MyCATApache/Mycat-Server · error · ConfigException

[host: ] contains one root privileges user

Error message

[host: ${hostStr}] contains one root privileges user: ${user}

What it means

Also in loadFirewall: a whitelisted user must have at least one schema assigned (uc.getSchemas() non-null and non-empty). A user with no schemas is treated as a root/full-privilege account, and MyCat refuses to allow such an unrestricted user inside a host whitelist, throwing this ConfigException. This prevents accidentally whitelisting a superuser whose access would bypass schema-level isolation.

Solutions

1. Either add a <schemas> list to the referenced user's definition so it is schema-restricted, or remove that user from the firewall whitelist
2. Create a dedicated restricted user (with explicit schemas) for whitelist use instead of the root-privilege account
3. Audit all users referenced by <firewall> entries and confirm each declares non-empty schemas
4. Restart MyCat after the change

Example fix

// before
<user name="admin"><property name="password">x</property></user>
<host host="10.0.0.1" user="admin"/>
// after
<user name="admin"><property name="password">x</property><schemas>db1</schemas></user>

// ensure whitelisted users declare non-empty schemas
for each firewall host element:
    for (String u : e.getAttribute("user").split(",")) {
        Element user = userByName(u.trim());
        if (user.getElementsByTagName("schemas").getLength() == 0
            || user.getElementsByTagName("schemas").item(0).getTextContent().trim().isEmpty())
            throw new IllegalStateException("Whitelisted user lacks schemas: " + u);
    }

null

try {
    serverLoader.load();
} catch (ConfigException e) {
    LOG.error("Root-privilege user in firewall whitelist: " + e.getMessage());
    throw new ConfigurationException("Whitelisted users must declare schemas", e);
}

When it happens

Trigger: server.xml firewall entry lists a <user> whose definition has no <schemas> (or an empty <schemas>) child; the user loaded with no schema restrictions.

Common situations: Defining an admin user without schemas for convenience, then adding it to the IP whitelist; a config refactor that dropped the schemas block from a user definition; copying a root user entry into the firewall section.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• host duplicated
• [user: ] doesn't exist in [host: ]
• CachePoolFactory not defined for type
• can't find cache pool
• table rule duplicated!

AI-assisted analysis of MyCATApache/Mycat-Server@65f8d8beb7 (2026-09-11). Data as JSON: /api/errors/da30d33e4f1c0641. Report an issue: GitHub.

Appendix: source

Thrown at src/main/java/io/mycat/config/loader/xml/XMLServerLoader.java:164

                String hostStr = e.getAttribute("host").trim();
                String userStr = e.getAttribute("user").trim();
                String []hosts = hostStr.split(",");
                for (String host : hosts) {
                    host = host.trim();
                    if (this.firewall.existsHost(host)) {
                        throw new ConfigException("host duplicated : " + host);
                    }
                }
                String []users = userStr.split(",");
                List<UserConfig> userConfigs = new ArrayList<UserConfig>();
                for(String user : users){
                    user = user.trim();
                	UserConfig uc = this.users.get(user);
                    if (null == uc) {
                        throw new ConfigException("[user: " + user + "] doesn't exist in [host: " + hostStr + "]");
                    }
                    if (uc.getSchemas() == null || uc.getSchemas().size() == 0) {
                        throw new ConfigException("[host: " + hostStr + "] contains one root privileges user: " + user);
                    }
                    userConfigs.add(uc);
                }
                for (String host : hosts) {
                    host = host.trim();
                    if (host.contains("*") || host.contains("%")) {
                        whitehostMask.put(FirewallConfig.getMaskPattern(host), userConfigs);
                    } else {
                        whitehost.put(host, userConfigs);
                    }
                }
            }
        }

        firewall.setWhitehost(whitehost);
        firewall.setWhitehostMask(whitehostMask);

        WallConfig wallConfig = new WallConfig();

View on GitHub (pinned to 65f8d8beb7)