<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="grant-tables">
      </a>
      8.2.3 Grant Tables
     </h3>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045250727184">
  </a>
  <a class="indexterm" name="idm46045250725696">
  </a>
  <p>
   The
   <code class="literal">
    mysql
   </code>
   system database includes several
      grant tables that contain information about user accounts and the
      privileges held by them. This section describes those tables. For
      information about other tables in the system database, see
   <a class="xref" href="system-schema.html" title="7.3 The mysql System Schema">
    Section 7.3, “The mysql System Schema”
   </a>
   .
  </p>
  <p>
   The discussion here describes the underlying structure of the
      grant tables and how the server uses their contents when
      interacting with clients. However, normally you do not modify the
      grant tables directly. Modifications occur indirectly when you use
      account-management statements such as
   <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
    <code class="literal">
     CREATE
      USER
    </code>
   </a>
   ,
   <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
    <code class="literal">
     GRANT
    </code>
   </a>
   , and
   <a class="link" href="revoke.html" title="15.7.1.8 REVOKE Statement">
    <code class="literal">
     REVOKE
    </code>
   </a>
   to set up accounts and
      control the privileges available to each one. See
   <a class="xref" href="account-management-statements.html" title="15.7.1 Account Management Statements">
    Section 15.7.1, “Account Management Statements”
   </a>
   . When you use such
      statements to perform account manipulations, the server modifies
      the grant tables on your behalf.
  </p>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    Direct modification of grant tables using statements such as
    <a class="link" href="insert.html" title="15.2.7 INSERT Statement">
     <code class="literal">
      INSERT
     </code>
    </a>
    ,
    <a class="link" href="update.html" title="15.2.17 UPDATE Statement">
     <code class="literal">
      UPDATE
     </code>
    </a>
    , or
    <a class="link" href="delete.html" title="15.2.2 DELETE Statement">
     <code class="literal">
      DELETE
     </code>
    </a>
    is discouraged and done at
        your own risk. The server is free to ignore rows that become
        malformed as a result of such modifications.
   </p>
   <p>
    For any operation that modifies a grant table, the server checks
        whether the table has the expected structure and produces an
        error if not. To update the tables to the expected structure,
        perform the MySQL upgrade procedure. See
    <a class="xref" href="upgrading.html" title="Chapter 3 Upgrading MySQL">
     Chapter 3,
     <i>
      Upgrading MySQL
     </i>
    </a>
    .
   </p>
  </div>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="grant-tables.html#grant-tables-overview" title="Grant Table Overview">
       Grant Table Overview
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="grant-tables.html#grant-tables-user-db" title="The user and db Grant Tables">
       The user and db Grant Tables
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="grant-tables.html#grant-tables-tables-priv-columns-priv" title="The tables_priv and columns_priv Grant Tables">
       The tables_priv and columns_priv Grant Tables
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="grant-tables.html#grant-tables-procs-priv" title="The procs_priv Grant Table">
       The procs_priv Grant Table
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="grant-tables.html#grant-tables-proxies-priv" title="The proxies_priv Grant Table">
       The proxies_priv Grant Table
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="grant-tables.html#grant-tables-global-grants" title="The global_grants Grant Table">
       The global_grants Grant Table
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="grant-tables.html#grant-tables-default-roles" title="The default_roles Grant Table">
       The default_roles Grant Table
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="grant-tables.html#grant-tables-role-edges" title="The role_edges Grant Table">
       The role_edges Grant Table
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="grant-tables.html#grant-tables-password-history" title="The password_history Grant Table">
       The password_history Grant Table
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="grant-tables.html#grant-tables-scope-column-properties" title="Grant Table Scope Column Properties">
       Grant Table Scope Column Properties
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="grant-tables.html#grant-tables-privilege-column-properties" title="Grant Table Privilege Column Properties">
       Grant Table Privilege Column Properties
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="grant-tables.html#grant-tables-concurrency" title="Grant Table Concurrency">
       Grant Table Concurrency
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="grant-tables-overview">
       </a>
       Grant Table Overview
      </h4>
     </div>
    </div>
   </div>
   <p>
    These
    <code class="literal">
     mysql
    </code>
    database tables contain grant
        information:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a class="link" href="grant-tables.html#grant-tables-user-db" title="The user and db Grant Tables">
        <code class="literal">
         user
        </code>
       </a>
       :
            User accounts, static global privileges, and other
            nonprivilege columns.
      </p>
      <a class="indexterm" name="idm46045250693312">
      </a>
      <a class="indexterm" name="idm46045250691824">
      </a>
      <a class="indexterm" name="idm46045250690336">
      </a>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="grant-tables.html#grant-tables-global-grants" title="The global_grants Grant Table">
        <code class="literal">
         global_grants
        </code>
       </a>
       :
            Dynamic global privileges.
      </p>
      <a class="indexterm" name="idm46045250686736">
      </a>
      <a class="indexterm" name="idm46045250685248">
      </a>
      <a class="indexterm" name="idm46045250683760">
      </a>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="grant-tables.html#grant-tables-user-db" title="The user and db Grant Tables">
        <code class="literal">
         db
        </code>
       </a>
       :
            Database-level privileges.
      </p>
      <a class="indexterm" name="idm46045250680320">
      </a>
      <a class="indexterm" name="idm46045250678832">
      </a>
      <a class="indexterm" name="idm46045250677344">
      </a>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="grant-tables.html#grant-tables-tables-priv-columns-priv" title="The tables_priv and columns_priv Grant Tables">
        <code class="literal">
         tables_priv
        </code>
       </a>
       :
            Table-level privileges.
      </p>
      <a class="indexterm" name="idm46045250673744">
      </a>
      <a class="indexterm" name="idm46045250672256">
      </a>
      <a class="indexterm" name="idm46045250670768">
      </a>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="grant-tables.html#grant-tables-tables-priv-columns-priv" title="The tables_priv and columns_priv Grant Tables">
        <code class="literal">
         columns_priv
        </code>
       </a>
       :
            Column-level privileges.
      </p>
      <a class="indexterm" name="idm46045250667216">
      </a>
      <a class="indexterm" name="idm46045250665728">
      </a>
      <a class="indexterm" name="idm46045250664240">
      </a>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="grant-tables.html#grant-tables-procs-priv" title="The procs_priv Grant Table">
        <code class="literal">
         procs_priv
        </code>
       </a>
       :
            Stored procedure and function privileges.
      </p>
      <a class="indexterm" name="idm46045250660752">
      </a>
      <a class="indexterm" name="idm46045250659264">
      </a>
      <a class="indexterm" name="idm46045250657776">
      </a>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="grant-tables.html#grant-tables-proxies-priv" title="The proxies_priv Grant Table">
        <code class="literal">
         proxies_priv
        </code>
       </a>
       :
            Proxy-user privileges.
      </p>
      <a class="indexterm" name="idm46045250654176">
      </a>
      <a class="indexterm" name="idm46045250652688">
      </a>
      <a class="indexterm" name="idm46045250651200">
      </a>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="grant-tables.html#grant-tables-default-roles" title="The default_roles Grant Table">
        <code class="literal">
         default_roles
        </code>
       </a>
       :
            Default user roles.
      </p>
      <a class="indexterm" name="idm46045250647648">
      </a>
      <a class="indexterm" name="idm46045250646160">
      </a>
      <a class="indexterm" name="idm46045250644672">
      </a>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="grant-tables.html#grant-tables-role-edges" title="The role_edges Grant Table">
        <code class="literal">
         role_edges
        </code>
       </a>
       :
            Edges for role subgraphs.
      </p>
      <a class="indexterm" name="idm46045250641200">
      </a>
      <a class="indexterm" name="idm46045250639712">
      </a>
      <a class="indexterm" name="idm46045250638224">
      </a>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="grant-tables.html#grant-tables-password-history" title="The password_history Grant Table">
        <code class="literal">
         password_history
        </code>
       </a>
       :
            Password change history.
      </p>
      <a class="indexterm" name="idm46045250634624">
      </a>
      <a class="indexterm" name="idm46045250633136">
      </a>
      <a class="indexterm" name="idm46045250631648">
      </a>
     </li>
    </ul>
   </div>
   <p>
    For information about the differences between static and dynamic
        global privileges, see
    <a class="xref" href="privileges-provided.html#static-dynamic-privileges" title="Static Versus Dynamic Privileges">
     Static Versus Dynamic Privileges
    </a>
    .)
   </p>
   <p>
    In MySQL 8.4, grant tables use the
    <code class="literal">
     InnoDB
    </code>
    storage engine and are transactional.
        Before MySQL 8.4, grant tables used the
    <code class="literal">
     MyISAM
    </code>
    storage engine and were
        nontransactional. This change of grant table storage engine
        enables an accompanying change to the behavior of
        account-management statements such as
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    or
    <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
     <code class="literal">
      GRANT
     </code>
    </a>
    . Previously, an
        account-management statement that named multiple users could
        succeed for some users and fail for others. Now, each statement
        is transactional and either succeeds for all named users or
        rolls back and has no effect if any error occurs.
   </p>
   <p>
    Each grant table contains scope columns and privilege columns:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Scope columns determine the scope of each row in the tables;
            that is, the context in which the row applies. For example,
            a
       <code class="literal">
        user
       </code>
       table row with
       <code class="literal">
        Host
       </code>
       and
       <code class="literal">
        User
       </code>
       values
            of
       <code class="literal">
        'h1.example.net'
       </code>
       and
       <code class="literal">
        'bob'
       </code>
       applies to authenticating
            connections made to the server from the host
       <code class="literal">
        h1.example.net
       </code>
       by a client that specifies
            a user name of
       <code class="literal">
        bob
       </code>
       . Similarly, a
       <code class="literal">
        db
       </code>
       table row with
       <code class="literal">
        Host
       </code>
       ,
       <code class="literal">
        User
       </code>
       , and
       <code class="literal">
        Db
       </code>
       column values of
       <code class="literal">
        'h1.example.net'
       </code>
       ,
       <code class="literal">
        'bob'
       </code>
       and
       <code class="literal">
        'reports'
       </code>
       applies when
       <code class="literal">
        bob
       </code>
       connects from the host
       <code class="literal">
        h1.example.net
       </code>
       to access the
       <code class="literal">
        reports
       </code>
       database. The
       <code class="literal">
        tables_priv
       </code>
       and
       <code class="literal">
        columns_priv
       </code>
       tables contain scope columns
            indicating tables or table/column combinations to which each
            row applies. The
       <code class="literal">
        procs_priv
       </code>
       scope columns
            indicate the stored routine to which each row applies.
      </p>
     </li>
     <li class="listitem">
      <p>
       Privilege columns indicate which privileges a table row
            grants; that is, which operations it permits to be
            performed. The server combines the information in the
            various grant tables to form a complete description of a
            user's privileges.
       <a class="xref" href="request-access.html" title="8.2.7 Access Control, Stage 2: Request Verification">
        Section 8.2.7, “Access Control, Stage 2: Request Verification”
       </a>
       ,
            describes the rules for this.
      </p>
     </li>
    </ul>
   </div>
   <p>
    In addition, a grant table may contain columns used for purposes
        other than scope or privilege assessment.
   </p>
   <p>
    The server uses the grant tables in the following manner:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The
       <code class="literal">
        user
       </code>
       table scope columns determine
            whether to reject or permit incoming connections. For
            permitted connections, any privileges granted in the
       <code class="literal">
        user
       </code>
       table indicate the user's static
            global privileges. Any privileges granted in this table
            apply to
       <span class="emphasis">
        <em>
         all
        </em>
       </span>
       databases on the server.
      </p>
      <div class="caution" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Caution
       </div>
       <p>
        Because any static global privilege is considered a
              privilege for all databases, any static global privilege
              enables a user to see all database names with
        <a class="link" href="show-databases.html" title="15.7.7.15 SHOW DATABASES Statement">
         <code class="literal">
          SHOW DATABASES
         </code>
        </a>
        or by
              examining the
        <a class="link" href="information-schema-schemata-table.html" title="28.3.31 The INFORMATION_SCHEMA SCHEMATA Table">
         <code class="literal">
          SCHEMATA
         </code>
        </a>
        table
              of
        <code class="literal">
         INFORMATION_SCHEMA
        </code>
        , except databases
              that have been restricted at the database level by partial
              revokes.
       </p>
      </div>
     </li>
     <li class="listitem">
      <p>
       The
       <code class="literal">
        global_grants
       </code>
       table lists current
            assignments of dynamic global privileges to user accounts.
            For each row, the scope columns determine which user has the
            privilege named in the privilege column.
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <code class="literal">
        db
       </code>
       table scope columns determine
            which users can access which databases from which hosts. The
            privilege columns determine the permitted operations. A
            privilege granted at the database level applies to the
            database and to all objects in the database, such as tables
            and stored programs.
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <code class="literal">
        tables_priv
       </code>
       and
       <code class="literal">
        columns_priv
       </code>
       tables are similar to the
       <code class="literal">
        db
       </code>
       table, but are more fine-grained: They
            apply at the table and column levels rather than at the
            database level. A privilege granted at the table level
            applies to the table and to all its columns. A privilege
            granted at the column level applies only to a specific
            column.
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <code class="literal">
        procs_priv
       </code>
       table applies to stored
            routines (stored procedures and functions). A privilege
            granted at the routine level applies only to a single
            procedure or function.
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <code class="literal">
        proxies_priv
       </code>
       table indicates which
            users can act as proxies for other users and whether a user
            can grant the
       <a class="link" href="privileges-provided.html#priv_proxy">
        <code class="literal">
         PROXY
        </code>
       </a>
       privilege
            to other users.
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <code class="literal">
        default_roles
       </code>
       and
       <code class="literal">
        role_edges
       </code>
       tables contain information
            about role relationships.
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <code class="literal">
        password_history
       </code>
       table retains
            previously chosen passwords to enable restrictions on
            password reuse. See
       <a class="xref" href="password-management.html" title="8.2.15 Password Management">
        Section 8.2.15, “Password Management”
       </a>
       .
      </p>
     </li>
    </ul>
   </div>
   <p>
    The server reads the contents of the grant tables into memory
        when it starts. You can tell it to reload the tables by issuing
        a
    <a class="link" href="flush.html#flush-privileges">
     <code class="literal">
      FLUSH PRIVILEGES
     </code>
    </a>
    statement or
        executing a
    <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
     <span class="command">
      <strong>
       mysqladmin flush-privileges
      </strong>
     </span>
    </a>
    or
    <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
     <span class="command">
      <strong>
       mysqladmin reload
      </strong>
     </span>
    </a>
    command. Changes to the
        grant tables take effect as indicated in
    <a class="xref" href="privilege-changes.html" title="8.2.13 When Privilege Changes Take Effect">
     Section 8.2.13, “When Privilege Changes Take Effect”
    </a>
    .
   </p>
   <p>
    When you modify an account, it is a good idea to verify that
        your changes have the intended effect. To check the privileges
        for a given account, use the
    <a class="link" href="show-grants.html" title="15.7.7.22 SHOW GRANTS Statement">
     <code class="literal">
      SHOW
        GRANTS
     </code>
    </a>
    statement. For example, to determine the
        privileges that are granted to an account with user name and
        host name values of
    <code class="literal">
     bob
    </code>
    and
    <code class="literal">
     pc84.example.com
    </code>
    , use this statement:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa47206099"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SHOW</span> <span class="token keyword">GRANTS</span> <span class="token keyword">FOR</span> <span class="token string">'bob'</span>@<span class="token string">'pc84.example.com'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    To display nonprivilege properties of an account, use
    <a class="link" href="show-create-user.html" title="15.7.7.13 SHOW CREATE USER Statement">
     <code class="literal">
      SHOW CREATE USER
     </code>
    </a>
    :
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa89663300"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SHOW</span> <span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'bob'</span>@<span class="token string">'pc84.example.com'</span><span class="token punctuation">;</span></code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="grant-tables-user-db">
       </a>
       The user and db Grant Tables
      </h4>
     </div>
    </div>
   </div>
   <p>
    The server uses the
    <code class="literal">
     user
    </code>
    and
    <code class="literal">
     db
    </code>
    tables in the
    <code class="literal">
     mysql
    </code>
    database at both the first and second stages of access control
        (see
    <a class="xref" href="access-control.html" title="8.2 Access Control and Account Management">
     Section 8.2, “Access Control and Account Management”
    </a>
    ). The columns in the
    <code class="literal">
     user
    </code>
    and
    <code class="literal">
     db
    </code>
    tables are
        shown here.
   </p>
   <div class="table">
    <a name="idm46045250562832">
    </a>
    <p class="title">
     <b>
      Table 8.4 user and db Table Columns
     </b>
    </p>
    <div class="table-contents">
     <table>
      <colgroup>
       <col style="width: 40%"/>
       <col style="width: 30%"/>
       <col style="width: 30%"/>
      </colgroup>
      <thead>
       <tr>
        <th scope="col">
         Table Name
        </th>
        <th scope="col">
         <code class="literal">
          user
         </code>
        </th>
        <th scope="col">
         <code class="literal">
          db
         </code>
        </th>
       </tr>
      </thead>
      <tbody>
       <tr>
        <th scope="row">
         <span class="bold">
          <strong>
           Scope columns
          </strong>
         </span>
        </th>
        <td>
         <code class="literal">
          Host
         </code>
        </td>
        <td>
         <code class="literal">
          Host
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          User
         </code>
        </td>
        <td>
         <code class="literal">
          Db
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
        </td>
        <td>
         <code class="literal">
          User
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
         <span class="bold">
          <strong>
           Privilege columns
          </strong>
         </span>
        </th>
        <td>
         <code class="literal">
          Select_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Select_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Insert_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Insert_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Update_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Update_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Delete_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Delete_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Index_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Index_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Alter_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Alter_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Create_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Create_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Drop_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Drop_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Grant_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Grant_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Create_view_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Create_view_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Show_view_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Show_view_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Create_routine_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Create_routine_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Alter_routine_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Alter_routine_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Execute_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Execute_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Trigger_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Trigger_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Event_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Event_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Create_tmp_table_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Create_tmp_table_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Lock_tables_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Lock_tables_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          References_priv
         </code>
        </td>
        <td>
         <code class="literal">
          References_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Reload_priv
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Shutdown_priv
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Process_priv
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          File_priv
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Show_db_priv
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Super_priv
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Repl_slave_priv
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Repl_client_priv
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Create_user_priv
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Create_tablespace_priv
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Create_role_priv
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Drop_role_priv
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
         <span class="bold">
          <strong>
           Security columns
          </strong>
         </span>
        </th>
        <td>
         <code class="literal">
          ssl_type
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          ssl_cipher
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          x509_issuer
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          x509_subject
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          plugin
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          authentication_string
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          password_expired
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          password_last_changed
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          password_lifetime
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          account_locked
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Password_reuse_history
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Password_reuse_time
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Password_require_current
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          User_attributes
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
         <span class="bold">
          <strong>
           Resource control columns
          </strong>
         </span>
        </th>
        <td>
         <code class="literal">
          max_questions
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          max_updates
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          max_connections
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          max_user_connections
         </code>
        </td>
        <td>
        </td>
       </tr>
      </tbody>
     </table>
    </div>
    <div class="table-contents">
     <table cellpadding="0" cellspacing="0" style="position: fixed; top: 0px; display: none; left: 401px; width: 674px;">
      <thead>
       <tr>
        <th scope="col" style="width: 269.344px;">
         Table Name
        </th>
        <th scope="col" style="width: 202.016px;">
         <code class="literal">
          user
         </code>
        </th>
        <th scope="col" style="width: 202.016px;">
         <code class="literal">
          db
         </code>
        </th>
       </tr>
      </thead>
     </table>
    </div>
   </div>
   <br class="table-break"/>
   <p>
    The
    <code class="literal">
     user
    </code>
    table
    <code class="literal">
     plugin
    </code>
    and
    <code class="literal">
     authentication_string
    </code>
    columns store
        authentication plugin and credential information.
   </p>
   <p>
    The server uses the plugin named in the
    <code class="literal">
     plugin
    </code>
    column of an account row to
        authenticate connection attempts for the account.
   </p>
   <p>
    The
    <code class="literal">
     plugin
    </code>
    column must be nonempty. At
        startup, and at runtime when
    <a class="link" href="flush.html#flush-privileges">
     <code class="literal">
      FLUSH
        PRIVILEGES
     </code>
    </a>
    is executed, the server checks
    <code class="literal">
     user
    </code>
    table rows. For any row with an empty
    <code class="literal">
     plugin
    </code>
    column, the server writes a warning to
        the error log of this form:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-none"><div class="docs-select-all right" id="sa84403984"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">[Warning] User entry '<em class="replaceable">user_name</em>'@'<em class="replaceable">host_name</em>' has an empty plugin
value. The user will be ignored and no one can login with this user
anymore.</code></pre>
   </div>
   <p>
    To assign a plugin to an account that is missing one, use the
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    statement.
   </p>
   <p>
    The
    <code class="literal">
     password_expired
    </code>
    column permits DBAs to
        expire account passwords and require users to reset their
        password. The default
    <code class="literal">
     password_expired
    </code>
    value
        is
    <code class="literal">
     'N'
    </code>
    , but can be set to
    <code class="literal">
     'Y'
    </code>
    with the
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER
        USER
     </code>
    </a>
    statement. After an account's password has been
        expired, all operations performed by the account in subsequent
        connections to the server result in an error until the user
        issues an
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    statement to
        establish a new account password.
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     Although it is possible to
     <span class="quote">
      “
      <span class="quote">
       reset
      </span>
      ”
     </span>
     an expired
          password by setting it to its current value, it is preferable,
          as a matter of good policy, to choose a different password.
          DBAs can enforce non-reuse by establishing an appropriate
          password-reuse policy. See
     <a class="xref" href="password-management.html#password-reuse-policy" title="Password Reuse Policy">
      Password Reuse Policy
     </a>
     .
    </p>
   </div>
   <p>
    <code class="literal">
     password_last_changed
    </code>
    is a
    <code class="literal">
     TIMESTAMP
    </code>
    column indicating when the password
        was last changed. The value is non-
    <code class="literal">
     NULL
    </code>
    only
        for accounts that use a MySQL built-in authentication plugin
        (
    <code class="literal">
     mysql_native_password
    </code>
    which is deprecated,
    <code class="literal">
     sha256_password
    </code>
    which is deprecated, or
    <code class="literal">
     caching_sha2_password
    </code>
    ). The value is
    <code class="literal">
     NULL
    </code>
    for other accounts, such as those
        authenticated using an external authentication system.
   </p>
   <p>
    <code class="literal">
     password_last_changed
    </code>
    is updated by the
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    ,
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    , and
    <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
     <code class="literal">
      SET PASSWORD
     </code>
    </a>
    statements, and by
    <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
     <code class="literal">
      GRANT
     </code>
    </a>
    statements that create an
        account or change an account password.
   </p>
   <p>
    <code class="literal">
     password_lifetime
    </code>
    indicates the account
        password lifetime, in days. If the password is past its lifetime
        (assessed using the
    <code class="literal">
     password_last_changed
    </code>
    column), the server considers the password expired when clients
        connect using the account. A value of
    <em class="replaceable">
     <code>
      N
     </code>
    </em>
    greater than zero means that the
        password must be changed every
    <em class="replaceable">
     <code>
      N
     </code>
    </em>
    days. A value of 0 disables automatic password expiration. If
        the value is
    <code class="literal">
     NULL
    </code>
    (the default), the global
        expiration policy applies, as defined by the
    <a class="link" href="server-system-variables.html#sysvar_default_password_lifetime">
     <code class="literal">
      default_password_lifetime
     </code>
    </a>
    system variable.
   </p>
   <a class="indexterm" name="idm46045250327056">
   </a>
   <a class="indexterm" name="idm46045250325984">
   </a>
   <a class="indexterm" name="idm46045250324496">
   </a>
   <p>
    <code class="literal">
     account_locked
    </code>
    indicates whether the account
        is locked (see
    <a class="xref" href="account-locking.html" title="8.2.20 Account Locking">
     Section 8.2.20, “Account Locking”
    </a>
    ).
   </p>
   <p>
    <code class="literal">
     Password_reuse_history
    </code>
    is the value of the
    <code class="literal">
     PASSWORD HISTORY
    </code>
    option for the account, or
    <code class="literal">
     NULL
    </code>
    for the default history.
   </p>
   <p>
    <code class="literal">
     Password_reuse_time
    </code>
    is the value of the
    <code class="literal">
     PASSWORD REUSE INTERVAL
    </code>
    option for the
        account, or
    <code class="literal">
     NULL
    </code>
    for the default interval.
   </p>
   <p>
    <code class="literal">
     Password_require_current
    </code>
    corresponds to the
        value of the
    <code class="literal">
     PASSWORD REQUIRE
    </code>
    option for the
        account, as shown by the following table.
   </p>
   <div class="table">
    <a name="password-require-current-values-table">
    </a>
    <p class="title">
     <b>
      Table 8.5 Permitted Password_require_current Values
     </b>
    </p>
    <div class="table-contents">
     <table summary="Permitted values of the user.Password_require_current column and how they correspond to PASSWORD REQUIRE options.">
      <colgroup>
       <col style="width: 50%"/>
       <col style="width: 50%"/>
      </colgroup>
      <thead>
       <tr>
        <th>
         Password_require_current Value
        </th>
        <th>
         Corresponding PASSWORD REQUIRE Option
        </th>
       </tr>
      </thead>
      <tbody>
       <tr>
        <td>
         <code class="literal">
          'Y'
         </code>
        </td>
        <td>
         <code class="literal">
          PASSWORD REQUIRE CURRENT
         </code>
        </td>
       </tr>
       <tr>
        <td>
         <code class="literal">
          'N'
         </code>
        </td>
        <td>
         <code class="literal">
          PASSWORD REQUIRE CURRENT OPTIONAL
         </code>
        </td>
       </tr>
       <tr>
        <td>
         <code class="literal">
          NULL
         </code>
        </td>
        <td>
         <code class="literal">
          PASSWORD REQUIRE CURRENT DEFAULT
         </code>
        </td>
       </tr>
      </tbody>
     </table>
    </div>
   </div>
   <br class="table-break"/>
   <p>
    <code class="literal">
     User_attributes
    </code>
    is a JSON-format column that
        stores account attributes not stored in other columns. The
    <code class="literal">
     INFORMATION_SCHEMA
    </code>
    exposes these attributes
        through the
    <a class="link" href="information-schema-user-attributes-table.html" title="28.3.45 The INFORMATION_SCHEMA USER_ATTRIBUTES Table">
     <code class="literal">
      USER_ATTRIBUTES
     </code>
    </a>
    table.
   </p>
   <p>
    The
    <code class="literal">
     User_attributes
    </code>
    column may contain these
        attributes:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        additional_password
       </code>
       : The secondary
            password, if any. See
       <a class="xref" href="password-management.html#dual-passwords" title="Dual Password Support">
        Dual Password Support
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        Restrictions
       </code>
       : Restriction lists, if any.
            Restrictions are added by partial-revoke operations. The
            attribute value is an array of elements that each have
       <code class="literal">
        Database
       </code>
       and
       <code class="literal">
        Restrictions
       </code>
       keys indicating the name of
            a restricted database and the applicable restrictions on it
            (see
       <a class="xref" href="partial-revokes.html" title="8.2.12 Privilege Restriction Using Partial Revokes">
        Section 8.2.12, “Privilege Restriction Using Partial Revokes”
       </a>
       ).
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        Password_locking
       </code>
       : The conditions for
            failed-login tracking and temporary account locking, if any
            (see
       <a class="xref" href="password-management.html#failed-login-tracking" title="Failed-Login Tracking and Temporary Account Locking">
        Failed-Login Tracking and Temporary Account Locking
       </a>
       ). The
       <code class="literal">
        Password_locking
       </code>
       attribute is updated
            according to the
       <code class="literal">
        FAILED_LOGIN_ATTEMPTS
       </code>
       and
       <code class="literal">
        PASSWORD_LOCK_TIME
       </code>
       options of the
       <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
        <code class="literal">
         CREATE USER
        </code>
       </a>
       and
       <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
        <code class="literal">
         ALTER USER
        </code>
       </a>
       statements. The
            attribute value is a hash with
       <code class="literal">
        failed_login_attempts
       </code>
       and
       <code class="literal">
        password_lock_time_days
       </code>
       keys indicating
            the value of such options as have been specified for the
            account. If a key is missing, its value is implicitly 0. If
            a key value is implicitly or explicitly 0, the corresponding
            capability is disabled.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        multi_factor_authentication
       </code>
       : Rows in the
       <code class="literal">
        mysql.user
       </code>
       system table have a
       <code class="literal">
        plugin
       </code>
       column that indicates an
            authentication plugin. For single-factor authentication,
            that plugin is the only authentication factor. For
            two-factor or three-factor forms of multifactor
            authentication, that plugin corresponds to the first
            authentication factor, but additional information must be
            stored for the second and third factors. The
       <code class="literal">
        multi_factor_authentication
       </code>
       attribute
            holds this information.
      </p>
      <p>
       The
       <code class="literal">
        multi_factor_authentication
       </code>
       value is
            an array, where each array element is a hash that describes
            an authentication factor using these attributes:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <code class="literal">
           plugin
          </code>
          : The name of the
                authentication plugin.
         </p>
        </li>
        <li class="listitem">
         <p>
          <code class="literal">
           authentication_string
          </code>
          : The
                authentication string value.
         </p>
        </li>
        <li class="listitem">
         <p>
          <code class="literal">
           passwordless
          </code>
          : A flag that denotes
                whether the user is meant to be used without a password
                (with a security token as the only authentication
                method).
         </p>
        </li>
        <li class="listitem">
         <p>
          <code class="literal">
           requires_registration
          </code>
          : a flag that
                defines whether the user account has registered a
                security token.
         </p>
        </li>
       </ul>
      </div>
      <p>
       The first and second array elements describe multifactor
            authentication factors 2 and 3.
      </p>
     </li>
    </ul>
   </div>
   <p>
    If no attributes apply,
    <code class="literal">
     User_attributes
    </code>
    is
    <code class="literal">
     NULL
    </code>
    .
   </p>
   <p>
    Example: An account that has a secondary password and partially
        revoked database privileges has
    <code class="literal">
     additional_password
    </code>
    and
    <code class="literal">
     Restrictions
    </code>
    attributes in the column value:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa55129394"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> User_attributes <span class="token keyword">FROM</span> mysql<span class="token punctuation">.</span><span class="token keyword">User</span> <span class="token keyword">WHERE</span> <span class="token keyword">User</span> <span class="token operator">=</span> <span class="token string">'u'</span>\G
<span class="token output"><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span> 1. row <span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span>
User_attributes<span class="token punctuation">:</span> {"Restrictions"<span class="token punctuation">:</span>
                   [{"Database"<span class="token punctuation">:</span> "mysql", "Privileges"<span class="token punctuation">:</span> ["SELECT"]}],
                  "additional_password"<span class="token punctuation">:</span> "<em class="replaceable">hashed_credentials</em>"}</span></code></pre>
   </div>
   <p>
    To determine which attributes are present, use the
    <a class="link" href="json-search-functions.html#function_json-keys">
     <code class="literal">
      JSON_KEYS()
     </code>
    </a>
    function:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa36367215"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> <span class="token keyword">User</span><span class="token punctuation">,</span> <span class="token keyword">Host</span><span class="token punctuation">,</span> <span class="token function">JSON_KEYS</span><span class="token punctuation">(</span>User_attributes<span class="token punctuation">)</span>
<span class="token keyword">FROM</span> mysql<span class="token punctuation">.</span><span class="token keyword">user</span> <span class="token keyword">WHERE</span> User_attributes <span class="token operator">IS</span> <span class="token operator">NOT</span> <span class="token boolean">NULL</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    To extract a particular attribute, such as
    <code class="literal">
     Restrictions
    </code>
    , do this:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa25013096"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> <span class="token keyword">User</span><span class="token punctuation">,</span> <span class="token keyword">Host</span><span class="token punctuation">,</span> User_attributes<span class="token operator">-</span><span class="token operator">&gt;&gt;</span><span class="token string">'$.Restrictions'</span>
<span class="token keyword">FROM</span> mysql<span class="token punctuation">.</span><span class="token keyword">user</span> <span class="token keyword">WHERE</span> User_attributes<span class="token operator">-</span><span class="token operator">&gt;&gt;</span><span class="token string">'$.Restrictions'</span> <span class="token operator">&lt;&gt;</span> <span class="token string">''</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Here is an example of the kind of information stored for
    <code class="literal">
     multi_factor_authentication
    </code>
    :
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa154998"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"multi_factor_authentication"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
    <span class="token punctuation">{</span>
      <span class="token property">"plugin"</span><span class="token operator">:</span> <span class="token string">"authentication_ldap_simple"</span><span class="token punctuation">,</span>
      <span class="token property">"passwordless"</span><span class="token operator">:</span> <span class="token number">0</span><span class="token punctuation">,</span>
      <span class="token property">"authentication_string"</span><span class="token operator">:</span> <span class="token string">"ldap auth string"</span><span class="token punctuation">,</span>
      <span class="token property">"requires_registration"</span><span class="token operator">:</span> <span class="token number">0</span>
    <span class="token punctuation">}</span><span class="token punctuation">,</span>
    <span class="token punctuation">{</span>
      <span class="token property">"plugin"</span><span class="token operator">:</span> <span class="token string">"authentication_webauthn"</span><span class="token punctuation">,</span>
      <span class="token property">"passwordless"</span><span class="token operator">:</span> <span class="token number">0</span><span class="token punctuation">,</span>
      <span class="token property">"authentication_string"</span><span class="token operator">:</span> <span class="token string">""</span><span class="token punctuation">,</span>
      <span class="token property">"requires_registration"</span><span class="token operator">:</span> <span class="token number">1</span>
    <span class="token punctuation">}</span>
  <span class="token punctuation">]</span>
<span class="token punctuation">}</span></code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="grant-tables-tables-priv-columns-priv">
       </a>
       The tables_priv and columns_priv Grant Tables
      </h4>
     </div>
    </div>
   </div>
   <p>
    During the second stage of access control, the server performs
        request verification to ensure that each client has sufficient
        privileges for each request that it issues. In addition to the
    <code class="literal">
     user
    </code>
    and
    <code class="literal">
     db
    </code>
    grant tables,
        the server may also consult the
    <code class="literal">
     tables_priv
    </code>
    and
    <code class="literal">
     columns_priv
    </code>
    tables for requests that
        involve tables. The latter tables provide finer privilege
        control at the table and column levels. They have the columns
        shown in the following table.
   </p>
   <div class="table">
    <a name="idm46045250247296">
    </a>
    <p class="title">
     <b>
      Table 8.6 tables_priv and columns_priv Table Columns
     </b>
    </p>
    <div class="table-contents">
     <table>
      <colgroup>
       <col style="width: 20%"/>
       <col style="width: 20%"/>
       <col style="width: 20%"/>
      </colgroup>
      <thead>
       <tr>
        <th scope="col">
         Table Name
        </th>
        <th scope="col">
         <code class="literal">
          tables_priv
         </code>
        </th>
        <th scope="col">
         <code class="literal">
          columns_priv
         </code>
        </th>
       </tr>
      </thead>
      <tbody>
       <tr>
        <th scope="row">
         <span class="bold">
          <strong>
           Scope columns
          </strong>
         </span>
        </th>
        <td>
         <code class="literal">
          Host
         </code>
        </td>
        <td>
         <code class="literal">
          Host
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Db
         </code>
        </td>
        <td>
         <code class="literal">
          Db
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          User
         </code>
        </td>
        <td>
         <code class="literal">
          User
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Table_name
         </code>
        </td>
        <td>
         <code class="literal">
          Table_name
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
        </td>
        <td>
         <code class="literal">
          Column_name
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
         <span class="bold">
          <strong>
           Privilege columns
          </strong>
         </span>
        </th>
        <td>
         <code class="literal">
          Table_priv
         </code>
        </td>
        <td>
         <code class="literal">
          Column_priv
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Column_priv
         </code>
        </td>
        <td>
        </td>
       </tr>
       <tr>
        <th scope="row">
         <span class="bold">
          <strong>
           Other columns
          </strong>
         </span>
        </th>
        <td>
         <code class="literal">
          Timestamp
         </code>
        </td>
        <td>
         <code class="literal">
          Timestamp
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
        </th>
        <td>
         <code class="literal">
          Grantor
         </code>
        </td>
        <td>
        </td>
       </tr>
      </tbody>
     </table>
    </div>
   </div>
   <br class="table-break"/>
   <p>
    The
    <code class="literal">
     Timestamp
    </code>
    and
    <code class="literal">
     Grantor
    </code>
    columns are set to the current timestamp and the
    <a class="link" href="information-functions.html#function_current-user">
     <code class="literal">
      CURRENT_USER
     </code>
    </a>
    value, respectively,
        but are otherwise unused.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="grant-tables-procs-priv">
       </a>
       The procs_priv Grant Table
      </h4>
     </div>
    </div>
   </div>
   <p>
    For verification of requests that involve stored routines, the
        server may consult the
    <code class="literal">
     procs_priv
    </code>
    table,
        which has the columns shown in the following table.
   </p>
   <div class="table">
    <a name="idm46045250197632">
    </a>
    <p class="title">
     <b>
      Table 8.7 procs_priv Table Columns
     </b>
    </p>
    <div class="table-contents">
     <table>
      <colgroup>
       <col style="width: 20%"/>
       <col style="width: 20%"/>
      </colgroup>
      <thead>
       <tr>
        <th>
         Table Name
        </th>
        <th>
         <code class="literal">
          procs_priv
         </code>
        </th>
       </tr>
      </thead>
      <tbody>
       <tr>
        <td>
         <span class="bold">
          <strong>
           Scope columns
          </strong>
         </span>
        </td>
        <td>
         <code class="literal">
          Host
         </code>
        </td>
       </tr>
       <tr>
        <td>
        </td>
        <td>
         <code class="literal">
          Db
         </code>
        </td>
       </tr>
       <tr>
        <td>
        </td>
        <td>
         <code class="literal">
          User
         </code>
        </td>
       </tr>
       <tr>
        <td>
        </td>
        <td>
         <code class="literal">
          Routine_name
         </code>
        </td>
       </tr>
       <tr>
        <td>
        </td>
        <td>
         <code class="literal">
          Routine_type
         </code>
        </td>
       </tr>
       <tr>
        <td>
         <span class="bold">
          <strong>
           Privilege columns
          </strong>
         </span>
        </td>
        <td>
         <code class="literal">
          Proc_priv
         </code>
        </td>
       </tr>
       <tr>
        <td>
         <span class="bold">
          <strong>
           Other columns
          </strong>
         </span>
        </td>
        <td>
         <code class="literal">
          Timestamp
         </code>
        </td>
       </tr>
       <tr>
        <td>
        </td>
        <td>
         <code class="literal">
          Grantor
         </code>
        </td>
       </tr>
      </tbody>
     </table>
    </div>
   </div>
   <br class="table-break"/>
   <p>
    The
    <code class="literal">
     Routine_type
    </code>
    column is an
    <a class="link" href="enum.html" title="13.3.5 The ENUM Type">
     <code class="literal">
      ENUM
     </code>
    </a>
    column with values of
    <code class="literal">
     'FUNCTION'
    </code>
    or
    <code class="literal">
     'PROCEDURE'
    </code>
    to indicate the type of routine the row refers to. This column
        enables privileges to be granted separately for a function and a
        procedure with the same name.
   </p>
   <p>
    The
    <code class="literal">
     Timestamp
    </code>
    and
    <code class="literal">
     Grantor
    </code>
    columns are unused.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="grant-tables-proxies-priv">
       </a>
       The proxies_priv Grant Table
      </h4>
     </div>
    </div>
   </div>
   <p>
    The
    <code class="literal">
     proxies_priv
    </code>
    table records information
        about proxy accounts. It has these columns:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        Host
       </code>
       ,
       <code class="literal">
        User
       </code>
       : The proxy
            account; that is, the account that has the
       <a class="link" href="privileges-provided.html#priv_proxy">
        <code class="literal">
         PROXY
        </code>
       </a>
       privilege for the
            proxied account.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        Proxied_host
       </code>
       ,
       <code class="literal">
        Proxied_user
       </code>
       : The proxied account.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        Grantor
       </code>
       ,
       <code class="literal">
        Timestamp
       </code>
       :
            Unused.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        With_grant
       </code>
       : Whether the proxy account can
            grant the
       <a class="link" href="privileges-provided.html#priv_proxy">
        <code class="literal">
         PROXY
        </code>
       </a>
       privilege to
            other accounts.
      </p>
     </li>
    </ul>
   </div>
   <p>
    For an account to be able to grant the
    <a class="link" href="privileges-provided.html#priv_proxy">
     <code class="literal">
      PROXY
     </code>
    </a>
    privilege to other
        accounts, it must have a row in the
    <code class="literal">
     proxies_priv
    </code>
    table with
    <code class="literal">
     With_grant
    </code>
    set to 1 and
    <code class="literal">
     Proxied_host
    </code>
    and
    <code class="literal">
     Proxied_user
    </code>
    set to indicate the account or
        accounts for which the privilege can be granted. For example,
        the
    <code class="literal">
     'root'@'localhost'
    </code>
    account created during
        MySQL installation has a row in the
    <code class="literal">
     proxies_priv
    </code>
    table that enables granting the
    <a class="link" href="privileges-provided.html#priv_proxy">
     <code class="literal">
      PROXY
     </code>
    </a>
    privilege for
    <code class="literal">
     ''@''
    </code>
    , that is, for all users and all hosts.
        This enables
    <code class="literal">
     root
    </code>
    to set up proxy users, as
        well as to delegate to other accounts the authority to set up
        proxy users. See
    <a class="xref" href="proxy-users.html" title="8.2.19 Proxy Users">
     Section 8.2.19, “Proxy Users”
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="grant-tables-global-grants">
       </a>
       The global_grants Grant Table
      </h4>
     </div>
    </div>
   </div>
   <p>
    The
    <code class="literal">
     global_grants
    </code>
    table lists current
        assignments of dynamic global privileges to user accounts. The
        table has these columns:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        USER
       </code>
       ,
       <code class="literal">
        HOST
       </code>
       : The user
            name and host name of the account to which the privilege is
            granted.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PRIV
       </code>
       : The privilege name.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        WITH_GRANT_OPTION
       </code>
       : Whether the account
            can grant the privilege to other accounts.
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="grant-tables-default-roles">
       </a>
       The default_roles Grant Table
      </h4>
     </div>
    </div>
   </div>
   <p>
    The
    <code class="literal">
     default_roles
    </code>
    table lists default user
        roles. It has these columns:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        HOST
       </code>
       ,
       <code class="literal">
        USER
       </code>
       : The
            account or role to which the default role applies.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        DEFAULT_ROLE_HOST
       </code>
       ,
       <code class="literal">
        DEFAULT_ROLE_USER
       </code>
       : The default role.
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="grant-tables-role-edges">
       </a>
       The role_edges Grant Table
      </h4>
     </div>
    </div>
   </div>
   <p>
    The
    <code class="literal">
     role_edges
    </code>
    table lists edges for role
        subgraphs. It has these columns:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        FROM_HOST
       </code>
       ,
       <code class="literal">
        FROM_USER
       </code>
       :
            The account that is granted a role.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        TO_HOST
       </code>
       ,
       <code class="literal">
        TO_USER
       </code>
       : The
            role that is granted to the account.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        WITH_ADMIN_OPTION
       </code>
       : Whether the account
            can grant the role to and revoke it from other accounts by
            using
       <code class="literal">
        WITH ADMIN OPTION
       </code>
       .
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="grant-tables-password-history">
       </a>
       The password_history Grant Table
      </h4>
     </div>
    </div>
   </div>
   <p>
    The
    <code class="literal">
     password_history
    </code>
    table contains
        information about password changes. It has these columns:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        Host
       </code>
       ,
       <code class="literal">
        User
       </code>
       : The
            account for which the password change occurred.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        Password_timestamp
       </code>
       : The time when the
            password change occurred.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        Password
       </code>
       : The new password hash value.
      </p>
     </li>
    </ul>
   </div>
   <p>
    The
    <code class="literal">
     password_history
    </code>
    table accumulates a
        sufficient number of nonempty passwords per account to enable
        MySQL to perform checks against both the account password
        history length and reuse interval. Automatic pruning of entries
        that are outside both limits occurs when password-change
        attempts occur.
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     The empty password does not count in the password history and
          is subject to reuse at any time.
    </p>
   </div>
   <p>
    If an account is renamed, its entries are renamed to match. If
        an account is dropped or its authentication plugin is changed,
        its entries are removed.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="grant-tables-scope-column-properties">
       </a>
       Grant Table Scope Column Properties
      </h4>
     </div>
    </div>
   </div>
   <p>
    Scope columns in the grant tables contain strings. The default
        value for each is the empty string. The following table shows
        the number of characters permitted in each column.
   </p>
   <div class="table">
    <a name="idm46045250103728">
    </a>
    <p class="title">
     <b>
      Table 8.8 Grant Table Scope Column Lengths
     </b>
    </p>
    <div class="table-contents">
     <table>
      <colgroup>
       <col style="width: 50%"/>
       <col style="width: 50%"/>
      </colgroup>
      <thead>
       <tr>
        <th>
         Column Name
        </th>
        <th>
         Maximum Permitted Characters
        </th>
       </tr>
      </thead>
      <tbody>
       <tr>
        <td>
         <code class="literal">
          Host
         </code>
         ,
         <code class="literal">
          Proxied_host
         </code>
        </td>
        <td>
         255
        </td>
       </tr>
       <tr>
        <td>
         <code class="literal">
          User
         </code>
         ,
         <code class="literal">
          Proxied_user
         </code>
        </td>
        <td>
         32
        </td>
       </tr>
       <tr>
        <td>
         <code class="literal">
          Db
         </code>
        </td>
        <td>
         64
        </td>
       </tr>
       <tr>
        <td>
         <code class="literal">
          Table_name
         </code>
        </td>
        <td>
         64
        </td>
       </tr>
       <tr>
        <td>
         <code class="literal">
          Column_name
         </code>
        </td>
        <td>
         64
        </td>
       </tr>
       <tr>
        <td>
         <code class="literal">
          Routine_name
         </code>
        </td>
        <td>
         64
        </td>
       </tr>
      </tbody>
     </table>
    </div>
   </div>
   <br class="table-break"/>
   <a class="indexterm" name="idm46045250081808">
   </a>
   <a class="indexterm" name="idm46045250080320">
   </a>
   <p>
    <code class="literal">
     Host
    </code>
    and
    <code class="literal">
     Proxied_host
    </code>
    values are converted to lowercase before being stored in the
        grant tables.
   </p>
   <p>
    For access-checking purposes, comparisons of
    <code class="literal">
     User
    </code>
    ,
    <code class="literal">
     Proxied_user
    </code>
    ,
    <code class="literal">
     authentication_string
    </code>
    ,
    <code class="literal">
     Db
    </code>
    ,
        and
    <code class="literal">
     Table_name
    </code>
    values are case-sensitive.
        Comparisons of
    <code class="literal">
     Host
    </code>
    ,
    <code class="literal">
     Proxied_host
    </code>
    ,
    <code class="literal">
     Column_name
    </code>
    ,
        and
    <code class="literal">
     Routine_name
    </code>
    values are not
        case-sensitive.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="grant-tables-privilege-column-properties">
       </a>
       Grant Table Privilege Column Properties
      </h4>
     </div>
    </div>
   </div>
   <p>
    The
    <code class="literal">
     user
    </code>
    and
    <code class="literal">
     db
    </code>
    tables
        list each privilege in a separate column that is declared as
    <code class="literal">
     ENUM('N','Y') DEFAULT 'N'
    </code>
    . In other words,
        each privilege can be disabled or enabled, with the default
        being disabled.
   </p>
   <p>
    The
    <code class="literal">
     tables_priv
    </code>
    ,
    <code class="literal">
     columns_priv
    </code>
    , and
    <code class="literal">
     procs_priv
    </code>
    tables declare the privilege
        columns as
    <a class="link" href="set.html" title="13.3.6 The SET Type">
     <code class="literal">
      SET
     </code>
    </a>
    columns. Values in
        these columns can contain any combination of the privileges
        controlled by the table. Only those privileges listed in the
        column value are enabled.
   </p>
   <div class="table">
    <a name="idm46045250062128">
    </a>
    <p class="title">
     <b>
      Table 8.9 Set-Type Privilege Column Values
     </b>
    </p>
    <div class="table-contents">
     <table>
      <colgroup>
       <col style="width: 20%"/>
       <col style="width: 25%"/>
       <col style="width: 45%"/>
      </colgroup>
      <thead>
       <tr>
        <th scope="col">
         Table Name
        </th>
        <th scope="col">
         Column Name
        </th>
        <th scope="col">
         Possible Set Elements
        </th>
       </tr>
      </thead>
      <tbody>
       <tr>
        <th scope="row">
         <code class="literal">
          tables_priv
         </code>
        </th>
        <td>
         <code class="literal">
          Table_priv
         </code>
        </td>
        <td>
         <code class="literal">
          'Select', 'Insert', 'Update', 'Delete', 'Create', 'Drop',
              'Grant', 'References', 'Index', 'Alter', 'Create View',
              'Show view', 'Trigger'
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          tables_priv
         </code>
        </th>
        <td>
         <code class="literal">
          Column_priv
         </code>
        </td>
        <td>
         <code class="literal">
          'Select', 'Insert', 'Update', 'References'
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          columns_priv
         </code>
        </th>
        <td>
         <code class="literal">
          Column_priv
         </code>
        </td>
        <td>
         <code class="literal">
          'Select', 'Insert', 'Update', 'References'
         </code>
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          procs_priv
         </code>
        </th>
        <td>
         <code class="literal">
          Proc_priv
         </code>
        </td>
        <td>
         <code class="literal">
          'Execute', 'Alter Routine', 'Grant'
         </code>
        </td>
       </tr>
      </tbody>
     </table>
    </div>
   </div>
   <br class="table-break"/>
   <p>
    Only the
    <code class="literal">
     user
    </code>
    and
    <code class="literal">
     global_grants
    </code>
    tables specify administrative
        privileges, such as
    <a class="link" href="privileges-provided.html#priv_reload">
     <code class="literal">
      RELOAD
     </code>
    </a>
    ,
    <a class="link" href="privileges-provided.html#priv_shutdown">
     <code class="literal">
      SHUTDOWN
     </code>
    </a>
    , and
    <a class="link" href="privileges-provided.html#priv_system-variables-admin">
     <code class="literal">
      SYSTEM_VARIABLES_ADMIN
     </code>
    </a>
    .
        Administrative operations are operations on the server itself
        and are not database-specific, so there is no reason to list
        these privileges in the other grant tables. Consequently, the
        server need consult only the
    <code class="literal">
     user
    </code>
    and
    <code class="literal">
     global_grants
    </code>
    tables to determine whether a
        user can perform an administrative operation.
   </p>
   <p>
    The
    <a class="link" href="privileges-provided.html#priv_file">
     <code class="literal">
      FILE
     </code>
    </a>
    privilege also is
        specified only in the
    <code class="literal">
     user
    </code>
    table. It is not
        an administrative privilege as such, but a user's ability to
        read or write files on the server host is independent of the
        database being accessed.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="grant-tables-concurrency">
       </a>
       Grant Table Concurrency
      </h4>
     </div>
    </div>
   </div>
   <p>
    To permit concurrent DML and DDL operations on MySQL grant
        tables, read operations that previously acquired row locks on
        MySQL grant tables are executed as non-locking reads. Operations
        that are performed as non-locking reads on MySQL grant tables
        include:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a class="link" href="select.html" title="15.2.13 SELECT Statement">
        <code class="literal">
         SELECT
        </code>
       </a>
       statements and other
            read-only statements that read data from grant tables
            through join lists and subqueries, including
       <a class="link" href="innodb-locking-reads.html" title="17.7.2.4 Locking Reads">
        <code class="literal">
         SELECT
            ... FOR SHARE
        </code>
       </a>
       statements, using any transaction
            isolation level.
      </p>
     </li>
     <li class="listitem">
      <p>
       DML operations that read data from grant tables (through
            join lists or subqueries) but do not modify them, using any
            transaction isolation level.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Statements that no longer acquire row locks when reading data
        from grant tables report a warning if executed while using
        statement-based replication.
   </p>
   <p>
    When using
        -
    <a class="link" href="replication-options-binary-log.html#sysvar_binlog_format">
     <code class="literal">
      binlog_format=mixed
     </code>
    </a>
    , DML
        operations that read data from grant tables are written to the
        binary log as row events to make the operations safe for
        mixed-mode replication.
   </p>
   <p>
    <a class="link" href="innodb-locking-reads.html" title="17.7.2.4 Locking Reads">
     <code class="literal">
      SELECT ...
        FOR SHARE
     </code>
    </a>
    statements that read data from grant tables
        report a warning. With the
    <code class="literal">
     FOR SHARE
    </code>
    clause,
        read locks are not supported on grant tables.
   </p>
   <p>
    DML operations that read data from grant tables and are executed
        using the
    <a class="link" href="innodb-transaction-isolation-levels.html#isolevel_serializable">
     <code class="literal">
      SERIALIZABLE
     </code>
    </a>
    isolation level report a warning. Read locks that would normally
        be acquired when using the
    <a class="link" href="innodb-transaction-isolation-levels.html#isolevel_serializable">
     <code class="literal">
      SERIALIZABLE
     </code>
    </a>
    isolation level
        are not supported on grant tables.
   </p>
  </div>
 </div>
 <br/>
</div>
