Access denied: account, host, plugin, or privilege?

Understand the likely causes

• MySQL accounts match a user and host combination. The application may be reaching another endpoint, using a socket instead of TCP, or matching a different server account than expected.
• A stale secret, incompatible client plugin support, disabled authentication plugin, locked account, or missing active role requires a different correction. One error excerpt does not identify which cause applies.

Record the failing stage

Capture the exact error code, client version, intended endpoint, transport, requested username, and whether any SQL statement succeeded. Redact passwords and connection strings. An unreachable endpoint or TLS certificate failure is not evidence that table grants are wrong. If login fails, the following SQL cannot be run through that failed connection; use existing authorized administrative diagnostics instead.

Check the account that actually matched

After an authorized login succeeds, compare the client identity with the privilege-checking account and active roles. A role may be granted but inactive. These are inspection queries only; results depend on the connection and should not be copied into public issue reports.

SELECT VERSION(),USER(),CURRENT_USER(),CURRENT_ROLE();
SHOW GRANTS FOR CURRENT_USER;

Have an administrator inspect matching rows

An authorized administrator can inspect only the relevant account rows, without selecting password hashes. Check exact host scope, account locking, and plugin compatibility with the server and connector. A localhost socket and remote TCP connection can match differently; do not add a wildcard host merely to make the error disappear.

SELECT User,Host,plugin,account_locked
FROM mysql.user WHERE User='lab_reporter' ORDER BY Host;

Apply the correction supported by evidence

For stale credentials, use the established rotation process and refresh connection pools. For endpoint or host mismatch, correct routing or the narrowly intended account definition. MySQL 8.4 disables mysql_native_password by default and normally uses caching_sha2_password; prefer a compatible updated connector and a reviewed account migration rather than enabling legacy authentication indiscriminately. For authorization failures, request only the missing relation privilege or role activation.

Keep transport verification intact

A TCP client using caching_sha2_password must satisfy the documented secure-transport or RSA exchange requirements. Validate server certificates through the connector configuration; do not disable verification to diagnose a password. SHOW SESSION STATUS LIKE 'Ssl_cipher' can help inspect a successful TLS session, while local socket transport follows a different security context.

Keep it from recurring

• Inventory server and connector versions, test credential rotation, separate migration and runtime accounts, and retain host-scoped least-privilege grants. MySQL and MariaDB plugin and role behavior must be reviewed separately.