Seven-Step Guide to Diagnose OceanBase Cluster Login "Access Denied" Errors

Problem Background

In production, the client tool can connect to the OceanBase cluster, but logging in via the console reports an ERROR 1045 (42000): Access denied for user 'root'@'xxx.xxx.xxx.xxx' (using password: NO) error.

The article uses this case to outline seven typical checks for the "Access denied" problem.

Step 1 – Verify User Password

Confirm that the password for the user you are using is correct.

Step 2 – Check Network Connectivity

Ensure that servers on different subnets can reach the obproxy service on port 2883 :

telnet <obproxy-ip> 2883

Step 3 – Inspect User Privileges

Make sure the account has global login rights and is not locked. Example query:

// wms account login error
[root@10-186-65-73 ~]# mysql -hxxx -P2883 -uwms@hwc_test#hwc_cluster -p"xxx"
ERROR 1045 (42000): Access denied for user 'wms'@'xxx.xxx.xxx.xxx' (using password: YES)

mysql -hxxxx -P2883 -uroot@hwc_test#hwc_cluster -p"xxx"
select user_name,host,is_locked from oceanbase.__all_user where user_name='wms';
+-----------+-------------+-----------+
| user_name | host        | is_locked |
+-----------+-------------+-----------+
| wms       | 10.186.57.% | 0         |
+-----------+-------------+-----------+
1 row in set (0.01 sec)

Step 4 – Verify Client Compatibility

OceanBase supports MySQL client versions 5.5, 5.6, and 5.7. For obclient , check the version with:

obclient -V

Step 5 – Check Tenant Parameter ob_tcp_invited_nodes

This parameter defines the IP whitelist for a tenant. Example to view:

# show variables like '%ob_tcp_invited_nodes%';
+----------------------+-------------+
| Variable_name        | Value       |
+----------------------+-------------+
| ob_tcp_invited_nodes | 10.186.57.% |
+----------------------+-------------+

To remove restrictions:

ALTER TENANT test_tenant SET VARIABLES ob_tcp_invited_nodes='%';

Step 6 – Examine obproxy Logs

Look for related error messages in the log directory, typically /home/admin/logs/obproxy/log/ .

Step 7 – Review obproxy Configuration

Confirm that the configuration does not block specific IPs. Configuration files are usually under /home/admin/logs/obproxy/etc/ and can be inspected with:

strings obproxy_config.bin

Problem Location

The production environment used MySQL client 8.0.18, but only certain MySQL 8.x versions are compatible with OceanBase. The login failure was caused by a mismatch between the client version and the OceanBase cluster.