<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="replication-howto-repuser">
      </a>
      19.1.2.3 Creating a User for Replication
     </h4>
    </div>
   </div>
  </div>
  <p>
   Each replica connects to the source using a MySQL user name and
        password, so there must be a user account on the source that the
        replica can use to connect. The user name is specified by the
   <code class="literal">
    SOURCE_USER
   </code>
   option of the
   <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
    <code class="literal">
     CHANGE REPLICATION SOURCE TO
    </code>
   </a>
   statement when you set up a replica. Any account can be used for
        this operation, providing it has been granted the
   <a class="link" href="privileges-provided.html#priv_replication-slave">
    <code class="literal">
     REPLICATION SLAVE
    </code>
   </a>
   privilege. You
        can choose to create a different account for each replica, or
        connect to the source using the same account for each replica.
  </p>
  <p>
   Although you do not have to create an account specifically for
        replication, you should be aware that the replication user name
        and password are stored in plain text in the replica's
        connection metadata repository
   <code class="literal">
    mysql.slave_master_info
   </code>
   (see
   <a class="xref" href="replica-logs-status.html" title="19.2.4.2 Replication Metadata Repositories">
    Section 19.2.4.2, “Replication Metadata Repositories”
   </a>
   ). Therefore, you may want
        to create a separate account that has privileges only for the
        replication process, to minimize the possibility of compromise
        to other accounts.
  </p>
  <p>
   To create a new account, use
   <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
    <code class="literal">
     CREATE
        USER
    </code>
   </a>
   . To grant this account the privileges required
        for replication, use the
   <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
    <code class="literal">
     GRANT
    </code>
   </a>
   statement. If you create an account solely for the purposes of
        replication, that account needs only the
   <a class="link" href="privileges-provided.html#priv_replication-slave">
    <code class="literal">
     REPLICATION SLAVE
    </code>
   </a>
   privilege. For
        example, to set up a new user,
   <code class="literal">
    repl
   </code>
   , that can
        connect for replication from any host within the
   <code class="literal">
    example.com
   </code>
   domain, issue these statements on
        the source:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa91957652"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'repl'</span>@<span class="token string">'%.example.com'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">GRANT</span> <span class="token keyword">REPLICATION</span> <span class="token keyword">SLAVE</span> <span class="token keyword">ON</span> <span class="token operator">*</span><span class="token punctuation">.</span><span class="token operator">*</span> <span class="token keyword">TO</span> <span class="token string">'repl'</span>@<span class="token string">'%.example.com'</span><span class="token punctuation">;</span></code></pre>
  </div>
  <p>
   See
   <a class="xref" href="account-management-statements.html" title="15.7.1 Account Management Statements">
    Section 15.7.1, “Account Management Statements”
   </a>
   , for more
        information on statements for manipulation of user accounts.
  </p>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    To connect to the source using a user account that
          authenticates with the
    <code class="literal">
     caching_sha2_password
    </code>
    plugin, you must
          either set up a secure connection as described in
    <a class="xref" href="replication-encrypted-connections.html" title="19.3.1 Setting Up Replication to Use Encrypted Connections">
     Section 19.3.1, “Setting Up Replication to Use Encrypted Connections”
    </a>
    , or enable
          the unencrypted connection to support password exchange using
          an RSA key pair. The
    <code class="literal">
     caching_sha2_password
    </code>
    authentication plugin is the default for new users (see
    <a class="xref" href="caching-sha2-pluggable-authentication.html" title="8.4.1.2 Caching SHA-2 Pluggable Authentication">
     Section 8.4.1.2, “Caching SHA-2 Pluggable Authentication”
    </a>
    ). If
          the user account that you create or use for replication (as
          specified by the
    <code class="literal">
     SOURCE_USER
    </code>
    option) uses
          this authentication plugin, and you are not using a secure
          connection, you must enable RSA key pair-based password
          exchange for a successful connection.
   </p>
  </div>
 </div>
 <br/>
</div>
