try to fix IS_ROLE

Signed-off-by: Sebastian Gumprich <[email protected]>

roles/mysql_hardening/tasks/mysql_secure_installation.yml

@@ -49,15 +49,20 @@
 - name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
   community.mysql.mysql_query:
     query: >
-      SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
-      FROM mysql.user
-      WHERE (length(authentication_string)=0
-             OR authentication_string="")
-        AND USER NOT IN ('mysql.sys',
-                         'mysqlxsys',
-                         'mariadb.sys')
-        AND ('IS_ROLE' NOT IN (SELECT column_name FROM information_schema.columns WHERE table_name = 'user')
-        OR IFNULL(IS_ROLE, 'N') = 'N');
+      SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS USER
+      FROM mysql.user u
+      LEFT JOIN INFORMATION_SCHEMA.COLUMNS c ON c.TABLE_SCHEMA = 'mysql'
+      AND c.TABLE_NAME = 'user'
+      AND c.COLUMN_NAME = 'IS_ROLE'
+      WHERE (u.authentication_string = ''
+             OR u.authentication_string IS NULL)
+        AND (length(password)=0
+             OR password="")
+        AND u.user NOT IN ('mysql.sys',
+                           'mysqlxsys',
+                           'mariadb.sys')
+        AND (c.COLUMN_NAME IS NULL
+             OR COALESCE(u.IS_ROLE, 'N') = 'N');
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_users_wo_passwords_or_auth_string
   check_mode: false
@@ -69,7 +74,7 @@
 - name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
   community.mysql.mysql_query:
     query: >
-      SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
+      SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS USER
       FROM mysql.user
       WHERE (length(password)=0
              OR password="")
@@ -78,7 +83,10 @@
         AND USER NOT IN ('mysql.sys',
                          'mysqlxsys',
                          'mariadb.sys')
-        AND 'IS_ROLE' NOT IN (SELECT column_name FROM information_schema.columns WHERE table_name = 'user');
+        AND 'IS_ROLE' NOT IN
+          (SELECT COLUMN_NAME
+           FROM information_schema.columns
+           WHERE TABLE_NAME = 'user');
     login_unix_socket: "{{ login_unix_socket | default(omit) }}"
   register: mysql_users_wo_passwords
   check_mode: false