<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="replication-privilege-checks-gr">
      </a>
      19.3.3.2 Privilege Checks For Group Replication Channels
     </h4>
    </div>
   </div>
  </div>
  <p>
   You can also use a
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   account to secure the two replication applier threads used by
        Group Replication. The
   <code class="literal">
    group_replication_applier
   </code>
   thread on each
        group member is used for applying group transactions, and the
   <code class="literal">
    group_replication_recovery
   </code>
   thread on each
        group member is used for state transfer from the binary log as
        part of distributed recovery when the member joins or rejoins
        the group.
  </p>
  <p>
   To secure one of these threads, stop Group Replication, then
        issue the
   <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
    <code class="literal">
     CHANGE REPLICATION SOURCE
        TO
    </code>
   </a>
   statement with the
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   option, specifying
   <code class="literal">
    group_replication_applier
   </code>
   or
   <code class="literal">
    group_replication_recovery
   </code>
   as the channel
        name. For example:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa26865968"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">STOP</span> <span class="token keyword">GROUP_REPLICATION</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">CHANGE</span> <span class="token keyword">REPLICATION</span> <span class="token keyword">SOURCE</span> <span class="token keyword">TO</span> <span class="token keyword">PRIVILEGE_CHECKS_USER</span> <span class="token operator">=</span> <span class="token string">'gr_repl'</span>@<span class="token string">'%.example.com'</span> 
          <span class="token keyword">FOR</span> <span class="token keyword">CHANNEL</span> <span class="token string">'group_replication_recovery'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">FLUSH</span> <span class="token keyword">PRIVILEGES</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">START</span> <span class="token keyword">GROUP_REPLICATION</span><span class="token punctuation">;</span></code></pre>
  </div>
  <p>
   For Group Replication channels, the
   <code class="literal">
    REQUIRE_ROW_FORMAT
   </code>
   setting is automatically
        enabled when the channel is created, and cannot be disabled, so
        you do not need to specify this.
  </p>
  <p>
   Group Replication requires every table that is to be replicated
        by the group to have a defined primary key, or primary key
        equivalent where the equivalent is a non-null unique key. Rather
        than using the checks carried out by the
   <a class="link" href="server-system-variables.html#sysvar_sql_require_primary_key">
    <code class="literal">
     sql_require_primary_key
    </code>
   </a>
   system
        variable, Group Replication has its own built-in set of checks
        for primary keys or primary key equivalents. You may set the
   <code class="literal">
    REQUIRE_TABLE_PRIMARY_KEY_CHECK
   </code>
   option of the
   <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
    <code class="literal">
     CHANGE REPLICATION SOURCE TO
    </code>
   </a>
   statement to
   <code class="literal">
    ON
   </code>
   for a Group Replication
        channel. However, be aware that you might find some transactions
        that are permitted under Group Replication's built-in checks are
        not permitted under the checks carried out when you set
   <code class="literal">
    sql_require_primary_key = ON
   </code>
   or
   <code class="literal">
    REQUIRE_TABLE_PRIMARY_KEY_CHECK = ON
   </code>
   . For
        this reason, new and upgraded Group Replication channels have
   <code class="literal">
    REQUIRE_TABLE_PRIMARY_KEY_CHECK
   </code>
   set to the
        default value
   <code class="literal">
    STREAM
   </code>
   , rather than
   <code class="literal">
    ON
   </code>
   .
  </p>
  <p>
   If a remote cloning operation is used for distributed recovery
        in Group Replication (see
   <a class="xref" href="group-replication-cloning.html" title="20.5.4.2 Cloning for Distributed Recovery">
    Section 20.5.4.2, “Cloning for Distributed Recovery”
   </a>
   ), the
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   account and related
        settings from the donor are cloned to the joining member. If the
        joining member is set to start Group Replication on boot, it
        automatically uses the account for privilege checks on the
        appropriate replication channels.
  </p>
 </div>
 <br/>
</div>
