span> <span class="pl-s"><span class="pl-pds">"</span>{{ luks_device | mandatory }}<span class="pl-pds">"</span></span>] <span class="pl-k">*************</span></pre></div>