In user management, multiple IP logins can be restricted

Note:
This topic has been translated from a Chinese forum by GPT and might contain errors.

Original topic: 在用户管理中,可限定多个IP登录。

| username: OnTheRoad

Requirement Feedback
Please clearly and accurately describe the problem scenario, desired behavior, and background information to facilitate timely follow-up by the product team.
[Problem Scenario Involved in the Requirement]
In production, it is often required to restrict user login by IP. Currently, MySQL can restrict login IPs using _ and %. However, this is still not flexible enough.
[Desired Behavior of the Requirement]
Allow multiple IPs to be separated by commas , in the host field of the mysql.user table.

For example, restrict the admin user to log in only from the addresses 192.168.3.221 and 192.168.3.10. The corresponding host field would be 192.168.3.221,192.168.3.10.

CREATE USER 'admin'@'192.168.3.221,192.168.3.10' IDENTIFIED BY 'some_pass';

[Alternative Solutions for the Requirement]

[Background Information]
Applicable to scenarios with high security requirements, while also simplifying the DBA’s management of database user permissions.

| username: ShawnYan | Original post link

tidb indeed does not support this usage. Is this common in your company?
ERROR 1396 (HY000): Operation CREATE USER failed for 'admin'@'192.168.3.221,192.168.3.10'

Generally, there is a proxy in front of the tidb server. It is not recommended for the application server to connect directly to the tidb server.

| username: xiaohetao | Original post link

“It is not recommended for the application server to directly connect to the TiDB server.” What would be the impacts if connected directly?

| username: ShawnYan | Original post link

If directly connected, at which layer is failover implemented? Using F5 is not considered direct connection either.

| username: Billmay表妹 | Original post link

I seem to have seen that the commercial version has a whitelist control feature.

| username: OnTheRoad | Original post link

Thank you for your reply, cousin. It seems that I didn’t see the relevant introduction in the official documentation.

| username: OnTheRoad | Original post link

The current deployment structure uses HAProxy as a proxy.

| username: xiaohetao | Original post link

What are the impacts of connecting directly?

| username: system | Original post link

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.