apache/seatunnel · error · ConnectException

Unexpected error while connecting to MySQL and looking at pr

Error message

Unexpected error while connecting to MySQL and looking at privileges for current user:

What it means

MySqlJdbcContext.userHasPrivileges() executes `SHOW GRANTS FOR CURRENT_USER` and scans the grant strings for required privileges. An SQLException during this check is wrapped in a ConnectException with this message, failing the connector's permission validation step before replication starts.

Source

Thrown at seatunnel-connectors-v2/connector-cdc/connector-cdc-mysql/src/main/java/io/debezium/connector/mysql/legacy/MySqlJdbcContext.java:381

        try {
            jdbc.query(
                    "SHOW GRANTS FOR CURRENT_USER",
                    rs -> {
                        while (rs.next()) {
                            String grants = rs.getString(1);
                            logger.debug(grants);
                            if (grants == null) {
                                return;
                            }
                            grants = grants.toUpperCase();
                            if (grants.contains("ALL")
                                    || grants.contains(grantName.toUpperCase())) {
                                result.set(true);
                            }
                        }
                    });
        } catch (SQLException e) {
            throw new ConnectException(
                    "Unexpected error while connecting to MySQL and looking at privileges for current user: ",
                    e);
        }
        return result.get();
    }

    public String connectionString() {
        return jdbc.connectionString(MYSQL_CONNECTION_URL);
    }

    /**
     * Read the MySQL charset-related system variables.
     *
     * @return the system variables that are related to server character sets; never null
     */
    protected Map<String, String> readMySqlCharsetSystemVariables() {
        // Read the system variables from the MySQL instance and get the current database name ...
        logger.debug("Reading MySQL charset-related system variables before parsing DDL history.");

View on GitHub (pinned to cf67b549a7)

Solutions

Examine the wrapped SQLException for the exact server error (access denied vs connection loss).
Run `SHOW GRANTS FOR CURRENT_USER();` with the same credentials via mysql CLI to reproduce and confirm.
Grant the connector user the required CDC privileges (SELECT, RELOAD, SHOW VIEW, REPLICATION SLAVE, REPLICATION CLIENT).
Fix authentication: align the driver with the server's default auth plugin, or rotate expired credentials.
Reconnect/restart the task if the cause was a transient connection drop.

Example fix

// before
throw new ConnectException("Unexpected error while connecting to MySQL and looking at privileges for current user: ", e);
// after
throw new ConnectException("Unable to verify privileges for user '" + connection.username() + "': " + e.getMessage(), e);

Defensive patterns

Strategy: validation

Validate before calling

// Verify the CDC user's grants before starting the connector:
try (Connection c = DriverManager.getConnection(jdbcUrl, user, pass);
     Statement s = c.createStatement();
     ResultSet rs = s.executeQuery("SHOW GRANTS FOR CURRENT_USER()")) {
    StringBuilder grants = new StringBuilder();
    while (rs.next()) grants.append(rs.getString(1)).append('\n');
    String g = grants.toString().toUpperCase();
    for (String needed : new String[]{"REPLICATION SLAVE", "REPLICATION CLIENT", "SELECT"}) {
        if (!g.contains(needed)) throw new IllegalStateException("Missing privilege: " + needed);
    }
}

Type guard

static boolean isAccessDenied(ConnectException ce) {
    Throwable t = ce.getCause();
    return t instanceof java.sql.SQLException
        && ((java.sql.SQLException) t).getErrorCode() == 1044;
}

Try / catch

try {
    connector.start();
} catch (org.apache.kafka.connect.errors.ConnectException e) {
    if (e.getMessage().contains("looking at privileges for current user")) {
        // Usually fatal: wrong user/grants. Log cause and abort with guidance.
        throw new IllegalArgumentException("Check CDC user grants: " + e.getCause(), e);
    } else { throw e; }
}

Prevention

Provision the CDC user with REPLICATION SLAVE, REPLICATION CLIENT, SELECT, RELOAD, SHOW VIEW up front.
Run SHOW GRANTS FOR CURRENT_USER() as a deployment pre-check with the same credentials.
Rotate credentials before expiry and update connector config in sync.
Match the JDBC driver's auth plugin support to the MySQL server default (e.g. caching_sha2_password).
Re-run privilege validation after any DBA grant-table changes.

When it happens

Trigger: Calling userHasPrivileges(...) when the JDBC connection is unusable, SHOW GRANTS is rejected for the current user, or the result set iteration throws; caught at MySqlJdbcContext.java:381 and rethrown as ConnectException.

Common situations: Grant tables corrupted or restricted (privilege errors even for SHOW GRANTS); connecting via a proxy that strips the session context; server hardening that limits SHOW GRANTS; expired credentials/kerberos ticket causing the query to fail; auth plugin incompatibility (e.g. caching_sha2_password vs older driver).

Understand the failure class

Background: "query failed", "%w: SQL error" — wrapped database query errors in Go libraries explained — this error's family across 3 libraries.

Related errors

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/c8ccab5933bca8f0. Report an issue: GitHub.