> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/server/reference/error-codes/mariadb-error-codes-1600-to-1699/e1698.md).

# Error 1698: Access denied for user

| Error Code | SQLSTATE | Error                                   | Description                      |
| ---------- | -------- | --------------------------------------- | -------------------------------- |
| 1698       | 28000    | ER\_ACCESS\_DENIED\_NO\_PASSWORD\_ERROR | Access denied for user '%s'@'%s' |

## Possible Causes and Solutions

This error is the variant of [error 1045](/docs/server/reference/error-codes/mariadb-error-codes-1000-to-1099/e1045.md) for authentication that doesn't use a password. It has no `using password` part, because no password was checked.

### Login With the unix\_socket Plugin

Most often, the account authenticates with the [unix\_socket](/docs/server/reference/plugins/authentication-plugins/authentication-plugin-unix-socket.md) plugin, and the operating system user who runs the client isn't the one the account expects. A password on the command line makes no difference, because the plugin doesn't check it.

The `root@localhost` account that [mariadb-install-db](/docs/server/clients-and-utilities/deployment-tools/mariadb-install-db.md) creates by default works like this: it accepts the operating system user `root` through `unix_socket`, and has no usable password. So connecting as `root` from another operating system user fails, with or without a password:

```
$ mariadb -u root
ERROR 1698 (28000): Access denied for user 'root'@'localhost'
$ mariadb -u root -pguess
ERROR 1698 (28000): Access denied for user 'root'@'localhost'
```

To solve the error:

* Run the client as the operating system user the account expects, for example `sudo mariadb` for `root`.
* Or connect with an account that matches your own operating system user, for example one created with `CREATE USER 'alice'@'localhost' IDENTIFIED VIA unix_socket;` for the operating system user `alice`. From MariaDB 11.6, an account created `IDENTIFIED VIA unix_socket AS 'alice'` accepts the operating system user `alice` under any account name.
* Or give the account a password as an additional authentication method. As a user who can log in, run `ALTER USER 'root'@'localhost' IDENTIFIED VIA unix_socket OR mysql_native_password USING PASSWORD('…');`. See [Switching to Password-Based Authentication](/docs/server/reference/plugins/authentication-plugins/authentication-plugin-unix-socket.md#switching-to-password-based-authentication).

On Windows, the [named\_pipe](/docs/server/reference/plugins/authentication-plugins/authentication-plugin-named-pipe.md) plugin gives the same error when the Windows user doesn't match.

### Statements That Need More Privileges

The server also returns this error, with the name of the current account, for some statements after the login:

* `GRANT role TO …` when you don't have the `ADMIN OPTION` for the [role](/docs/server/security/user-account-management/roles.md).
* [GRANT PROXY](/docs/server/reference/sql-statements/account-management-sql-statements/grant.md#proxy-privileges) when you don't have the `PROXY` privilege on that account `WITH GRANT OPTION`.

```
$ mariadb -u g -p -e "GRANT r1 TO t@localhost"
ERROR 1698 (28000) at line 1: Access denied for user 'g'@'localhost'
```

For other connection problems, see [Troubleshooting Connection Issues](/docs/server/mariadb-quickstart-guides/mariadb-connection-troubleshooting-guide.md).

## See Also

* [When access\_denied\_errors status variable is incremented](/docs/server/security/user-account-management/incrementing-of-the-access_denied_errors-status-variable.md)

<sub>*This page is licensed: CC BY-SA / Gnu FDL*</sub>

{% @marketo/form formId="4316" %}