<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="create-user">
      </a>
      15.7.1.3 CREATE USER Statement
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045174571200">
  </a>
  <a class="indexterm" name="idm46045174570128">
  </a>
  <a class="indexterm" name="idm46045174568640">
  </a>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa14368259"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token punctuation">[</span><span class="token keyword">IF</span> <span class="token operator">NOT</span> <span class="token keyword">EXISTS</span><span class="token punctuation">]</span>
    <span class="token keyword"><em class="replaceable">user</em></span> <span class="token punctuation">[</span><em class="replaceable">auth_option</em><span class="token punctuation">]</span> <span class="token punctuation">[</span><span class="token punctuation">,</span> <span class="token keyword"><em class="replaceable">user</em></span> <span class="token punctuation">[</span><em class="replaceable">auth_option</em><span class="token punctuation">]</span><span class="token punctuation">]</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span>
    <span class="token keyword">DEFAULT</span> <span class="token keyword">ROLE</span> <span class="token keyword"><em class="replaceable">role</em></span> <span class="token punctuation">[</span><span class="token punctuation">,</span> <span class="token keyword"><em class="replaceable">role</em></span> <span class="token punctuation">]</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span>
    <span class="token punctuation">[</span><span class="token keyword">REQUIRE</span> {<span class="token keyword">NONE</span> <span class="token operator">|</span> <em class="replaceable">tls_option</em> <span class="token punctuation">[</span><span class="token punctuation">[</span><span class="token operator">AND</span><span class="token punctuation">]</span> <em class="replaceable">tls_option</em><span class="token punctuation">]</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span>}<span class="token punctuation">]</span>
    <span class="token punctuation">[</span><span class="token keyword">WITH</span> <em class="replaceable">resource_option</em> <span class="token punctuation">[</span><em class="replaceable">resource_option</em><span class="token punctuation">]</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">]</span>
    <span class="token punctuation">[</span><em class="replaceable">password_option</em> <span class="token operator">|</span> <em class="replaceable">lock_option</em><span class="token punctuation">]</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span>
    <span class="token punctuation">[</span><span class="token keyword">COMMENT</span> <span class="token string">'<em class="replaceable">comment_string</em>'</span> <span class="token operator">|</span> <span class="token keyword">ATTRIBUTE</span> <span class="token string">'<em class="replaceable">json_object</em>'</span><span class="token punctuation">]</span>

<span class="token keyword"><em class="replaceable">user</em></span>:
    <span class="token punctuation">(</span>see Section <span class="token number">8.2</span><span class="token punctuation">.</span><span class="token number">4</span><span class="token punctuation">,</span> “Specifying <span class="token keyword">Account</span> <span class="token keyword">Names</span>”<span class="token punctuation">)</span>

<em class="replaceable">auth_option</em>: {
    <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span> <span class="token punctuation">[</span><span class="token operator">AND</span> <em class="replaceable">2fa_auth_option</em><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span> <span class="token punctuation">[</span><span class="token operator">AND</span> <em class="replaceable">2fa_auth_option</em><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token punctuation">[</span><span class="token operator">AND</span> <em class="replaceable">2fa_auth_option</em><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span> <span class="token punctuation">[</span><span class="token operator">AND</span> <em class="replaceable">2fa_auth_option</em><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token keyword">BY</span> <span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span> <span class="token punctuation">[</span><span class="token operator">AND</span> <em class="replaceable">2fa_auth_option</em><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token keyword">AS</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span> <span class="token punctuation">[</span><span class="token operator">AND</span> <em class="replaceable">2fa_auth_option</em><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token punctuation">[</span><em class="replaceable">initial_auth_option</em><span class="token punctuation">]</span>
}

<em class="replaceable">2fa_auth_option</em>: {
    <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span> <span class="token punctuation">[</span><span class="token operator">AND</span> <em class="replaceable">3fa_auth_option</em><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span> <span class="token punctuation">[</span><span class="token operator">AND</span> <em class="replaceable">3fa_auth_option</em><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token punctuation">[</span><span class="token operator">AND</span> <em class="replaceable">3fa_auth_option</em><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span> <span class="token punctuation">[</span><span class="token operator">AND</span> <em class="replaceable">3fa_auth_option</em><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token keyword">BY</span> <span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span> <span class="token punctuation">[</span><span class="token operator">AND</span> <em class="replaceable">3fa_auth_option</em><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token keyword">AS</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span> <span class="token punctuation">[</span><span class="token operator">AND</span> <em class="replaceable">3fa_auth_option</em><span class="token punctuation">]</span>
}

<em class="replaceable">3fa_auth_option</em>: {
    <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token keyword">BY</span> <span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token keyword">AS</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>
}

<em class="replaceable">initial_auth_option</em>: {
    INITIAL AUTHENTICATION <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> {<span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span> <span class="token operator">|</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>}
  <span class="token operator">|</span> INITIAL AUTHENTICATION <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token keyword">AS</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>
}

<em class="replaceable">tls_option</em>: {
   <span class="token keyword">SSL</span>
 <span class="token operator">|</span> <span class="token keyword">X509</span>
 <span class="token operator">|</span> <span class="token keyword">CIPHER</span> <span class="token string">'<em class="replaceable">cipher</em>'</span>
 <span class="token operator">|</span> <span class="token keyword">ISSUER</span> <span class="token string">'<em class="replaceable">issuer</em>'</span>
 <span class="token operator">|</span> <span class="token keyword">SUBJECT</span> <span class="token string">'<em class="replaceable">subject</em>'</span>
}

<em class="replaceable">resource_option</em>: {
    <span class="token keyword">MAX_QUERIES_PER_HOUR</span> <em class="replaceable">count</em>
  <span class="token operator">|</span> <span class="token keyword">MAX_UPDATES_PER_HOUR</span> <em class="replaceable">count</em>
  <span class="token operator">|</span> <span class="token keyword">MAX_CONNECTIONS_PER_HOUR</span> <em class="replaceable">count</em>
  <span class="token operator">|</span> <span class="token keyword">MAX_USER_CONNECTIONS</span> <em class="replaceable">count</em>
}

<em class="replaceable">password_option</em>: {
    <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span> <span class="token punctuation">[</span><span class="token keyword">DEFAULT</span> <span class="token operator">|</span> <span class="token keyword">NEVER</span> <span class="token operator">|</span> <span class="token keyword">INTERVAL</span> <em class="replaceable">N</em> <span class="token keyword">DAY</span><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">HISTORY</span> {<span class="token keyword">DEFAULT</span> <span class="token operator">|</span> <em class="replaceable">N</em>}
  <span class="token operator">|</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REUSE</span> <span class="token keyword">INTERVAL</span> {<span class="token keyword">DEFAULT</span> <span class="token operator">|</span> <em class="replaceable">N</em> <span class="token keyword">DAY</span>}
  <span class="token operator">|</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">CURRENT</span> <span class="token punctuation">[</span><span class="token keyword">DEFAULT</span> <span class="token operator">|</span> <span class="token keyword">OPTIONAL</span><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">FAILED_LOGIN_ATTEMPTS</span> <em class="replaceable">N</em>
  <span class="token operator">|</span> <span class="token keyword">PASSWORD_LOCK_TIME</span> {<em class="replaceable">N</em> <span class="token operator">|</span> <span class="token keyword">UNBOUNDED</span>}
}

<em class="replaceable">lock_option</em>: {
    <span class="token keyword">ACCOUNT</span> <span class="token keyword">LOCK</span>
  <span class="token operator">|</span> <span class="token keyword">ACCOUNT</span> <span class="token keyword">UNLOCK</span>
}</code></pre>
  </div>
  <p>
   The
   <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
    <code class="literal">
     CREATE USER
    </code>
   </a>
   statement creates
        new MySQL accounts. It enables authentication, role, SSL/TLS,
        resource-limit, password-management, comment, and attribute
        properties to be established for new accounts. It also controls
        whether accounts are initially locked or unlocked.
  </p>
  <p>
   To use
   <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
    <code class="literal">
     CREATE USER
    </code>
   </a>
   , you must have
        the global
   <a class="link" href="privileges-provided.html#priv_create-user">
    <code class="literal">
     CREATE USER
    </code>
   </a>
   privilege,
        or the
   <a class="link" href="privileges-provided.html#priv_insert">
    <code class="literal">
     INSERT
    </code>
   </a>
   privilege for the
   <code class="literal">
    mysql
   </code>
   system schema. When the
   <a class="link" href="server-system-variables.html#sysvar_read_only">
    <code class="literal">
     read_only
    </code>
   </a>
   system variable is
        enabled,
   <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
    <code class="literal">
     CREATE USER
    </code>
   </a>
   additionally
        requires the
   <a class="link" href="privileges-provided.html#priv_connection-admin">
    <code class="literal">
     CONNECTION_ADMIN
    </code>
   </a>
   privilege (or the deprecated
   <a class="link" href="privileges-provided.html#priv_super">
    <code class="literal">
     SUPER
    </code>
   </a>
   privilege).
  </p>
  <p>
   These additional privilege considerations also apply:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      The
      <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
       <code class="literal">
        authentication_policy
       </code>
      </a>
      system variable places certain constraints on how the
            authentication-related clauses of
      <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
       <code class="literal">
        CREATE USER
       </code>
      </a>
      statements may be
            used; for details, see the description of that variable.
            These constraints do not apply if you have the
      <a class="link" href="privileges-provided.html#priv_authentication-policy-admin">
       <code class="literal">
        AUTHENTICATION_POLICY_ADMIN
       </code>
      </a>
      privilege.
     </p>
    </li>
    <li class="listitem">
     <p>
      To create an account that uses passwordless authentication,
            you must have the
      <a class="link" href="privileges-provided.html#priv_passwordless-user-admin">
       <code class="literal">
        PASSWORDLESS_USER_ADMIN
       </code>
      </a>
      privilege.
     </p>
    </li>
   </ul>
  </div>
  <p>
   <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
    <code class="literal">
     CREATE USER
    </code>
   </a>
   fails with an error
        if any account to be created is named as the
   <code class="literal">
    DEFINER
   </code>
   attribute for any stored object.
        (That is, the statement fails if creating an account would cause
        the account to adopt a currently orphaned stored object.) To
        perform the operation anyway, you must have the
   <a class="link" href="privileges-provided.html#priv_set-any-definer">
    <code class="literal">
     SET_ANY_DEFINER
    </code>
   </a>
   or
   <a class="link" href="privileges-provided.html#priv_allow-nonexistent-definer">
    <code class="literal">
     ALLOW_NONEXISTENT_DEFINER
    </code>
   </a>
   privilege; in this case, the statement succeeds with a warning
        rather than failing with an error. To perform the user-creation
        operation without either of these, drop the orphan objects,
        create the account and grant its privileges, and then re-create
        the dropped objects. For additional information, including how
        to identify which objects name a given account as the
   <code class="literal">
    DEFINER
   </code>
   attribute, see
   <a class="xref" href="stored-objects-security.html#stored-objects-security-orphan-objects" title="Orphan Stored Objects">
    Orphan Stored Objects
   </a>
   .
  </p>
  <p>
   <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
    <code class="literal">
     CREATE USER
    </code>
   </a>
   either succeeds for
        all named users or rolls back and has no effect if any error
        occurs. By default, an error occurs if you try to create a user
        that already exists. If the
   <code class="literal">
    IF NOT EXISTS
   </code>
   clause is given, the statement produces a warning for each named
        user that already exists, rather than an error.
  </p>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    Under some circumstances,
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE
          USER
     </code>
    </a>
    may be recorded in server logs or on the client
          side in a history file such as
    <code class="filename">
     ~/.mysql_history
    </code>
    , which means that
          cleartext passwords may be read by anyone having read access
          to that information. For information about the conditions
          under which this occurs for the server logs and how to control
          it, see
    <a class="xref" href="password-logging.html" title="8.1.2.3 Passwords and Logging">
     Section 8.1.2.3, “Passwords and Logging”
    </a>
    . For similar
          information about client-side logging, see
    <a class="xref" href="mysql-logging.html" title="6.5.1.3 mysql Client Logging">
     Section 6.5.1.3, “mysql Client Logging”
    </a>
    .
   </p>
  </div>
  <p>
   There are several aspects to the
   <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
    <code class="literal">
     CREATE
        USER
    </code>
   </a>
   statement, described under the following topics:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="create-user.html#create-user-overview" title="CREATE USER Overview">
       CREATE USER Overview
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="create-user.html#create-user-authentication" title="CREATE USER Authentication Options">
       CREATE USER Authentication Options
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="create-user.html#create-user-multifactor-authentication" title="CREATE USER Multifactor Authentication Options">
       CREATE USER Multifactor Authentication Options
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="create-user.html#create-user-role" title="CREATE USER Role Options">
       CREATE USER Role Options
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="create-user.html#create-user-tls" title="CREATE USER SSL/TLS Options">
       CREATE USER SSL/TLS Options
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="create-user.html#create-user-resource-limits" title="CREATE USER Resource-Limit Options">
       CREATE USER Resource-Limit Options
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="create-user.html#create-user-password-management" title="CREATE USER Password-Management Options">
       CREATE USER Password-Management Options
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="create-user.html#create-user-comments-attributes" title="CREATE USER Comment and Attribute Options">
       CREATE USER Comment and Attribute Options
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="create-user.html#create-user-account-locking" title="CREATE USER Account-Locking Options">
       CREATE USER Account-Locking Options
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="create-user.html#create-user-binary-logging" title="CREATE USER Binary Logging">
       CREATE USER Binary Logging
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="create-user-overview">
       </a>
       CREATE USER Overview
      </h5>
     </div>
    </div>
   </div>
   <p>
    For each account,
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    creates a new row in the
    <code class="literal">
     mysql.user
    </code>
    system
          table. The account row reflects the properties specified in
          the statement. Unspecified properties are set to their default
          values:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Authentication: The default authentication plugin
              (determined as described in
       <a class="xref" href="pluggable-authentication.html#pluggable-authentication-default-plugin" title="The Default Authentication Plugin">
        The Default Authentication Plugin
       </a>
       ),
              and empty credentials
      </p>
     </li>
     <li class="listitem">
      <p>
       Default role:
       <code class="literal">
        NONE
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       SSL/TLS:
       <code class="literal">
        NONE
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       Resource limits: Unlimited
      </p>
     </li>
     <li class="listitem">
      <p>
       Password management:
       <code class="literal">
        PASSWORD EXPIRE DEFAULT
              PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT
              PASSWORD REQUIRE CURRENT DEFAULT
       </code>
       ; failed-login
              tracking and temporary account locking are disabled
      </p>
     </li>
     <li class="listitem">
      <p>
       Account locking:
       <code class="literal">
        ACCOUNT UNLOCK
       </code>
      </p>
     </li>
    </ul>
   </div>
   <p>
    An account when first created has no privileges and the
          default role
    <code class="literal">
     NONE
    </code>
    . To assign privileges or
          roles to this account, use one or more
    <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
     <code class="literal">
      GRANT
     </code>
    </a>
    statements.
   </p>
   <p>
    Each account name uses the format described in
    <a class="xref" href="account-names.html" title="8.2.4 Specifying Account Names">
     Section 8.2.4, “Specifying Account Names”
    </a>
    . For example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa85234469"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    The host name part of the account name, if omitted, defaults
          to
    <code class="literal">
     '%'
    </code>
    . You should be aware that, while
          MySQL 8.4 treats grants made to such a user as
          though they had been granted to
    <code class="literal">
     '
     <em class="replaceable">
      <code>
       user
      </code>
     </em>
     '@'localhost'
    </code>
    ,
          this behavior is deprecated, and thus subject to removal in a
          future version of MySQL.
   </p>
   <p>
    Each
    <em class="replaceable">
     <code>
      user
     </code>
    </em>
    value naming an account
          may be followed by an optional
    <em class="replaceable">
     <code>
      auth_option
     </code>
    </em>
    value that indicates
          how the account authenticates. These values enable account
          authentication plugins and credentials (for example, a
          password) to be specified. Each
    <em class="replaceable">
     <code>
      auth_option
     </code>
    </em>
    value applies
    <span class="emphasis">
     <em>
      only
     </em>
    </span>
    to the account named immediately
          preceding it.
   </p>
   <p>
    Following the
    <em class="replaceable">
     <code>
      user
     </code>
    </em>
    specifications,
          the statement may include options for SSL/TLS, resource-limit,
          password-management, and locking properties. All such options
          are
    <span class="emphasis">
     <em>
      global
     </em>
    </span>
    to the statement and apply to
    <span class="emphasis">
     <em>
      all
     </em>
    </span>
    accounts named in the statement.
   </p>
   <p>
    Example: Create an account that uses the default
          authentication plugin and the given password. Mark the
          password expired so that the user must choose a new one at the
          first connection to the server:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa38077291"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">new_password</em>'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Example: Create an account that uses the
    <code class="literal">
     caching_sha2_password
    </code>
    authentication plugin
          and the given password. Require that a new password be chosen
          every 180 days, and enable failed-login tracking, such that
          three consecutive incorrect passwords cause temporary account
          locking for two days:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa65383782"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> caching_sha2_password <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">new_password</em>'</span>
  <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span> <span class="token keyword">INTERVAL</span> <span class="token number">180</span> <span class="token keyword">DAY</span>
  <span class="token keyword">FAILED_LOGIN_ATTEMPTS</span> <span class="token number">3</span> <span class="token keyword">PASSWORD_LOCK_TIME</span> <span class="token number">2</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Example: Create multiple accounts, specifying some per-account
          properties and some global properties:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa60272985"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span>
  <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> mysql_native_password
                                   <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">new_password1</em>'</span><span class="token punctuation">,</span>
  <span class="token string">'jeanne'</span>@<span class="token string">'localhost'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> caching_sha2_password
                                  <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">new_password2</em>'</span>
  <span class="token keyword">REQUIRE</span> <span class="token keyword">X509</span> <span class="token keyword">WITH</span> <span class="token keyword">MAX_QUERIES_PER_HOUR</span> <span class="token number">60</span>
  <span class="token keyword">PASSWORD</span> <span class="token keyword">HISTORY</span> <span class="token number">5</span>
  <span class="token keyword">ACCOUNT</span> <span class="token keyword">LOCK</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Each
    <em class="replaceable">
     <code>
      auth_option
     </code>
    </em>
    value
          (
    <code class="literal">
     IDENTIFIED WITH ... BY
    </code>
    in this case)
          applies only to the account named immediately preceding it, so
          each account uses the immediately following authentication
          plugin and password.
   </p>
   <p>
    The remaining properties apply globally to all accounts named
          in the statement, so for both accounts:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Connections must be made using a valid X.509 certificate.
      </p>
     </li>
     <li class="listitem">
      <p>
       Up to 60 queries per hour are permitted.
      </p>
     </li>
     <li class="listitem">
      <p>
       Password changes cannot reuse any of the five most recent
              passwords.
      </p>
     </li>
     <li class="listitem">
      <p>
       The account is locked initially, so effectively it is a
              placeholder and cannot be used until an administrator
              unlocks it.
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="create-user-authentication">
       </a>
       CREATE USER Authentication Options
      </h5>
     </div>
    </div>
   </div>
   <p>
    An account name may be followed by an
    <em class="replaceable">
     <code>
      auth_option
     </code>
    </em>
    authentication option
          that specifies the account authentication plugin, credentials,
          or both.
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     MySQL 8.4 supports multifactor authentication
            (MFA), such that accounts can have up to three
            authentication methods. That is, accounts can use two-factor
            authentication (2FA) or three-factor authentication (3FA).
            The syntax and semantics of
     <em class="replaceable">
      <code>
       auth_option
      </code>
     </em>
     remain unchanged, but
     <em class="replaceable">
      <code>
       auth_option
      </code>
     </em>
     may be followed by
            specifications for additional authentication methods. This
            section describes
     <em class="replaceable">
      <code>
       auth_option
      </code>
     </em>
     .
            For details about the optional MFA-related following
            clauses, see
     <a class="xref" href="create-user.html#create-user-multifactor-authentication" title="CREATE USER Multifactor Authentication Options">
      CREATE USER Multifactor Authentication Options
     </a>
     .
    </p>
   </div>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     Clauses for random password generation apply only to
            accounts that use an authentication plugin that stores
            credentials internally to MySQL. For accounts that use a
            plugin that performs authentication against a credentials
            system that is external to MySQL, password management must
            be handled externally against that system as well. For more
            information about internal credentials storage, see
     <a class="xref" href="password-management.html" title="8.2.15 Password Management">
      Section 8.2.15, “Password Management”
     </a>
     .
    </p>
   </div>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <em class="replaceable">
        <code>
         auth_plugin
        </code>
       </em>
       names an
              authentication plugin. The plugin name can be a quoted
              string literal or an unquoted name. Plugin names are
              stored in the
       <code class="literal">
        plugin
       </code>
       column of the
       <code class="literal">
        mysql.user
       </code>
       system table.
      </p>
      <p>
       For
       <em class="replaceable">
        <code>
         auth_option
        </code>
       </em>
       syntax that
              does not specify an authentication plugin, the server
              assigns the default plugin, determined as described in
       <a class="xref" href="pluggable-authentication.html#pluggable-authentication-default-plugin" title="The Default Authentication Plugin">
        The Default Authentication Plugin
       </a>
       .
              For descriptions of each plugin, see
       <a class="xref" href="authentication-plugins.html" title="8.4.1 Authentication Plugins">
        Section 8.4.1, “Authentication Plugins”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       Credentials that are stored internally are stored in the
       <code class="literal">
        mysql.user
       </code>
       system table. An
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          auth_string
         </code>
        </em>
        '
       </code>
       value or
       <code class="literal">
        RANDOM PASSWORD
       </code>
       specifies
              account credentials, either as a cleartext (unencrypted)
              string or hashed in the format expected by the
              authentication plugin associated with the account,
              respectively:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          For syntax that uses
          <code class="literal">
           BY
                  '
           <em class="replaceable">
            <code>
             auth_string
            </code>
           </em>
           '
          </code>
          ,
                  the string is cleartext and is passed to the
                  authentication plugin for possible hashing. The result
                  returned by the plugin is stored in the
          <code class="literal">
           mysql.user
          </code>
          table. A plugin may use
                  the value as specified, in which case no hashing
                  occurs.
         </p>
        </li>
        <li class="listitem">
         <p>
          For syntax that uses
          <code class="literal">
           BY RANDOM
                  PASSWORD
          </code>
          , MySQL generates a random password
                  and as cleartext and passes it to the authentication
                  plugin for possible hashing. The result returned by
                  the plugin is stored in the
          <code class="literal">
           mysql.user
          </code>
          table. A plugin may use
                  the value as specified, in which case no hashing
                  occurs.
         </p>
         <p>
          Randomly generated passwords have the characteristics
                  described in
          <a class="xref" href="password-management.html#random-password-generation" title="Random Password Generation">
           Random Password Generation
          </a>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          For syntax that uses
          <code class="literal">
           AS
                  '
           <em class="replaceable">
            <code>
             auth_string
            </code>
           </em>
           '
          </code>
          ,
                  the string is assumed to be already in the format the
                  authentication plugin requires, and is stored as is in
                  the
          <code class="literal">
           mysql.user
          </code>
          table. If a plugin
                  requires a hashed value, the value must be already
                  hashed in a format appropriate for the plugin;
                  otherwise, the value cannot be used by the plugin and
                  correct authentication of client connections does not
                  occur.
         </p>
         <p>
          A hashed string can be either a string literal or a
                  hexadecimal value. The latter corresponds to the type
                  of value displayed by
          <a class="link" href="show-create-user.html" title="15.7.7.13 SHOW CREATE USER Statement">
           <code class="literal">
            SHOW CREATE
                  USER
           </code>
          </a>
          for password hashes containing
                  unprintable characters when the
          <a class="link" href="server-system-variables.html#sysvar_print_identified_with_as_hex">
           <code class="literal">
            print_identified_with_as_hex
           </code>
          </a>
          system variable is enabled.
         </p>
         <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
          <div class="admon-title">
           Important
          </div>
          <p>
           Although we show
           <code class="literal">
            '
            <em class="replaceable">
             <code>
              auth_string
             </code>
            </em>
            '
           </code>
           with quotation marks, a hexadecimal value used for
                    this purpose must
           <span class="emphasis">
            <em>
             not
            </em>
           </span>
           be
                    quoted.
          </p>
         </div>
        </li>
        <li class="listitem">
         <p>
          If an authentication plugin performs no hashing of the
                  authentication string, the
          <code class="literal">
           BY
                  '
           <em class="replaceable">
            <code>
             auth_string
            </code>
           </em>
           '
          </code>
          and
          <code class="literal">
           AS
                  '
           <em class="replaceable">
            <code>
             auth_string
            </code>
           </em>
           '
          </code>
          clauses have the same effect: The authentication
                  string is stored as is in the
          <code class="literal">
           mysql.user
          </code>
          system table.
         </p>
        </li>
       </ul>
      </div>
     </li>
    </ul>
   </div>
   <p>
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    permits these
    <em class="replaceable">
     <code>
      auth_option
     </code>
    </em>
    syntaxes:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        IDENTIFIED BY
              '
        <em class="replaceable">
         <code>
          auth_string
         </code>
        </em>
        '
       </code>
      </p>
      <p>
       Sets the account authentication plugin to the default
              plugin, passes the cleartext
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          auth_string
         </code>
        </em>
        '
       </code>
       value to the plugin for possible hashing, and stores the
              result in the account row in the
       <code class="literal">
        mysql.user
       </code>
       system table.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        IDENTIFIED BY RANDOM PASSWORD
       </code>
      </p>
      <p>
       Sets the account authentication plugin to the default
              plugin, generates a random password, passes the cleartext
              password value to the plugin for possible hashing, and
              stores the result in the account row in the
       <code class="literal">
        mysql.user
       </code>
       system table. The statement
              also returns the cleartext password in a result set to
              make it available to the user or application executing the
              statement. For details about the result set and
              characteristics of randomly generated passwords, see
       <a class="xref" href="password-management.html#random-password-generation" title="Random Password Generation">
        Random Password Generation
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        IDENTIFIED WITH
        <em class="replaceable">
         <code>
          auth_plugin
         </code>
        </em>
       </code>
      </p>
      <p>
       Sets the account authentication plugin to
       <em class="replaceable">
        <code>
         auth_plugin
        </code>
       </em>
       , clears the
              credentials to the empty string, and stores the result in
              the account row in the
       <code class="literal">
        mysql.user
       </code>
       system table.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        IDENTIFIED WITH
        <em class="replaceable">
         <code>
          auth_plugin
         </code>
        </em>
        BY
              '
        <em class="replaceable">
         <code>
          auth_string
         </code>
        </em>
        '
       </code>
      </p>
      <p>
       Sets the account authentication plugin to
       <em class="replaceable">
        <code>
         auth_plugin
        </code>
       </em>
       , passes the
              cleartext
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          auth_string
         </code>
        </em>
        '
       </code>
       value to the plugin for possible hashing, and stores the
              result in the account row in the
       <code class="literal">
        mysql.user
       </code>
       system table.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        IDENTIFIED WITH
        <em class="replaceable">
         <code>
          auth_plugin
         </code>
        </em>
        BY RANDOM
              PASSWORD
       </code>
      </p>
      <p>
       Sets the account authentication plugin to
       <em class="replaceable">
        <code>
         auth_plugin
        </code>
       </em>
       , generates a random
              password, passes the cleartext password value to the
              plugin for possible hashing, and stores the result in the
              account row in the
       <code class="literal">
        mysql.user
       </code>
       system
              table. The statement also returns the cleartext password
              in a result set to make it available to the user or
              application executing the statement. For details about the
              result set and characteristics of randomly generated
              passwords, see
       <a class="xref" href="password-management.html#random-password-generation" title="Random Password Generation">
        Random Password Generation
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        IDENTIFIED WITH
        <em class="replaceable">
         <code>
          auth_plugin
         </code>
        </em>
        AS
              '
        <em class="replaceable">
         <code>
          auth_string
         </code>
        </em>
        '
       </code>
      </p>
      <p>
       Sets the account authentication plugin to
       <em class="replaceable">
        <code>
         auth_plugin
        </code>
       </em>
       and stores the
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          auth_string
         </code>
        </em>
        '
       </code>
       value as is in the
       <code class="literal">
        mysql.user
       </code>
       account
              row. If the plugin requires a hashed string, the string is
              assumed to be already hashed in the format the plugin
              requires.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Example: Specify the password as cleartext; the default plugin
          is used:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa28954059"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Example: Specify the authentication plugin, along with a
          cleartext password value:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa22124779"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> mysql_native_password <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    In each case, the password value stored in the account row is
          the cleartext value
    <code class="literal">
     '
     <em class="replaceable">
      <code>
       password
      </code>
     </em>
     '
    </code>
    after
          it has been hashed by the authentication plugin associated
          with the account.
   </p>
   <p>
    For additional information about setting passwords and
          authentication plugins, see
    <a class="xref" href="assigning-passwords.html" title="8.2.14 Assigning Account Passwords">
     Section 8.2.14, “Assigning Account Passwords”
    </a>
    , and
    <a class="xref" href="pluggable-authentication.html" title="8.2.17 Pluggable Authentication">
     Section 8.2.17, “Pluggable Authentication”
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="create-user-multifactor-authentication">
       </a>
       CREATE USER Multifactor Authentication Options
      </h5>
     </div>
    </div>
   </div>
   <p>
    The
    <em class="replaceable">
     <code>
      auth_option
     </code>
    </em>
    part of
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    defines an
          authentication method for one-factor/single-factor
          authentication (1FA/SFA).
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE
          USER
     </code>
    </a>
    also supports multifactor authentication (MFA),
          such that accounts can have up to three authentication
          methods. That is, accounts can use two-factor authentication
          (2FA) or three-factor authentication (3FA).
   </p>
   <p>
    The
    <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
     <code class="literal">
      authentication_policy
     </code>
    </a>
    system variable defines constraints for
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    statements with
          multifactor authentication (MFA) clauses. For example, the
    <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
     <code class="literal">
      authentication_policy
     </code>
    </a>
    setting
          controls the number of authentication factors that accounts
          may have, and for each factor, which authentication methods
          are permitted. See
    <a class="xref" href="multifactor-authentication.html#multifactor-authentication-policy" title="Configuring the Multifactor Authentication Policy">
     Configuring the Multifactor Authentication Policy
    </a>
    .
   </p>
   <p>
    For information about factor-specific rules that determine the
          default authentication plugin for authentication clauses that
          name no plugin, see
    <a class="xref" href="pluggable-authentication.html#pluggable-authentication-default-plugin" title="The Default Authentication Plugin">
     The Default Authentication Plugin
    </a>
    .
   </p>
   <p>
    Following
    <em class="replaceable">
     <code>
      auth_option
     </code>
    </em>
    , there may
          appear different optional MFA clauses:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <em class="replaceable">
        <code>
         2fa_auth_option
        </code>
       </em>
       : Specifies a
              factor 2 authentication method. The following example
              defines
       <code class="literal">
        caching_sha2_password
       </code>
       as the
              factor 1 authentication method, and
       <code class="literal">
        authentication_ldap_sasl
       </code>
       as the factor
              2 authentication method.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa6816655"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'u1'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> caching_sha2_password
    <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">sha2_password</em>'</span>
  <span class="token operator">AND</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> authentication_ldap_sasl
    <span class="token keyword">AS</span> <span class="token string">'uid=u1_ldap,ou=People,dc=example,dc=com'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <em class="replaceable">
        <code>
         3fa_auth_option
        </code>
       </em>
       : Following
       <em class="replaceable">
        <code>
         2fa_auth_option
        </code>
       </em>
       , there may
              appear a
       <em class="replaceable">
        <code>
         3fa_auth_option
        </code>
       </em>
       clause
              to specify a factor 3 authentication method. The following
              example defines
       <code class="literal">
        caching_sha2_password
       </code>
       as the factor 1 authentication method,
       <code class="literal">
        authentication_ldap_sasl
       </code>
       as the factor
              2 authentication method, and
       <code class="literal">
        authentication_webauthn
       </code>
       as the factor 3
              authentication method
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa84948551"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'u1'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> caching_sha2_password
    <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">sha2_password</em>'</span>
  <span class="token operator">AND</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> authentication_ldap_sasl
    <span class="token keyword">AS</span> <span class="token string">'uid=u1_ldap,ou=People,dc=example,dc=com'</span>
  <span class="token operator">AND</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> authentication_webauthn<span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <em class="replaceable">
        <code>
         initial_auth_option
        </code>
       </em>
       : Specifies
              an initial authentication method for configuring
              FIDO/FIDO2 passwordless authentication. As shown in the
              following, temporary authentication using either a
              generated random password or a user-specified
       <em class="replaceable">
        <code>
         auth-string
        </code>
       </em>
       is required to
              enable WebAuthn passwordless authentication.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa35471304"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token keyword"><em class="replaceable">user</em></span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> authentication_webauthn
  INITIAL AUTHENTICATION <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> {<span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span> <span class="token operator">|</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>}<span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       For information about configuring passwordless
              authentication using WebAuthn pluggable authentication,
              See
       <a class="xref" href="webauthn-pluggable-authentication.html#webauthn-pluggable-authentication-passwordless" title="WebAuthn Passwordless Authentication">
        WebAuthn Passwordless Authentication
       </a>
       .
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="create-user-role">
       </a>
       CREATE USER Role Options
      </h5>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045174340704">
   </a>
   <p>
    The
    <code class="literal">
     DEFAULT ROLE
    </code>
    clause defines which roles
          become active when the user connects to the server and
          authenticates, or when the user executes the
    <a class="link" href="set-role.html" title="15.7.1.11 SET ROLE Statement">
     <code class="literal">
      SET ROLE
          DEFAULT
     </code>
    </a>
    statement during a session.
   </p>
   <p>
    Each role name uses the format described in
    <a class="xref" href="role-names.html" title="8.2.5 Specifying Role Names">
     Section 8.2.5, “Specifying Role Names”
    </a>
    . For example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa31295286"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'joe'</span>@<span class="token string">'10.0.0.1'</span> <span class="token keyword">DEFAULT</span> <span class="token keyword">ROLE</span> administrator<span class="token punctuation">,</span> developer<span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    The host name part of the role name, if omitted, defaults to
    <code class="literal">
     '%'
    </code>
    .
   </p>
   <p>
    The
    <code class="literal">
     DEFAULT ROLE
    </code>
    clause permits a list of
          one or more comma-separated role names. These roles must exist
          at the time
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    is
          executed; otherwise the statement raises an error
          (
    <a class="ulink" href="/doc/mysql-errors/8.4/en/server-error-reference.html#error_er_user_does_not_exist" target="_top">
     <code class="literal">
      ER_USER_DOES_NOT_EXIST
     </code>
    </a>
    ), and
          the user is not created.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="create-user-tls">
       </a>
       CREATE USER SSL/TLS Options
      </h5>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045174328368">
   </a>
   <a class="indexterm" name="idm46045174326912">
   </a>
   <a class="indexterm" name="idm46045174325424">
   </a>
   <p>
    MySQL can check X.509 certificate attributes in addition to
          the usual authentication that is based on the user name and
          credentials. For background information on the use of SSL/TLS
          with MySQL, see
    <a class="xref" href="encrypted-connections.html" title="8.3 Using Encrypted Connections">
     Section 8.3, “Using Encrypted Connections”
    </a>
    .
   </p>
   <p>
    To specify SSL/TLS-related options for a MySQL account, use a
    <code class="literal">
     REQUIRE
    </code>
    clause that specifies one or more
    <em class="replaceable">
     <code>
      tls_option
     </code>
    </em>
    values.
   </p>
   <p>
    Order of
    <code class="literal">
     REQUIRE
    </code>
    options does not matter,
          but no option can be specified twice. The
    <code class="literal">
     AND
    </code>
    keyword is optional between
    <code class="literal">
     REQUIRE
    </code>
    options.
   </p>
   <p>
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    permits these
    <em class="replaceable">
     <code>
      tls_option
     </code>
    </em>
    values:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        NONE
       </code>
      </p>
      <p>
       Indicates that all accounts named by the statement have no
              SSL or X.509 requirements. Unencrypted connections are
              permitted if the user name and password are valid.
              Encrypted connections can be used, at the client's option,
              if the client has the proper certificate and key files.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa52400298"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">NONE</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       Clients attempt to establish a secure connection by
              default. For clients that have
       <code class="literal">
        REQUIRE
              NONE
       </code>
       , the connection attempt falls back to an
              unencrypted connection if a secure connection cannot be
              established. To require an encrypted connection, a client
              need specify only the
       <a class="link" href="connection-options.html#option_general_ssl-mode">
        <code class="option">
         --ssl-mode=REQUIRED
        </code>
       </a>
       option; the connection attempt fails if a secure
              connection cannot be established.
      </p>
      <p>
       <code class="literal">
        NONE
       </code>
       is the default if no SSL-related
       <code class="literal">
        REQUIRE
       </code>
       options are specified.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        SSL
       </code>
      </p>
      <p>
       Tells the server to permit only encrypted connections for
              all accounts named by the statement.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa65846461"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">SSL</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       Clients attempt to establish a secure connection by
              default. For accounts that have
       <code class="literal">
        REQUIRE
              SSL
       </code>
       , the connection attempt fails if a secure
              connection cannot be established.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        X509
       </code>
      </p>
      <p>
       For all accounts named by the statement, requires that
              clients present a valid certificate, but the exact
              certificate, issuer, and subject do not matter. The only
              requirement is that it should be possible to verify its
              signature with one of the CA certificates. Use of X.509
              certificates always implies encryption, so the
       <code class="literal">
        SSL
       </code>
       option is unnecessary in this case.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa9249583"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">X509</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       For accounts with
       <code class="literal">
        REQUIRE X509
       </code>
       , clients
              must specify the
       <a class="link" href="connection-options.html#option_general_ssl-key">
        <code class="option">
         --ssl-key
        </code>
       </a>
       and
       <a class="link" href="connection-options.html#option_general_ssl-cert">
        <code class="option">
         --ssl-cert
        </code>
       </a>
       options to
              connect. (It is recommended but not required that
       <a class="link" href="connection-options.html#option_general_ssl-ca">
        <code class="option">
         --ssl-ca
        </code>
       </a>
       also be specified
              so that the public certificate provided by the server can
              be verified.) This is true for
       <code class="literal">
        ISSUER
       </code>
       and
       <code class="literal">
        SUBJECT
       </code>
       as well because those
       <code class="literal">
        REQUIRE
       </code>
       options imply the requirements
              of
       <code class="literal">
        X509
       </code>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        ISSUER
              '
        <em class="replaceable">
         <code>
          issuer
         </code>
        </em>
        '
       </code>
      </p>
      <p>
       For all accounts named by the statement, requires that
              clients present a valid X.509 certificate issued by CA
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          issuer
         </code>
        </em>
        '
       </code>
       . If
              a client presents a certificate that is valid but has a
              different issuer, the server rejects the connection. Use
              of X.509 certificates always implies encryption, so the
       <code class="literal">
        SSL
       </code>
       option is unnecessary in this case.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa51748374"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">REQUIRE</span> <span class="token keyword">ISSUER</span> <span class="token string">'/C=SE/ST=Stockholm/L=Stockholm/
    O=MySQL/CN=CA/emailAddress=ca@example.com'</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       Because
       <code class="literal">
        ISSUER
       </code>
       implies the requirements
              of
       <code class="literal">
        X509
       </code>
       , clients must specify the
       <a class="link" href="connection-options.html#option_general_ssl-key">
        <code class="option">
         --ssl-key
        </code>
       </a>
       and
       <a class="link" href="connection-options.html#option_general_ssl-cert">
        <code class="option">
         --ssl-cert
        </code>
       </a>
       options to
              connect. (It is recommended but not required that
       <a class="link" href="connection-options.html#option_general_ssl-ca">
        <code class="option">
         --ssl-ca
        </code>
       </a>
       also be specified
              so that the public certificate provided by the server can
              be verified.)
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        SUBJECT
              '
        <em class="replaceable">
         <code>
          subject
         </code>
        </em>
        '
       </code>
      </p>
      <p>
       For all accounts named by the statement, requires that
              clients present a valid X.509 certificate containing the
              subject
       <em class="replaceable">
        <code>
         subject
        </code>
       </em>
       . If a client
              presents a certificate that is valid but has a different
              subject, the server rejects the connection. Use of X.509
              certificates always implies encryption, so the
       <code class="literal">
        SSL
       </code>
       option is unnecessary in this case.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa25236951"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">REQUIRE</span> <span class="token keyword">SUBJECT</span> <span class="token string">'/C=SE/ST=Stockholm/L=Stockholm/
    O=MySQL demo client certificate/
    CN=client/emailAddress=client@example.com'</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       MySQL does a simple string comparison of the
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          subject
         </code>
        </em>
        '
       </code>
       value to the value in the certificate, so lettercase and
              component ordering must be given exactly as present in the
              certificate.
      </p>
      <p>
       Because
       <code class="literal">
        SUBJECT
       </code>
       implies the
              requirements of
       <code class="literal">
        X509
       </code>
       , clients must
              specify the
       <a class="link" href="connection-options.html#option_general_ssl-key">
        <code class="option">
         --ssl-key
        </code>
       </a>
       and
       <a class="link" href="connection-options.html#option_general_ssl-cert">
        <code class="option">
         --ssl-cert
        </code>
       </a>
       options to
              connect. (It is recommended but not required that
       <a class="link" href="connection-options.html#option_general_ssl-ca">
        <code class="option">
         --ssl-ca
        </code>
       </a>
       also be specified
              so that the public certificate provided by the server can
              be verified.)
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        CIPHER
              '
        <em class="replaceable">
         <code>
          cipher
         </code>
        </em>
        '
       </code>
      </p>
      <p>
       For all accounts named by the statement, requires a
              specific cipher method for encrypting connections. This
              option is needed to ensure that ciphers and key lengths of
              sufficient strength are used. Encryption can be weak if
              old algorithms using short encryption keys are used.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa16588616"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">REQUIRE</span> <span class="token keyword">CIPHER</span> <span class="token string">'EDH-RSA-DES-CBC3-SHA'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    The
    <code class="literal">
     SUBJECT
    </code>
    ,
    <code class="literal">
     ISSUER
    </code>
    , and
    <code class="literal">
     CIPHER
    </code>
    options can be combined in the
    <code class="literal">
     REQUIRE
    </code>
    clause:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa23820739"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">REQUIRE</span> <span class="token keyword">SUBJECT</span> <span class="token string">'/C=SE/ST=Stockholm/L=Stockholm/
    O=MySQL demo client certificate/
    CN=client/emailAddress=client@example.com'</span>
  <span class="token operator">AND</span> <span class="token keyword">ISSUER</span> <span class="token string">'/C=SE/ST=Stockholm/L=Stockholm/
    O=MySQL/CN=CA/emailAddress=ca@example.com'</span>
  <span class="token operator">AND</span> <span class="token keyword">CIPHER</span> <span class="token string">'EDH-RSA-DES-CBC3-SHA'</span><span class="token punctuation">;</span></code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="create-user-resource-limits">
       </a>
       CREATE USER Resource-Limit Options
      </h5>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045174260912">
   </a>
   <a class="indexterm" name="idm46045174259424">
   </a>
   <p>
    It is possible to place limits on use of server resources by
          an account, as discussed in
    <a class="xref" href="user-resources.html" title="8.2.21 Setting Account Resource Limits">
     Section 8.2.21, “Setting Account Resource Limits”
    </a>
    .
          To do so, use a
    <code class="literal">
     WITH
    </code>
    clause that specifies
          one or more
    <em class="replaceable">
     <code>
      resource_option
     </code>
    </em>
    values.
   </p>
   <p>
    Order of
    <code class="literal">
     WITH
    </code>
    options does not matter,
          except that if a given resource limit is specified multiple
          times, the last instance takes precedence.
   </p>
   <p>
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    permits these
    <em class="replaceable">
     <code>
      resource_option
     </code>
    </em>
    values:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        MAX_QUERIES_PER_HOUR
        <em class="replaceable">
         <code>
          count
         </code>
        </em>
       </code>
       ,
       <code class="literal">
        MAX_UPDATES_PER_HOUR
        <em class="replaceable">
         <code>
          count
         </code>
        </em>
       </code>
       ,
       <code class="literal">
        MAX_CONNECTIONS_PER_HOUR
        <em class="replaceable">
         <code>
          count
         </code>
        </em>
       </code>
      </p>
      <p>
       For all accounts named by the statement, these options
              restrict how many queries, updates, and connections to the
              server are permitted to each account during any given
              one-hour period. If
       <em class="replaceable">
        <code>
         count
        </code>
       </em>
       is
       <code class="literal">
        0
       </code>
       (the default), this means that there
              is no limitation for the account.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        MAX_USER_CONNECTIONS
        <em class="replaceable">
         <code>
          count
         </code>
        </em>
       </code>
      </p>
      <p>
       For all accounts named by the statement, restricts the
              maximum number of simultaneous connections to the server
              by each account. A nonzero
       <em class="replaceable">
        <code>
         count
        </code>
       </em>
       specifies the limit for
              the account explicitly. If
       <em class="replaceable">
        <code>
         count
        </code>
       </em>
       is
       <code class="literal">
        0
       </code>
       (the default), the server determines the number of
              simultaneous connections for the account from the global
              value of the
       <a class="link" href="server-system-variables.html#sysvar_max_user_connections">
        <code class="literal">
         max_user_connections
        </code>
       </a>
       system variable. If
       <a class="link" href="server-system-variables.html#sysvar_max_user_connections">
        <code class="literal">
         max_user_connections
        </code>
       </a>
       is
              also zero, there is no limit for the account.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa43171150"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">WITH</span> <span class="token keyword">MAX_QUERIES_PER_HOUR</span> <span class="token number">500</span> <span class="token keyword">MAX_UPDATES_PER_HOUR</span> <span class="token number">100</span><span class="token punctuation">;</span></code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="create-user-password-management">
       </a>
       CREATE USER Password-Management Options
      </h5>
     </div>
    </div>
   </div>
   <p>
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    supports several
    <em class="replaceable">
     <code>
      password_option
     </code>
    </em>
    values for password
          management:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Password expiration options: You can expire an account
              password manually and establish its password expiration
              policy. Policy options do not expire the password.
              Instead, they determine how the server applies automatic
              expiration to the account based on password age, which is
              assessed from the date and time of the most recent account
              password change.
      </p>
     </li>
     <li class="listitem">
      <p>
       Password reuse options: You can restrict password reuse
              based on number of password changes, time elapsed, or
              both.
      </p>
     </li>
     <li class="listitem">
      <p>
       Password verification-required options: You can indicate
              whether attempts to change an account password must
              specify the current password, as verification that the
              user attempting to make the change actually knows the
              current password.
      </p>
     </li>
     <li class="listitem">
      <p>
       Incorrect-password failed-login tracking options: You can
              cause the server to track failed login attempts and
              temporarily lock accounts for which too many consecutive
              incorrect passwords are given. The required number of
              failures and the lock time are configurable.
      </p>
     </li>
    </ul>
   </div>
   <p>
    This section describes the syntax for password-management
          options. For information about establishing policy for
          password management, see
    <a class="xref" href="password-management.html" title="8.2.15 Password Management">
     Section 8.2.15, “Password Management”
    </a>
    .
   </p>
   <p>
    If multiple password-management options of a given type are
          specified, the last one takes precedence. For example,
    <code class="literal">
     PASSWORD EXPIRE DEFAULT PASSWORD EXPIRE
          NEVER
    </code>
    is the same as
    <code class="literal">
     PASSWORD EXPIRE
          NEVER
    </code>
    .
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     Except for the options that pertain to failed-login
            tracking, password-management options apply only to accounts
            that use an authentication plugin that stores credentials
            internally to MySQL. For accounts that use a plugin that
            performs authentication against a credentials system that is
            external to MySQL, password management must be handled
            externally against that system as well. For more information
            about internal credentials storage, see
     <a class="xref" href="password-management.html" title="8.2.15 Password Management">
      Section 8.2.15, “Password Management”
     </a>
     .
    </p>
   </div>
   <p>
    A client has an expired password if the account password was
          expired manually or the password age is considered greater
          than its permitted lifetime per the automatic expiration
          policy. In this case, the server either disconnects the client
          or restricts the operations permitted to it (see
    <a class="xref" href="expired-password-handling.html" title="8.2.16 Server Handling of Expired Passwords">
     Section 8.2.16, “Server Handling of Expired Passwords”
    </a>
    ). Operations
          performed by a restricted client result in an error until the
          user establishes a new account password.
   </p>
   <p>
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    permits these
    <em class="replaceable">
     <code>
      password_option
     </code>
    </em>
    values for
          controlling password expiration:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD EXPIRE
       </code>
      </p>
      <p>
       Immediately marks the password expired for all accounts
              named by the statement.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa9911708"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD EXPIRE DEFAULT
       </code>
      </p>
      <p>
       Sets all accounts named by the statement so that the
              global expiration policy applies, as specified by the
       <a class="link" href="server-system-variables.html#sysvar_default_password_lifetime">
        <code class="literal">
         default_password_lifetime
        </code>
       </a>
       system variable.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa34981790"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span> <span class="token keyword">DEFAULT</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD EXPIRE NEVER
       </code>
      </p>
      <p>
       This expiration option overrides the global policy for all
              accounts named by the statement. For each, it disables
              password expiration so that the password never expires.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa24923100"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span> <span class="token keyword">NEVER</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD EXPIRE INTERVAL
        <em class="replaceable">
         <code>
          N
         </code>
        </em>
        DAY
       </code>
      </p>
      <p>
       This expiration option overrides the global policy for all
              accounts named by the statement. For each, it sets the
              password lifetime to
       <em class="replaceable">
        <code>
         N
        </code>
       </em>
       days.
              The following statement requires the password to be
              changed every 180 days:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa37135344"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span> <span class="token keyword">INTERVAL</span> <span class="token number">180</span> <span class="token keyword">DAY</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    permits these
    <em class="replaceable">
     <code>
      password_option
     </code>
    </em>
    values for
          controlling reuse of previous passwords based on required
          minimum number of password changes:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD HISTORY DEFAULT
       </code>
      </p>
      <p>
       Sets all accounts named by the statement so that the
              global policy about password history length applies, to
              prohibit reuse of passwords before the number of changes
              specified by the
       <a class="link" href="server-system-variables.html#sysvar_password_history">
        <code class="literal">
         password_history
        </code>
       </a>
       system
              variable.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa25053515"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">HISTORY</span> <span class="token keyword">DEFAULT</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD HISTORY
        <em class="replaceable">
         <code>
          N
         </code>
        </em>
       </code>
      </p>
      <p>
       This history-length option overrides the global policy for
              all accounts named by the statement. For each, it sets the
              password history length to
       <em class="replaceable">
        <code>
         N
        </code>
       </em>
       passwords, to prohibit reusing any of the
       <em class="replaceable">
        <code>
         N
        </code>
       </em>
       most recently chosen
              passwords. The following statement prohibits reuse of any
              of the previous 6 passwords:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa41220754"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">HISTORY</span> <span class="token number">6</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    permits these
    <em class="replaceable">
     <code>
      password_option
     </code>
    </em>
    values for
          controlling reuse of previous passwords based on time elapsed:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD REUSE INTERVAL DEFAULT
       </code>
      </p>
      <p>
       Sets all statements named by the account so that the
              global policy about time elapsed applies, to prohibit
              reuse of passwords newer than the number of days specified
              by the
       <a class="link" href="server-system-variables.html#sysvar_password_reuse_interval">
        <code class="literal">
         password_reuse_interval
        </code>
       </a>
       system variable.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa92596386"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REUSE</span> <span class="token keyword">INTERVAL</span> <span class="token keyword">DEFAULT</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD REUSE INTERVAL
        <em class="replaceable">
         <code>
          N
         </code>
        </em>
        DAY
       </code>
      </p>
      <p>
       This time-elapsed option overrides the global policy for
              all accounts named by the statement. For each, it sets the
              password reuse interval to
       <em class="replaceable">
        <code>
         N
        </code>
       </em>
       days, to prohibit reuse of passwords newer than that many
              days. The following statement prohibits password reuse for
              360 days:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa47044444"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REUSE</span> <span class="token keyword">INTERVAL</span> <span class="token number">360</span> <span class="token keyword">DAY</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    permits these
    <em class="replaceable">
     <code>
      password_option
     </code>
    </em>
    values for
          controlling whether attempts to change an account password
          must specify the current password, as verification that the
          user attempting to make the change actually knows the current
          password:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD REQUIRE CURRENT
       </code>
      </p>
      <p>
       This verification option overrides the global policy for
              all accounts named by the statement. For each, it requires
              that password changes specify the current password.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa34842966"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">CURRENT</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD REQUIRE CURRENT OPTIONAL
       </code>
      </p>
      <p>
       This verification option overrides the global policy for
              all accounts named by the statement. For each, it does not
              require that password changes specify the current
              password. (The current password may but need not be
              given.)
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa35095018"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">CURRENT</span> <span class="token keyword">OPTIONAL</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD REQUIRE CURRENT DEFAULT
       </code>
      </p>
      <p>
       Sets all statements named by the account so that the
              global policy about password verification applies, as
              specified by the
       <a class="link" href="server-system-variables.html#sysvar_password_require_current">
        <code class="literal">
         password_require_current
        </code>
       </a>
       system variable.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa44415253"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">CURRENT</span> <span class="token keyword">DEFAULT</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    permits these
    <em class="replaceable">
     <code>
      password_option
     </code>
    </em>
    values for
          controlling failed-login tracking:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        FAILED_LOGIN_ATTEMPTS
        <em class="replaceable">
         <code>
          N
         </code>
        </em>
       </code>
      </p>
      <p>
       Whether to track account login attempts that specify an
              incorrect password.
       <em class="replaceable">
        <code>
         N
        </code>
       </em>
       must be a
              number from 0 to 32767. A value of 0 disables failed-login
              tracking. Values greater than 0 indicate how many
              consecutive password failures cause temporary account
              locking (if
       <code class="literal">
        PASSWORD_LOCK_TIME
       </code>
       is also
              nonzero).
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD_LOCK_TIME {
        <em class="replaceable">
         <code>
          N
         </code>
        </em>
        | UNBOUNDED}
       </code>
      </p>
      <p>
       How long to lock the account after too many consecutive
              login attempts provide an incorrect password.
       <em class="replaceable">
        <code>
         N
        </code>
       </em>
       must be a number from 0 to
              32767, or
       <code class="literal">
        UNBOUNDED
       </code>
       . A value of 0
              disables temporary account locking. Values greater than 0
              indicate how long to lock the account in days. A value of
       <code class="literal">
        UNBOUNDED
       </code>
       causes the account locking
              duration to be unbounded; once locked, the account remains
              in a locked state until unlocked. For information about
              the conditions under which unlocking occurs, see
       <a class="xref" href="password-management.html#failed-login-tracking" title="Failed-Login Tracking and Temporary Account Locking">
        Failed-Login Tracking and Temporary Account Locking
       </a>
       .
      </p>
     </li>
    </ul>
   </div>
   <p>
    For failed-login tracking and temporary locking to occur, an
          account's
    <code class="literal">
     FAILED_LOGIN_ATTEMPTS
    </code>
    and
    <code class="literal">
     PASSWORD_LOCK_TIME
    </code>
    options both must be
          nonzero. The following statement creates an account that
          remains locked for two days after four consecutive password
          failures:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa76009571"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">FAILED_LOGIN_ATTEMPTS</span> <span class="token number">4</span> <span class="token keyword">PASSWORD_LOCK_TIME</span> <span class="token number">2</span><span class="token punctuation">;</span></code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="create-user-comments-attributes">
       </a>
       CREATE USER Comment and Attribute Options
      </h5>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045174154720">
   </a>
   <a class="indexterm" name="idm46045174153232">
   </a>
   <p>
    You can also include an optional comment or attribute when
          creating a user, as described here:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <span class="bold">
        <strong>
         User comment
        </strong>
       </span>
      </p>
      <p>
       To set a user comment, add
       <code class="literal">
        COMMENT
              '
        <em class="replaceable">
         <code>
          user_comment
         </code>
        </em>
        '
       </code>
       to the
       <code class="literal">
        CREATE USER
       </code>
       statement, where
       <em class="replaceable">
        <code>
         user_comment
        </code>
       </em>
       is the text of the
              user comment.
      </p>
      <p>
       Example (omitting any other options):
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa47931729"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jon'</span>@<span class="token string">'localhost'</span> <span class="token keyword">COMMENT</span> <span class="token string">'Some information about Jon'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <span class="bold">
        <strong>
         User attribute
        </strong>
       </span>
      </p>
      <p>
       A user attribute is a JSON object made up of one or more
              key-value pairs, and is set by including
       <code class="literal">
        ATTRIBUTE
              '
        <em class="replaceable">
         <code>
          json_object
         </code>
        </em>
        '
       </code>
       as part
              of
       <code class="literal">
        CREATE USER
       </code>
       .
       <em class="replaceable">
        <code>
         json_object
        </code>
       </em>
       must be a valid
              JSON object.
      </p>
      <p>
       Example (omitting any other options):
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa40889631"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jim'</span>@<span class="token string">'localhost'</span>
    <span class="token keyword">ATTRIBUTE</span> <span class="token string">'{"fname": "James", "lname": "Scott", "phone": "123-456-7890"}'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    User comments and user attributes are stored together in the
    <code class="literal">
     ATTRIBUTE
    </code>
    column of the Information Schema
    <a class="link" href="information-schema-user-attributes-table.html" title="28.3.45 The INFORMATION_SCHEMA USER_ATTRIBUTES Table">
     <code class="literal">
      USER_ATTRIBUTES
     </code>
    </a>
    table. This query
          displays the row in this table inserted by the statement just
          shown for creating the user
    <code class="literal">
     jim@localhost
    </code>
    :
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa69297191"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token operator">*</span> <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span>USER_ATTRIBUTES
<span class="token prompt">    -&gt;</span>    <span class="token keyword">WHERE</span> <span class="token keyword">USER</span> <span class="token operator">=</span> <span class="token string">'jim'</span> <span class="token operator">AND</span> <span class="token keyword">HOST</span> <span class="token operator">=</span> <span class="token string">'localhost'</span>\G
<span class="token output"><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span> 1. row <span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span>
     USER<span class="token punctuation">:</span> jim
     HOST<span class="token punctuation">:</span> localhost
ATTRIBUTE<span class="token punctuation">:</span> {"fname"<span class="token punctuation">:</span> "James", "lname"<span class="token punctuation">:</span> "Scott", "phone"<span class="token punctuation">:</span> "123-456-7890"}
</span><span class="token output">1 row in set (0.00 sec)</span></code></pre>
   </div>
   <p>
    The
    <code class="literal">
     COMMENT
    </code>
    option in actuality provides a
          shortcut for setting a user attribute whose only element has
    <code class="literal">
     comment
    </code>
    as its key and whose value is the
          argument supplied for the option. You can see this by
          executing the statement
    <code class="literal">
     CREATE USER 'jon'@'localhost'
          COMMENT 'Some information about Jon'
    </code>
    , and observing
          the row which it inserts into the
    <a class="link" href="information-schema-user-attributes-table.html" title="28.3.45 The INFORMATION_SCHEMA USER_ATTRIBUTES Table">
     <code class="literal">
      USER_ATTRIBUTES
     </code>
    </a>
    table:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa44230922"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jon'</span>@<span class="token string">'localhost'</span> <span class="token keyword">COMMENT</span> <span class="token string">'Some information about Jon'</span><span class="token punctuation">;</span>
<span class="token output">Query OK, 0 rows affected (0.06 sec)</span>

<span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token operator">*</span> <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span>USER_ATTRIBUTES
<span class="token prompt">    -&gt;</span>    <span class="token keyword">WHERE</span> <span class="token keyword">USER</span> <span class="token operator">=</span> <span class="token string">'jon'</span> <span class="token operator">AND</span> <span class="token keyword">HOST</span> <span class="token operator">=</span> <span class="token string">'localhost'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> USER <span class="token punctuation">|</span> HOST      <span class="token punctuation">|</span> ATTRIBUTE                                 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> jon  <span class="token punctuation">|</span> localhost <span class="token punctuation">|</span> {"comment": "Some information about Jon"} <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output">1 row in set (0.00 sec)</span></code></pre>
   </div>
   <p>
    You cannot use
    <code class="literal">
     COMMENT
    </code>
    and
    <code class="literal">
     ATTRIBUTE
    </code>
    together in the same
    <code class="literal">
     CREATE USER
    </code>
    statement; attempting to do so
          causes a syntax error. To set a user comment concurrently with
          setting a user attribute, use
    <code class="literal">
     ATTRIBUTE
    </code>
    and
          include in its argument a value with a
    <code class="literal">
     comment
    </code>
    key, like this:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa24248100"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'bill'</span>@<span class="token string">'localhost'</span>
<span class="token prompt">    -&gt;</span>        <span class="token keyword">ATTRIBUTE</span> <span class="token string">'{"fname":"William", "lname":"Schmidt",
    -&gt;        "comment":"Website developer"}'</span><span class="token punctuation">;</span>
<span class="token output">Query OK, 0 rows affected (0.16 sec)</span></code></pre>
   </div>
   <p>
    Since the content of the
    <code class="literal">
     ATTRIBUTE
    </code>
    row is a
          JSON object, you can employ any appropriate MySQL JSON
          functions or operators to manipulate it, as shown here:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa89391717"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span>
<span class="token prompt">    -&gt;</span>   <span class="token keyword">USER</span> <span class="token keyword">AS</span> <span class="token keyword">User</span><span class="token punctuation">,</span>
<span class="token prompt">    -&gt;</span>   <span class="token keyword">HOST</span> <span class="token keyword">AS</span> <span class="token keyword">Host</span><span class="token punctuation">,</span>
<span class="token prompt">    -&gt;</span>   <span class="token function">CONCAT</span><span class="token punctuation">(</span><span class="token keyword">ATTRIBUTE</span><span class="token operator">-</span><span class="token operator">&gt;&gt;</span><span class="token string">"$.fname"</span><span class="token punctuation">,</span><span class="token string">" "</span><span class="token punctuation">,</span><span class="token keyword">ATTRIBUTE</span><span class="token operator">-</span><span class="token operator">&gt;&gt;</span><span class="token string">"$.lname"</span><span class="token punctuation">)</span> <span class="token keyword">AS</span> <span class="token string">'Full Name'</span><span class="token punctuation">,</span>
<span class="token prompt">    -&gt;</span>   <span class="token keyword">ATTRIBUTE</span><span class="token operator">-</span><span class="token operator">&gt;&gt;</span><span class="token string">"$.comment"</span> <span class="token keyword">AS</span> <span class="token keyword">Comment</span>
<span class="token prompt">    -&gt;</span> <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span>USER_ATTRIBUTES
<span class="token prompt">    -&gt;</span> <span class="token keyword">WHERE</span> <span class="token keyword">USER</span><span class="token operator">=</span><span class="token string">'bill'</span> <span class="token operator">AND</span> <span class="token keyword">HOST</span><span class="token operator">=</span><span class="token string">'localhost'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> User <span class="token punctuation">|</span> Host      <span class="token punctuation">|</span> Full Name       <span class="token punctuation">|</span> Comment           <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> bill <span class="token punctuation">|</span> localhost <span class="token punctuation">|</span> William Schmidt <span class="token punctuation">|</span> Website developer <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output">1 row in set (0.00 sec)</span></code></pre>
   </div>
   <p>
    To set or to make changes in the user comment or user
          attribute for an existing user, you can use a
    <code class="literal">
     COMMENT
    </code>
    or
    <code class="literal">
     ATTRIBUTE
    </code>
    option with an
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    statement.
   </p>
   <p>
    Because the user comment and user attribute are stored
          together internally in a single
    <a class="link" href="json.html" title="13.5 The JSON Data Type">
     <code class="literal">
      JSON
     </code>
    </a>
    column, this sets an upper
          limit on their maximum combined size; see
    <a class="xref" href="storage-requirements.html#data-types-storage-reqs-json" title="JSON Storage Requirements">
     JSON Storage Requirements
    </a>
    , for more
          information.
   </p>
   <p>
    See also the description of the Information Schema
    <a class="link" href="information-schema-user-attributes-table.html" title="28.3.45 The INFORMATION_SCHEMA USER_ATTRIBUTES Table">
     <code class="literal">
      USER_ATTRIBUTES
     </code>
    </a>
    table for more
          information and examples.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="create-user-account-locking">
       </a>
       CREATE USER Account-Locking Options
      </h5>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045174103360">
   </a>
   <p>
    MySQL supports account locking and unlocking using the
    <code class="literal">
     ACCOUNT LOCK
    </code>
    and
    <code class="literal">
     ACCOUNT
          UNLOCK
    </code>
    options, which specify the locking state for
          an account. For additional discussion, see
    <a class="xref" href="account-locking.html" title="8.2.20 Account Locking">
     Section 8.2.20, “Account Locking”
    </a>
    .
   </p>
   <p>
    If multiple account-locking options are specified, the last
          one takes precedence.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="create-user-binary-logging">
       </a>
       CREATE USER Binary Logging
      </h5>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045174097376">
   </a>
   <p>
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    is written to the
          binary log if it succeeds, but not if it fails; in that case,
          rollback occurs and no changes are made. A statement written
          to the binary log includes all named users. If the
    <code class="literal">
     IF
          NOT EXISTS
    </code>
    clause is given, this includes even users
          that already exist and were not created.
   </p>
   <p>
    The statement written to the binary log specifies an
          authentication plugin for each user, determined as follows:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The plugin named in the original statement, if one was
              specified.
      </p>
     </li>
     <li class="listitem">
      <p>
       Otherwise, the default authentication plugin. In
              particular, if a user
       <code class="literal">
        u1
       </code>
       already exists
              and uses a nondefault authentication plugin, the statement
              written to the binary log for
       <code class="literal">
        CREATE USER IF NOT
              EXISTS u1
       </code>
       names the default authentication
              plugin. (If the statement written to the binary log must
              specify a nondefault authentication plugin for a user,
              include it in the original statement.)
      </p>
     </li>
    </ul>
   </div>
   <p>
    If the server adds the default authentication plugin for any
          nonexisting users in the statement written to the binary log,
          it writes a warning to the error log naming those users.
   </p>
   <p>
    If the original statement specifies the
    <code class="literal">
     FAILED_LOGIN_ATTEMPTS
    </code>
    or
    <code class="literal">
     PASSWORD_LOCK_TIME
    </code>
    option, the statement
          written to the binary log includes the option.
   </p>
   <p>
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    statements with
          clauses that support multifactor authentication (MFA) are
          written to the binary log.
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        CREATE USER ... IDENTIFIED WITH .. INITIAL
              AUTHENTICATION IDENTIFIED WITH ...
       </code>
       statements
              are written to the binary log as
       <code class="literal">
        CREATE USER ..
              IDENTIFIED WITH .. INITIAL AUTHENTICATION IDENTIFIED WITH
              .. AS
              '
        <em class="replaceable">
         <code>
          password-hash
         </code>
        </em>
        '
       </code>
       ,
              where the
       <em class="replaceable">
        <code>
         password-hash
        </code>
       </em>
       is the
              user-specified
       <em class="replaceable">
        <code>
         auth-string
        </code>
       </em>
       or
              the random password generated by server when the
       <code class="literal">
        RANDOM PASSWORD
       </code>
       clause is specified.
      </p>
     </li>
    </ul>
   </div>
  </div>
 </div>
 <br/>
</div>
