How to fix phpMyAdmin error 1045 access denied

MySQL error 1045 means the database server rejected the credentials and connection origin presented by phpMyAdmin. The message names both values because 'guide_operator'@'localhost' and 'guide_operator'@'198.51.100.20' are separate database accounts even though they share a username.

This repair targets phpMyAdmin cookie authentication when a read-only account exists only for localhost but phpMyAdmin connects from another host or container. If the account row already matches the source shown in error 1045, the password, account lock, or authentication plugin is the more likely cause.

The exact-host account receives a new credential and only SELECT on the application database. The old password must not remain in the phpMyAdmin login form; a successful session must identify the new account origin, reject the mysql system database, and return data from the permitted application database.

1. Record the account identity shown in phpMyAdmin error 1045.
2. Open an approved administrative MariaDB session on the database server.

   $ mariadb --user=root --password

   Password-based administrator login is shown. Servers configured for Unix-socket administrator authentication commonly provide the equivalent local administrative session through sudo mariadb.

3. List the account-host rows for the rejected database user.

   MariaDB [(none)]> SELECT User, Host FROM mysql.user WHERE User = 'guide_operator';
   +----------------+-----------+
   | User           | Host      |
   +----------------+-----------+
   | guide_operator | localhost |
   +----------------+-----------+

   The missing 198.51.100.20 row matches the phpMyAdmin source named in error 1045. The address is a documentation example; the reported source from the failing login is the required host value.

4. Inspect the localhost account's grants to confirm its read-only database scope.

   MariaDB [(none)]> SHOW GRANTS FOR 'guide_operator'@'localhost';
   ##### snipped #####
   GRANT SELECT ON `inventory_app`.* TO `guide_operator`@`localhost`

   The displayed database-level line defines the scope reproduced for the exact-host account. Global, administrative, or write privileges require their own least-privilege decision.

5. Create the read-only account for the exact phpMyAdmin source host with a new strong password.

   MariaDB [(none)]> CREATE USER 'guide_operator'@'198.51.100.20' IDENTIFIED BY '<new-strong-password>';

   The password token represents the unique credential entered later in phpMyAdmin. A % host would admit clients beyond the recorded phpMyAdmin source.

6. Grant SELECT on the application database to the new exact-host account.

   MariaDB [(none)]> GRANT SELECT ON inventory_app.* TO 'guide_operator'@'198.51.100.20';

   Related: How to grant database privileges in phpMyAdmin

7. Exit the administrative MariaDB session.

   MariaDB [(none)]> exit
   Bye

8. Return to the phpMyAdmin login form for the repaired account.
9. Enter guide_operator in the phpMyAdmin username field.
10. Enter the new exact-host account password in the phpMyAdmin password field.
11. Submit the phpMyAdmin login form with the new exact-host account credential.
12. Open the server-level SQL tab in phpMyAdmin.
13. Enter the system-database denial query in the phpMyAdmin SQL editor.

    SELECT COUNT(*) FROM mysql.user;

    

14. Run the system-database query in phpMyAdmin.
15. Select inventory_app in the phpMyAdmin navigation tree.
16. Open the database-level SQL tab in phpMyAdmin.
17. Enter the read-only application query in the phpMyAdmin SQL editor.

    SELECT CURRENT_USER(), DATABASE(), COUNT(*) AS visible_devices FROM devices;

    

18. Run the application query in phpMyAdmin.