--- title: "备租户用户无法登录，报错：ERROR 1396 (HY000): Operation LOCK USER failed 的原因和解决方法-OceanBase数据库使用指南" description: "了解OceanBase数据库在实际应用中关于备租户用户无法登录，报错：ERROR 1396 (HY000): Operation LOCK USER failed 的原因和解决方法相关的常见问题和使用技巧，帮助您快速解决备租户用户无法登录，报错：ERROR 1396 (HY000): Operation LOCK USER failed 的原因和解决方法的难题。" image: https://mdn.alipayobjects.com/huamei_22khvb/afts/img/A*OSPzQ6GUQF4AAAAAQHAAAAgAeiGDAQ/original --- 切换语言 - 中文站 - 简体中文 - International - English - 日本站 - 日本語 划线反馈 # 备租户用户无法登录，报错：ERROR 1396 (HY000): Operation LOCK USER failed 的原因和解决方法 更新时间：2026-07-02 15:41 适用版本： V4.0.x、V4.1.x、V4.2.x、V4.3.x、V4.4.x 内容类型：Troubleshoot ## 问题现象 OceanBase 备租户下的某个用户无法登录并报错，示例如下： ```shell mysql -hxxx.xxx.xxx.xxx -P2881 -utestuser@obmysql2 -pxxxxxxxx -A -c -Doceanbase ERROR 1396 (HY000): Operation LOCK USER failed for 'testuser'@'%' ``` 显示用户无法锁定，实际上备租户的用户是无法独立执行锁定的，必须从主租户同步锁定操作，而主租户并没有执行过锁定操作。 查看 observer.log，能看到如下信息： ```shell [2025-09-27 14:01:29.037191] WDIAG lock_user (ob_user_cmd_executor.cpp:535) [7215][T1002_MysqlQueu][T1002][xxxxx-xxxxx-xxxxx-xxxxx] [lt=23][errcode=-5155] Operation LOCK USER failed for 'testuser'@'%' [2025-09-27 14:01:29.037199] WDIAG [SQL.ENG] execute (ob_user_cmd_executor.cpp:491) [7215][T1002_MysqlQueu][T1002][xxxxx-xxxxx-xxxxx-xxxxx] [lt=7][errcode=-5155] Rename user completely failed(arg={tenant_id:1002, users:["testuser"], hosts:["%"], locked:true}, ret=-5155) [2025-09-27 14:01:29.037255] WDIAG [SERVER] do_query (ob_inner_sql_connection.cpp:799) [7215][T1002_MysqlQueu][T1002][xxxxx-xxxxx-xxxxx-xxxxx] [lt=4][errcode=-5155] result set open failed(ret=-5155, executor={ObIExecutor:, sql:"ALTER USER 'testuser'@'%' ACCOUNT LOCK"}) [2025-09-27 14:01:29.037346] WDIAG [SERVER] query (ob_inner_sql_connection.cpp:944) [7215][T1002_MysqlQueu][T1002][xxxxx-xxxxx-xxxxx-xxxxx] [lt=11][errcode=-5155] execute failed(ret=-5155, tenant_id=1002, executor={ObIExecutor:, sql:"ALTER USER 'testuser'@'%' ACCOUNT LOCK"}, retry_cnt=0, local_sys_schema_version=1758271726590016, local_tenant_schema_version=1758952223311288) [2025-09-27 14:01:29.037396] WDIAG [SERVER] query (ob_inner_sql_connection.cpp:979) [7215][T1002_MysqlQueu][T1002][xxxxx-xxxxx-xxxxx-xxxxx] [lt=5][errcode=-5155] failed to process record(executor={ObIExecutor:, sql:"ALTER USER 'testuser'@'%' ACCOUNT LOCK"}, record_ret=-5155, ret=-5155) [2025-09-27 14:01:29.037409] WDIAG [SERVER] query (ob_inner_sql_connection.cpp:1016) [7215][T1002_MysqlQueu][T1002][xxxxx-xxxxx-xxxxx-xxxxx] [lt=5][errcode=-5155] failed to process final(executor={ObIExecutor:, sql:"ALTER USER 'testuser'@'%' ACCOUNT LOCK"}, aret=-5155, ret=-5155) [2025-09-27 14:01:29.037415] WDIAG [SERVER] execute_write_inner (ob_inner_sql_connection.cpp:1583) [7215][T1002_MysqlQueu][T1002][Y0-0000000000000000-0-0] [lt=5][errcode=-5155] execute sql failed(ret=-5155, tenant_id=1002, sql=ALTER USER 'testuser'@'%' ACCOUNT LOCK) [2025-09-27 14:01:29.037438] WDIAG [SERVER] execute_write (ob_inner_sql_connection.cpp:1536) [7215][T1002_MysqlQueu][T1002][Y0-0000000000000000-0-0] [lt=6][errcode=-5155] execute_write failed(ret=-5155, tenant_id=1002, sql=ALTER USER 'testuser'@'%' ACCOUNT LOCK, is_user_sql=false) [2025-09-27 14:01:29.037444] WDIAG [COMMON.MYSQLP] write (ob_mysql_proxy.cpp:240) [7215][T1002_MysqlQueu][T1002][Y0-0000000000000000-0-0] [lt=5][errcode=-5155] execute sql failed(ret=-5155, tenant_id=1002, conn=0x7fafdd0b2d90, start=1758952889032722, sql=ALTER USER 'testuser'@'%' ACCOUNT LOCK) [2025-09-27 14:01:29.037516] INFO [SERVER] switch_lock_status_for_user (obmp_connect.cpp:1042) [7215][T1002_MysqlQueu][T1002][Y0-0000000000000000-0-0] [lt=6] user ddl has been sent, change user lock status to (tenant_id=1002, user_name_=testuser, host_name=%, do_lock=true) [2025-09-27 14:01:29.038109] INFO [SERVER] process (obmp_connect.cpp:537) [7215][T1002_MysqlQueu][T1002][Y0-0000000000000000-0-0] [lt=4] MySQL LOGIN(direct_client_ip="xxx.xxx.xxx.xxx", client_ip=xxx.xxx.xxx.xxx, tenant_name=obmysql2, tenant_id=1002, user_name=testuser, host_name=xxx.xxx.xxx.xxx, sessid=3221589748, proxy_sessid=0, client_sessid=3221589748, from_proxy=false, from_java_client=false, from_oci_client=false, from_jdbc_client=false, capability=537896589, proxy_capability=0, use_ssl=false, c/s protocol="OB_MYSQL_CS_TYPE", autocommit=false, proc_ret=-5155, ret=-5155, conn->client_type_=3, conn->client_version_=0) ``` ## 问题原因 首先，该用户无法登录的根本原因是备租户设置了安全策略，登录用户租户的 root 用户，执行如下语句。 ```sql -- 查看其值，若不为 0 就有可能是这个问题。若为 0 就不是这个问题，假设输出值为 5 show parameters like 'connection_control_failed_connections_threshold'; ``` 表示用户失败登录 5 次后会被锁定，而用户的确有 5 次登录密码输入错误，因此无法登录。但是备租户的用户无法独立执行锁定操作，所以执行这样的操作就会出现 `Operation LOCK USER failed`，也就是登录时提示的错误。 ## 问题的风险及影响 备租户用户无法登录，报错信息不明显。登录成功后失败次数不清 0。 ## 适用版本 OceanBase 数据库 V4.x 版本。 ## 解决方法 临时将 `connection_control_failed_connections_threshold` 设为 0，使得用户可以成功登录。 ```sql # 登陆用户租户的 root 用户执行 alter system set connection_control_failed_connections_threshold=0; # 也可以登陆系统租户执行，这里 xxx 是用户租户的租户名 alter system set connection_control_failed_connections_threshold=0 tenant=xxx; ``` 此处由于备租户在当前版本下的一个限制（主租户不会有这个限制），即使成功登录后也不能重置之前的登录失败次数： ```sql select tenant_id,user_id,user_name,failed_login_attempts from __ALL_virtual_TENANT_USER_FAILED_LOGIN_STAT; +-----------+---------+-----------+-----------------------+ | tenant_id | user_id | user_name | failed_login_attempts | +-----------+---------+-----------+-----------------------+ | 1002 | 500004 | testuser | 4 | +-----------+---------+-----------+-----------------------+ 1 row in set (0.00 sec) ``` 因此需要通过手动重置登录失败次数，步骤如下： -- 检查连接的 OBServer 上有租户资源，可以通过如下语句 -- 获取有租户资源的机器，其中 xxx 改为租户 id select a.svr_ip,b.sql_port from oceanbase.dba_ob_units a, oceanbase.dba_ob_servers b where tenant_id=xxx and a.svr_ip=b.svr_ip and a.svr_port=b.svr_port; ```sql -- 以备租户所在集群的 root@sys 用户登录，直连 OBServer，不能通过 OBProxy 连接 mysql -hxxx.xxx.xxx.xxx -P2881 -utestuser@obmysql2 -pxxxxxxxx -A -c -Doceanbase -- 切换到该租户的 Meta 租户 alter system change tenant tenant_id = 1001 -- 再次确认该用户的失败登录次数、tenant_id、user_id select * from __ALL_TENANT_USER_FAILED_LOGIN_STAT where tenant_id=1002 and user_id=500004; -- 进行清理，可以是 delete，也可以是 update delete from __ALL_TENANT_USER_FAILED_LOGIN_STAT where tenant_id=1002 and user_id=500004; update __ALL_TENANT_USER_FAILED_LOGIN_STAT set failed_login_attempts=0 where tenant_id=1002 and user_id=500004; ``` #### 警告 修改内部表存在一定的风险，请勿自行操作。如果需要修改，请联系 OceanBase 技术支持团队。 ## 规避方式 无。 上一篇 [缩小租户规格时遇到报错 requested memory over 90% 的原因和解决方法](https://www.oceanbase.com/knowledge-base/oceanbase-database-1000000003796389) 下一篇 [新增租户级别配置项 _tenant_stack_size 并增加 stack_size 上限](https://www.oceanbase.com/knowledge-base/oceanbase-database-1000000003289569) ![有帮助](https://gw.alipayobjects.com/mdn/ob_asset/afts/img/A*y6ocSqN8cqsAAAAAAAAAAAAAARQnAQ)![无帮助](https://gw.alipayobjects.com/mdn/ob_asset/afts/img/A*BG9IQJyLHF8AAAAAAAAAAAAAARQnAQ)![反馈](https://gw.alipayobjects.com/mdn/ob_asset/afts/img/A*eTWdQKCRKHwAAAAAAAAAAAAAARQnAQ)[AI](https://www.oceanbase.com/obi) 咨询热线