📋

Description

Error 3552, `ER_NO_SYSTEM_SCHEMA_ACCESS`, indicates that an attempt was made to access a MySQL internal system schema, such as `mysql`, `information_schema`, or `performance_schema`, without the required permissions. This commonly occurs when a user account lacks the necessary grants to query or modify these critical database structures, preventing operations like viewing server status, schema metadata, or performance metrics.

💬

Error Message

Access to system schema '%s' is rejected.

🔍

Known Causes

3 known causes

⚠️

Insufficient User Privileges

The MySQL user account attempting the operation does not possess the necessary `SELECT`, `INSERT`, `UPDATE`, or other specific privileges on the targeted system schema.

⚠️

Incorrect User Configuration

The user attempting the operation is not the intended administrative user, or their defined roles and grants inadvertently restrict access to critical system schemas.

⚠️

Application Using Low-Privilege Account

An application requiring access to system schemas for monitoring, introspection, or administrative tasks is configured to connect using a user account with limited privileges.

🛠️

Solutions

3 solutions available

1. Grant Necessary Privileges for System Schema Access medium

Grant specific privileges to the user or role attempting to access the system schema.

1

Identify the user or role that is encountering the error. This can often be seen in the application logs or by tracing the connection.

2

Connect to your MySQL server as a user with sufficient administrative privileges (e.g., `root`).

mysql -u root -p

3

Grant the necessary privileges for the specific system schema. Common system schemas include `mysql`, `information_schema`, and `performance_schema`. For example, to grant `SELECT` privilege on `information_schema` to a user named `app_user`:

GRANT SELECT ON information_schema.* TO 'app_user'@'localhost';

4

If the application requires broader access for debugging or management, you might consider granting more specific privileges. For instance, to allow a user to see all databases and tables (which includes system schemas):

GRANT SHOW DATABASES, SHOW TABLES ON *.* TO 'app_user'@'localhost';

5

Flush privileges to ensure the changes are applied immediately.

FLUSH PRIVILEGES;

6

Test the connection with the user experiencing the error.

2. Review and Adjust `validate_password` Component Settings medium

The `validate_password` component can sometimes interfere with legitimate access attempts, especially if it's configured too strictly.

1

Connect to your MySQL server as a user with administrative privileges.

mysql -u root -p

2

Check if the `validate_password` component is installed and enabled.

SHOW PLUGINS;

3

If the component is active, examine its configuration. You can query the `validate_password` table in the `mysql` schema.

SELECT * FROM mysql.validate_password;

4

Consider temporarily disabling or relaxing the `validate_password` component settings if they are overly strict and potentially causing the system schema access rejection. For example, to set the minimum password length to 0 (effectively disabling length checks):

SET GLOBAL validate_password_length = 0;

5

Apply other relevant `validate_password` settings as needed, or consider disabling the plugin entirely if it's not strictly required for security.

UNINSTALL PLUGIN validate_password;

6

Flush privileges after making changes.

FLUSH PRIVILEGES;

7

Test the access again.

3. Configure `require_secure_transport` for Specific Users medium

If `require_secure_transport` is enabled globally, it might affect how users connect and access resources, including system schemas.

1

Check the global `require_secure_transport` setting.

SHOW GLOBAL VARIABLES LIKE 'require_secure_transport';

2

If `require_secure_transport` is ON (or `ON_DEMAND`), and the user in question is connecting via an insecure channel and trying to access system schemas, this could be the cause. You can either:

3

Option A: Ensure the user is connecting via a secure transport (e.g., SSL/TLS). This might involve configuring your application or client to use SSL.

4

Option B: If secure transport is not feasible for this user, you can disable `require_secure_transport` globally (not recommended for production without careful consideration of security implications).

SET GLOBAL require_secure_transport = OFF;

5

Option C: Alternatively, you can set `require_secure_transport` for a specific user to OFF. This is a more granular approach.

ALTER USER 'app_user'@'localhost' REQUIRE NONE;

6

Flush privileges after making changes.

FLUSH PRIVILEGES;

7

Test the access.

🔗

Related Errors

5 related errors

MySQL Error 3552: Rejected System Schema Access