<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="alter-user">
      </a>
      15.7.1.1 ALTER USER Statement
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045175181984">
  </a>
  <a class="indexterm" name="idm46045175180912">
  </a>
  <a class="indexterm" name="idm46045175179424">
  </a>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa38692132"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token punctuation">[</span><span class="token keyword">IF</span> <span class="token keyword">EXISTS</span><span class="token punctuation">]</span>
    <span class="token keyword"><em class="replaceable">user</em></span> <span class="token punctuation">[</span><em class="replaceable">auth_option</em><span class="token punctuation">]</span> <span class="token punctuation">[</span><span class="token punctuation">,</span> <span class="token keyword"><em class="replaceable">user</em></span> <span class="token punctuation">[</span><em class="replaceable">auth_option</em><span class="token punctuation">]</span><span class="token punctuation">]</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span>
    <span class="token punctuation">[</span><span class="token keyword">REQUIRE</span> {<span class="token keyword">NONE</span> <span class="token operator">|</span> <em class="replaceable">tls_option</em> <span class="token punctuation">[</span><span class="token punctuation">[</span><span class="token operator">AND</span><span class="token punctuation">]</span> <em class="replaceable">tls_option</em><span class="token punctuation">]</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span>}<span class="token punctuation">]</span>
    <span class="token punctuation">[</span><span class="token keyword">WITH</span> <em class="replaceable">resource_option</em> <span class="token punctuation">[</span><em class="replaceable">resource_option</em><span class="token punctuation">]</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">]</span>
    <span class="token punctuation">[</span><em class="replaceable">password_option</em> <span class="token operator">|</span> <em class="replaceable">lock_option</em><span class="token punctuation">]</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span>
    <span class="token punctuation">[</span><span class="token keyword">COMMENT</span> <span class="token string">'<em class="replaceable">comment_string</em>'</span> <span class="token operator">|</span> <span class="token keyword">ATTRIBUTE</span> <span class="token string">'<em class="replaceable">json_object</em>'</span><span class="token punctuation">]</span>

<span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token punctuation">[</span><span class="token keyword">IF</span> <span class="token keyword">EXISTS</span><span class="token punctuation">]</span>
    <span class="token function">USER</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <em class="replaceable">user_func_auth_option</em>

<span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token punctuation">[</span><span class="token keyword">IF</span> <span class="token keyword">EXISTS</span><span class="token punctuation">]</span>
    <span class="token keyword"><em class="replaceable">user</em></span> <span class="token punctuation">[</span><em class="replaceable">registration_option</em><span class="token punctuation">]</span>

<span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token punctuation">[</span><span class="token keyword">IF</span> <span class="token keyword">EXISTS</span><span class="token punctuation">]</span>
    <span class="token function">USER</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token punctuation">[</span><em class="replaceable">registration_option</em><span class="token punctuation">]</span>

<span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token punctuation">[</span><span class="token keyword">IF</span> <span class="token keyword">EXISTS</span><span class="token punctuation">]</span>
    <span class="token keyword"><em class="replaceable">user</em></span> <span class="token keyword">DEFAULT</span> <span class="token keyword">ROLE</span>
    {<span class="token keyword">NONE</span> <span class="token operator">|</span> <span class="token keyword">ALL</span> <span class="token operator">|</span> <span class="token keyword"><em class="replaceable">role</em></span> <span class="token punctuation">[</span><span class="token punctuation">,</span> <span class="token keyword"><em class="replaceable">role</em></span> <span class="token punctuation">]</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span>}

<span class="token keyword"><em class="replaceable">user</em></span>:
    <span class="token punctuation">(</span>see Section <span class="token number">8.2</span><span class="token punctuation">.</span><span class="token number">4</span><span class="token punctuation">,</span> “Specifying <span class="token keyword">Account</span> <span class="token keyword">Names</span>”<span class="token punctuation">)</span>

<em class="replaceable">auth_option</em>: {
    <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>
        <span class="token punctuation">[</span><span class="token keyword">REPLACE</span> <span class="token string">'<em class="replaceable">current_auth_string</em>'</span><span class="token punctuation">]</span>
        <span class="token punctuation">[</span><span class="token keyword">RETAIN</span> <span class="token keyword">CURRENT</span> <span class="token keyword">PASSWORD</span><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span>
        <span class="token punctuation">[</span><span class="token keyword">REPLACE</span> <span class="token string">'<em class="replaceable">current_auth_string</em>'</span><span class="token punctuation">]</span>
        <span class="token punctuation">[</span><span class="token keyword">RETAIN</span> <span class="token keyword">CURRENT</span> <span class="token keyword">PASSWORD</span><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>
        <span class="token punctuation">[</span><span class="token keyword">REPLACE</span> <span class="token string">'<em class="replaceable">current_auth_string</em>'</span><span class="token punctuation">]</span>
        <span class="token punctuation">[</span><span class="token keyword">RETAIN</span> <span class="token keyword">CURRENT</span> <span class="token keyword">PASSWORD</span><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token keyword">BY</span> <span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span>
        <span class="token punctuation">[</span><span class="token keyword">REPLACE</span> <span class="token string">'<em class="replaceable">current_auth_string</em>'</span><span class="token punctuation">]</span>
        <span class="token punctuation">[</span><span class="token keyword">RETAIN</span> <span class="token keyword">CURRENT</span> <span class="token keyword">PASSWORD</span><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token keyword">AS</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>
  <span class="token operator">|</span> <span class="token keyword">DISCARD</span> <span class="token keyword">OLD</span> <span class="token keyword">PASSWORD</span>
  <span class="token operator">|</span> <span class="token keyword">ADD</span> <em class="replaceable">factor</em> <em class="replaceable">factor_auth_option</em> <span class="token punctuation">[</span><span class="token keyword">ADD</span> <em class="replaceable">factor</em> <em class="replaceable">factor_auth_option</em><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">MODIFY</span> <em class="replaceable">factor</em> <em class="replaceable">factor_auth_option</em> <span class="token punctuation">[</span><span class="token keyword">MODIFY</span> <em class="replaceable">factor</em> <em class="replaceable">factor_auth_option</em><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">DROP</span> <em class="replaceable">factor</em> <span class="token punctuation">[</span><span class="token keyword">DROP</span> <em class="replaceable">factor</em><span class="token punctuation">]</span>
}

<em class="replaceable">user_func_auth_option</em>: {
    <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>
        <span class="token punctuation">[</span><span class="token keyword">REPLACE</span> <span class="token string">'<em class="replaceable">current_auth_string</em>'</span><span class="token punctuation">]</span>
        <span class="token punctuation">[</span><span class="token keyword">RETAIN</span> <span class="token keyword">CURRENT</span> <span class="token keyword">PASSWORD</span><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">DISCARD</span> <span class="token keyword">OLD</span> <span class="token keyword">PASSWORD</span>
}

<em class="replaceable">factor_auth_option</em>: {
    <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token keyword">BY</span> <span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span>
  <span class="token operator">|</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> <em class="replaceable">auth_plugin</em> <span class="token keyword">AS</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>
}

<em class="replaceable">registration_option</em>: {
    <em class="replaceable">factor</em> INITIATE REGISTRATION
  <span class="token operator">|</span> <em class="replaceable">factor</em> FINISH REGISTRATION <span class="token keyword">SET</span> CHALLENGE_RESPONSE <span class="token keyword">AS</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>
  <span class="token operator">|</span> <em class="replaceable">factor</em> UNREGISTER
}

<em class="replaceable">factor</em>: {<span class="token number">2</span> <span class="token operator">|</span> <span class="token number">3</span>} FACTOR

<em class="replaceable">tls_option</em>: {
   <span class="token keyword">SSL</span>
 <span class="token operator">|</span> <span class="token keyword">X509</span>
 <span class="token operator">|</span> <span class="token keyword">CIPHER</span> <span class="token string">'<em class="replaceable">cipher</em>'</span>
 <span class="token operator">|</span> <span class="token keyword">ISSUER</span> <span class="token string">'<em class="replaceable">issuer</em>'</span>
 <span class="token operator">|</span> <span class="token keyword">SUBJECT</span> <span class="token string">'<em class="replaceable">subject</em>'</span>
}

<em class="replaceable">resource_option</em>: {
    <span class="token keyword">MAX_QUERIES_PER_HOUR</span> <em class="replaceable">count</em>
  <span class="token operator">|</span> <span class="token keyword">MAX_UPDATES_PER_HOUR</span> <em class="replaceable">count</em>
  <span class="token operator">|</span> <span class="token keyword">MAX_CONNECTIONS_PER_HOUR</span> <em class="replaceable">count</em>
  <span class="token operator">|</span> <span class="token keyword">MAX_USER_CONNECTIONS</span> <em class="replaceable">count</em>
}

<em class="replaceable">password_option</em>: {
    <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span> <span class="token punctuation">[</span><span class="token keyword">DEFAULT</span> <span class="token operator">|</span> <span class="token keyword">NEVER</span> <span class="token operator">|</span> <span class="token keyword">INTERVAL</span> <em class="replaceable">N</em> <span class="token keyword">DAY</span><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">HISTORY</span> {<span class="token keyword">DEFAULT</span> <span class="token operator">|</span> <em class="replaceable">N</em>}
  <span class="token operator">|</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REUSE</span> <span class="token keyword">INTERVAL</span> {<span class="token keyword">DEFAULT</span> <span class="token operator">|</span> <em class="replaceable">N</em> <span class="token keyword">DAY</span>}
  <span class="token operator">|</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">CURRENT</span> <span class="token punctuation">[</span><span class="token keyword">DEFAULT</span> <span class="token operator">|</span> <span class="token keyword">OPTIONAL</span><span class="token punctuation">]</span>
  <span class="token operator">|</span> <span class="token keyword">FAILED_LOGIN_ATTEMPTS</span> <em class="replaceable">N</em>
  <span class="token operator">|</span> <span class="token keyword">PASSWORD_LOCK_TIME</span> {<em class="replaceable">N</em> <span class="token operator">|</span> <span class="token keyword">UNBOUNDED</span>}
}

<em class="replaceable">lock_option</em>: {
    <span class="token keyword">ACCOUNT</span> <span class="token keyword">LOCK</span>
  <span class="token operator">|</span> <span class="token keyword">ACCOUNT</span> <span class="token keyword">UNLOCK</span>
}</code></pre>
  </div>
  <p>
   The
   <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
    <code class="literal">
     ALTER USER
    </code>
   </a>
   statement modifies
        MySQL accounts. It enables authentication, role, SSL/TLS,
        resource-limit, password-management, comment, and attribute
        properties to be modified for existing accounts. It can also be
        used to lock and unlock accounts.
  </p>
  <p>
   In most cases,
   <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
    <code class="literal">
     ALTER USER
    </code>
   </a>
   requires the global
   <a class="link" href="privileges-provided.html#priv_create-user">
    <code class="literal">
     CREATE USER
    </code>
   </a>
   privilege, or the
   <a class="link" href="privileges-provided.html#priv_update">
    <code class="literal">
     UPDATE
    </code>
   </a>
   privilege for the
   <code class="literal">
    mysql
   </code>
   system schema. The
        exceptions are:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      Any client who connects to the server using a nonanonymous
            account can change the password for that account. (In
            particular, you can change your own password.) To see which
            account the server authenticated you as, invoke the
      <a class="link" href="information-functions.html#function_current-user">
       <code class="literal">
        CURRENT_USER()
       </code>
      </a>
      function:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa12125052"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> <span class="token function">CURRENT_USER</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
     </div>
    </li>
    <li class="listitem">
     <p>
      For
      <code class="literal">
       DEFAULT ROLE
      </code>
      syntax,
      <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
       <code class="literal">
        ALTER USER
       </code>
      </a>
      requires these
            privileges:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         Setting the default roles for another user requires the
                global
         <a class="link" href="privileges-provided.html#priv_create-user">
          <code class="literal">
           CREATE USER
          </code>
         </a>
         privilege, or the
         <a class="link" href="privileges-provided.html#priv_update">
          <code class="literal">
           UPDATE
          </code>
         </a>
         privilege for the
         <code class="literal">
          mysql.default_roles
         </code>
         system table.
        </p>
       </li>
       <li class="listitem">
        <p>
         Setting the default roles for yourself requires no
                special privileges, as long as the roles you want as the
                default have been granted to you.
        </p>
       </li>
      </ul>
     </div>
    </li>
    <li class="listitem">
     <p>
      Statements that modify secondary passwords require these
            privileges:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         The
         <a class="link" href="privileges-provided.html#priv_application-password-admin">
          <code class="literal">
           APPLICATION_PASSWORD_ADMIN
          </code>
         </a>
         privilege is required to use the
         <code class="literal">
          RETAIN CURRENT
                PASSWORD
         </code>
         or
         <code class="literal">
          DISCARD OLD
                PASSWORD
         </code>
         clause for
         <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
          <code class="literal">
           ALTER
                USER
          </code>
         </a>
         statements that apply to your own
                account. The privilege is required to manipulate your
                own secondary password because most users require only
                one password.
        </p>
       </li>
       <li class="listitem">
        <p>
         If an account is to be permitted to manipulate secondary
                passwords for all accounts, it requires the
         <a class="link" href="privileges-provided.html#priv_create-user">
          <code class="literal">
           CREATE USER
          </code>
         </a>
         privilege
                rather than
         <a class="link" href="privileges-provided.html#priv_application-password-admin">
          <code class="literal">
           APPLICATION_PASSWORD_ADMIN
          </code>
         </a>
         .
        </p>
       </li>
      </ul>
     </div>
    </li>
   </ul>
  </div>
  <p>
   When the
   <a class="link" href="server-system-variables.html#sysvar_read_only">
    <code class="literal">
     read_only
    </code>
   </a>
   system
        variable is enabled,
   <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
    <code class="literal">
     ALTER USER
    </code>
   </a>
   additionally requires the
   <a class="link" href="privileges-provided.html#priv_connection-admin">
    <code class="literal">
     CONNECTION_ADMIN
    </code>
   </a>
   privilege (or
        the deprecated
   <a class="link" href="privileges-provided.html#priv_super">
    <code class="literal">
     SUPER
    </code>
   </a>
   privilege).
  </p>
  <p>
   These additional privilege considerations also apply:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      The
      <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
       <code class="literal">
        authentication_policy
       </code>
      </a>
      system variable places certain constraints on how the
            authentication-related clauses of
      <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
       <code class="literal">
        ALTER
            USER
       </code>
      </a>
      statements may be used; for details, see the
            description of that variable. These constraints do not apply
            if you have the
      <a class="link" href="privileges-provided.html#priv_authentication-policy-admin">
       <code class="literal">
        AUTHENTICATION_POLICY_ADMIN
       </code>
      </a>
      privilege.
     </p>
    </li>
    <li class="listitem">
     <p>
      To modify an account that uses passwordless authentication,
            you must have the
      <a class="link" href="privileges-provided.html#priv_passwordless-user-admin">
       <code class="literal">
        PASSWORDLESS_USER_ADMIN
       </code>
      </a>
      privilege.
     </p>
    </li>
   </ul>
  </div>
  <p>
   By default, an error occurs if you try to modify a user that
        does not exist. If the
   <code class="literal">
    IF EXISTS
   </code>
   clause is
        given, the statement produces a warning for each named user that
        does not exist, rather than an error.
  </p>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    Under some circumstances,
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER
          USER
     </code>
    </a>
    may be recorded in server logs or on the client
          side in a history file such as
    <code class="filename">
     ~/.mysql_history
    </code>
    , which means that
          cleartext passwords may be read by anyone having read access
          to that information. For information about the conditions
          under which this occurs for the server logs and how to control
          it, see
    <a class="xref" href="password-logging.html" title="8.1.2.3 Passwords and Logging">
     Section 8.1.2.3, “Passwords and Logging”
    </a>
    . For similar
          information about client-side logging, see
    <a class="xref" href="mysql-logging.html" title="6.5.1.3 mysql Client Logging">
     Section 6.5.1.3, “mysql Client Logging”
    </a>
    .
   </p>
  </div>
  <p>
   There are several aspects to the
   <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
    <code class="literal">
     ALTER
        USER
    </code>
   </a>
   statement, described under the following topics:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="alter-user.html#alter-user-overview" title="ALTER USER Overview">
       ALTER USER Overview
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="alter-user.html#alter-user-authentication" title="ALTER USER Authentication Options">
       ALTER USER Authentication Options
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="alter-user.html#alter-user-multifactor-authentication" title="ALTER USER Multifactor Authentication Options">
       ALTER USER Multifactor Authentication Options
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="alter-user.html#alter-user-registration-" title="ALTER USER Registration Options">
       ALTER USER Registration Options
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="alter-user.html#alter-user-role" title="ALTER USER Role Options">
       ALTER USER Role Options
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="alter-user.html#alter-user-tls" title="ALTER USER SSL/TLS Options">
       ALTER USER SSL/TLS Options
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="alter-user.html#alter-user-resource-limits" title="ALTER USER Resource-Limit Options">
       ALTER USER Resource-Limit Options
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="alter-user.html#alter-user-password-management" title="ALTER USER Password-Management Options">
       ALTER USER Password-Management Options
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="alter-user.html#alter-user-comments-attributes" title="ALTER USER Comment and Attribute Options">
       ALTER USER Comment and Attribute Options
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="alter-user.html#alter-user-account-locking" title="ALTER USER Account-Locking Options">
       ALTER USER Account-Locking Options
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="alter-user.html#alter-user-binary-logging" title="ALTER USER Binary Logging">
       ALTER USER Binary Logging
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="alter-user-overview">
       </a>
       ALTER USER Overview
      </h5>
     </div>
    </div>
   </div>
   <p>
    For each affected account,
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER
          USER
     </code>
    </a>
    modifies the corresponding row in the
    <code class="literal">
     mysql.user
    </code>
    system table to reflect the
          properties specified in the statement. Unspecified properties
          retain their current values.
   </p>
   <p>
    Each account name uses the format described in
    <a class="xref" href="account-names.html" title="8.2.4 Specifying Account Names">
     Section 8.2.4, “Specifying Account Names”
    </a>
    . The host name part of the
          account name, if omitted, defaults to
    <code class="literal">
     '%'
    </code>
    .
          It is also possible to specify
    <a class="link" href="information-functions.html#function_current-user">
     <code class="literal">
      CURRENT_USER
     </code>
    </a>
    or
    <a class="link" href="information-functions.html#function_current-user">
     <code class="literal">
      CURRENT_USER()
     </code>
    </a>
    to refer to the
          account associated with the current session.
   </p>
   <p>
    In one case only, the account may be specified with the
    <a class="link" href="information-functions.html#function_user">
     <code class="literal">
      USER()
     </code>
    </a>
    function:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa18922035"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token function">USER</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    This syntax enables changing your own password without naming
          your account literally. (The syntax also supports the
    <code class="literal">
     REPLACE
    </code>
    ,
    <code class="literal">
     RETAIN CURRENT
          PASSWORD
    </code>
    , and
    <code class="literal">
     DISCARD OLD
          PASSWORD
    </code>
    clauses described at
    <a class="xref" href="alter-user.html#alter-user-authentication" title="ALTER USER Authentication Options">
     ALTER USER Authentication Options
    </a>
    .)
   </p>
   <p>
    For
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    syntax that
          permits an
    <em class="replaceable">
     <code>
      auth_option
     </code>
    </em>
    value to
          follow a
    <em class="replaceable">
     <code>
      user
     </code>
    </em>
    value,
    <em class="replaceable">
     <code>
      auth_option
     </code>
    </em>
    indicates how the
          account authenticates by specifying an account authentication
          plugin, credentials (for example, a password), or both. Each
    <em class="replaceable">
     <code>
      auth_option
     </code>
    </em>
    value applies
    <span class="emphasis">
     <em>
      only
     </em>
    </span>
    to the account named immediately
          preceding it.
   </p>
   <p>
    Following the
    <em class="replaceable">
     <code>
      user
     </code>
    </em>
    specifications,
          the statement may include options for SSL/TLS, resource-limit,
          password-management, and locking properties. All such options
          are
    <span class="emphasis">
     <em>
      global
     </em>
    </span>
    to the statement and apply to
    <span class="emphasis">
     <em>
      all
     </em>
    </span>
    accounts named in the statement.
   </p>
   <p>
    Example: Change an account's password and expire it. As a
          result, the user must connect with the named password and
          choose a new one at the next connection:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa43628458"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">new_password</em>'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Example: Modify an account to use the
    <code class="literal">
     caching_sha2_password
    </code>
    authentication plugin
          and the given password. Require that a new password be chosen
          every 180 days, and enable failed-login tracking, such that
          three consecutive incorrect passwords cause temporary account
          locking for two days:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa64407051"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> caching_sha2_password <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">new_password</em>'</span>
  <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span> <span class="token keyword">INTERVAL</span> <span class="token number">180</span> <span class="token keyword">DAY</span>
  <span class="token keyword">FAILED_LOGIN_ATTEMPTS</span> <span class="token number">3</span> <span class="token keyword">PASSWORD_LOCK_TIME</span> <span class="token number">2</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Example: Lock or unlock an account:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa38541838"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">ACCOUNT</span> <span class="token keyword">LOCK</span><span class="token punctuation">;</span>
<span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">ACCOUNT</span> <span class="token keyword">UNLOCK</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Example: Require an account to connect using SSL and establish
          a limit of 20 connections per hour:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa69840461"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">REQUIRE</span> <span class="token keyword">SSL</span> <span class="token keyword">WITH</span> <span class="token keyword">MAX_CONNECTIONS_PER_HOUR</span> <span class="token number">20</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Example: Alter multiple accounts, specifying some per-account
          properties and some global properties:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa93610839"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span>
  <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
    <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">jeffrey_new_password</em>'</span><span class="token punctuation">,</span>
  <span class="token string">'jeanne'</span>@<span class="token string">'localhost'</span><span class="token punctuation">,</span>
  <span class="token string">'josh'</span>@<span class="token string">'localhost'</span>
    <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">josh_new_password</em>'</span>
    <span class="token keyword">REPLACE</span> <span class="token string">'<em class="replaceable">josh_current_password</em>'</span>
    <span class="token keyword">RETAIN</span> <span class="token keyword">CURRENT</span> <span class="token keyword">PASSWORD</span>
  <span class="token keyword">REQUIRE</span> <span class="token keyword">SSL</span> <span class="token keyword">WITH</span> <span class="token keyword">MAX_USER_CONNECTIONS</span> <span class="token number">2</span>
  <span class="token keyword">PASSWORD</span> <span class="token keyword">HISTORY</span> <span class="token number">5</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    The
    <code class="literal">
     IDENTIFIED BY
    </code>
    value following
    <code class="literal">
     jeffrey
    </code>
    applies only to its immediately
          preceding account, so it changes the password to
    <code class="literal">
     '
     <em class="replaceable">
      <code>
       jeffrey_new_password
      </code>
     </em>
     '
    </code>
    only for
    <code class="literal">
     jeffrey
    </code>
    . For
    <code class="literal">
     jeanne
    </code>
    , there is no per-account value (thus
          leaving the password unchanged). For
    <code class="literal">
     josh
    </code>
    ,
    <code class="literal">
     IDENTIFIED BY
    </code>
    establishes a new password
          (
    <code class="literal">
     '
     <em class="replaceable">
      <code>
       josh_new_password
      </code>
     </em>
     '
    </code>
    ),
    <code class="literal">
     REPLACE
    </code>
    is specified to verify that the
          user issuing the
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    statement knows the current password
          (
    <code class="literal">
     '
     <em class="replaceable">
      <code>
       josh_current_password
      </code>
     </em>
     '
    </code>
    ),
          and that current password is also retained as the account
          secondary password. (As a result,
    <code class="literal">
     josh
    </code>
    can
          connect with either the primary or secondary password.)
   </p>
   <p>
    The remaining properties apply globally to all accounts named
          in the statement, so for both accounts:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Connections are required to use SSL.
      </p>
     </li>
     <li class="listitem">
      <p>
       The account can be used for a maximum of two simultaneous
              connections.
      </p>
     </li>
     <li class="listitem">
      <p>
       Password changes cannot reuse any of the five most recent
              passwords.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Example: Discard the secondary password for
    <code class="literal">
     josh
    </code>
    , leaving the account with only its
          primary password:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa54496501"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'josh'</span>@<span class="token string">'localhost'</span> <span class="token keyword">DISCARD</span> <span class="token keyword">OLD</span> <span class="token keyword">PASSWORD</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    In the absence of a particular type of option, the account
          remains unchanged in that respect. For example, with no
          locking option, the locking state of the account is not
          changed.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="alter-user-authentication">
       </a>
       ALTER USER Authentication Options
      </h5>
     </div>
    </div>
   </div>
   <p>
    An account name may be followed by an
    <em class="replaceable">
     <code>
      auth_option
     </code>
    </em>
    authentication option
          that specifies the account authentication plugin, credentials,
          or both. It may also include a password-verification clause
          that specifies the account current password to be replaced,
          and clauses that manage whether an account has a secondary
          password.
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     Clauses for random password generation, password
            verification, and secondary passwords apply only to accounts
            that use an authentication plugin that stores credentials
            internally to MySQL. For accounts that use a plugin that
            performs authentication against a credentials system that is
            external to MySQL, password management must be handled
            externally against that system as well. For more information
            about internal credentials storage, see
     <a class="xref" href="password-management.html" title="8.2.15 Password Management">
      Section 8.2.15, “Password Management”
     </a>
     .
    </p>
   </div>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <em class="replaceable">
        <code>
         auth_plugin
        </code>
       </em>
       names an
              authentication plugin. The plugin name can be a quoted
              string literal or an unquoted name. Plugin names are
              stored in the
       <code class="literal">
        plugin
       </code>
       column of the
       <code class="literal">
        mysql.user
       </code>
       system table.
      </p>
      <p>
       For
       <em class="replaceable">
        <code>
         auth_option
        </code>
       </em>
       syntax that
              does not specify an authentication plugin, the server
              assigns the default plugin, determined as described in
       <a class="xref" href="pluggable-authentication.html#pluggable-authentication-default-plugin" title="The Default Authentication Plugin">
        The Default Authentication Plugin
       </a>
       .
              For descriptions of each plugin, see
       <a class="xref" href="authentication-plugins.html" title="8.4.1 Authentication Plugins">
        Section 8.4.1, “Authentication Plugins”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       Credentials that are stored internally are stored in the
       <code class="literal">
        mysql.user
       </code>
       system table. An
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          auth_string
         </code>
        </em>
        '
       </code>
       value or
       <code class="literal">
        RANDOM PASSWORD
       </code>
       specifies
              account credentials, either as a cleartext (unencrypted)
              string or hashed in the format expected by the
              authentication plugin associated with the account,
              respectively:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          For syntax that uses
          <code class="literal">
           BY
                  '
           <em class="replaceable">
            <code>
             auth_string
            </code>
           </em>
           '
          </code>
          ,
                  the string is cleartext and is passed to the
                  authentication plugin for possible hashing. The result
                  returned by the plugin is stored in the
          <code class="literal">
           mysql.user
          </code>
          table. A plugin may use
                  the value as specified, in which case no hashing
                  occurs.
         </p>
        </li>
        <li class="listitem">
         <p>
          For syntax that uses
          <code class="literal">
           BY RANDOM
                  PASSWORD
          </code>
          , MySQL generates a random password
                  and as cleartext and passes it to the authentication
                  plugin for possible hashing. The result returned by
                  the plugin is stored in the
          <code class="literal">
           mysql.user
          </code>
          table. A plugin may use
                  the value as specified, in which case no hashing
                  occurs.
         </p>
         <p>
          Randomly generated passwords have the characteristics
                  described in
          <a class="xref" href="password-management.html#random-password-generation" title="Random Password Generation">
           Random Password Generation
          </a>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          For syntax that uses
          <code class="literal">
           AS
                  '
           <em class="replaceable">
            <code>
             auth_string
            </code>
           </em>
           '
          </code>
          ,
                  the string is assumed to be already in the format the
                  authentication plugin requires, and is stored as is in
                  the
          <code class="literal">
           mysql.user
          </code>
          table. If a plugin
                  requires a hashed value, the value must be already
                  hashed in a format appropriate for the plugin;
                  otherwise, the value cannot be used by the plugin and
                  correct authentication of client connections does not
                  occur.
         </p>
         <p>
          A hashed string can be either a string literal or a
                  hexadecimal value. The latter corresponds to the type
                  of value displayed by
          <a class="link" href="show-create-user.html" title="15.7.7.13 SHOW CREATE USER Statement">
           <code class="literal">
            SHOW CREATE
                  USER
           </code>
          </a>
          for password hashes containing
                  unprintable characters when the
          <a class="link" href="server-system-variables.html#sysvar_print_identified_with_as_hex">
           <code class="literal">
            print_identified_with_as_hex
           </code>
          </a>
          system variable is enabled.
         </p>
        </li>
        <li class="listitem">
         <p>
          If an authentication plugin performs no hashing of the
                  authentication string, the
          <code class="literal">
           BY
                  '
           <em class="replaceable">
            <code>
             auth_string
            </code>
           </em>
           '
          </code>
          and
          <code class="literal">
           AS
                  '
           <em class="replaceable">
            <code>
             auth_string
            </code>
           </em>
           '
          </code>
          clauses have the same effect: The authentication
                  string is stored as is in the
          <code class="literal">
           mysql.user
          </code>
          system table.
         </p>
        </li>
       </ul>
      </div>
     </li>
     <li class="listitem">
      <p>
       The
       <code class="literal">
        REPLACE
              '
        <em class="replaceable">
         <code>
          current_auth_string
         </code>
        </em>
        '
       </code>
       clause performs password verification. If given:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <code class="literal">
           REPLACE
          </code>
          specifies the account
                  current password to be replaced, as a cleartext
                  (unencrypted) string.
         </p>
        </li>
        <li class="listitem">
         <p>
          The clause must be given if password changes for the
                  account are required to specify the current password,
                  as verification that the user attempting to make the
                  change actually knows the current password.
         </p>
        </li>
        <li class="listitem">
         <p>
          The clause is optional if password changes for the
                  account may but need not specify the current password.
         </p>
        </li>
        <li class="listitem">
         <p>
          The statement fails if the clause is given but does
                  not match the current password, even if the clause is
                  optional.
         </p>
        </li>
        <li class="listitem">
         <p>
          <code class="literal">
           REPLACE
          </code>
          can be specified only when
                  changing the account password for the current user.
         </p>
        </li>
       </ul>
      </div>
      <p>
       For more information about password verification by
              specifying the current password, see
       <a class="xref" href="password-management.html" title="8.2.15 Password Management">
        Section 8.2.15, “Password Management”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <code class="literal">
        RETAIN CURRENT PASSWORD
       </code>
       and
       <code class="literal">
        DISCARD OLD PASSWORD
       </code>
       clauses implement
              dual-password capability. Both are optional, but if given,
              have the following effects:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <code class="literal">
           RETAIN CURRENT PASSWORD
          </code>
          retains an
                  account current password as its secondary password,
                  replacing any existing secondary password. The new
                  password becomes the primary password, but clients can
                  use the account to connect to the server using either
                  the primary or secondary password. (Exception: If the
                  new password specified by the
          <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
           <code class="literal">
            ALTER USER
           </code>
          </a>
          statement is
                  empty, the secondary password becomes empty as well,
                  even if
          <code class="literal">
           RETAIN CURRENT PASSWORD
          </code>
          is
                  given.)
         </p>
        </li>
        <li class="listitem">
         <p>
          If you specify
          <code class="literal">
           RETAIN CURRENT
                  PASSWORD
          </code>
          for an account that has an empty
                  primary password, the statement fails.
         </p>
        </li>
        <li class="listitem">
         <p>
          If an account has a secondary password and you change
                  its primary password without specifying
          <code class="literal">
           RETAIN CURRENT PASSWORD
          </code>
          , the
                  secondary password remains unchanged.
         </p>
        </li>
        <li class="listitem">
         <p>
          If you change the authentication plugin assigned to
                  the account, the secondary password is discarded. If
                  you change the authentication plugin and also specify
          <code class="literal">
           RETAIN CURRENT PASSWORD
          </code>
          , the
                  statement fails.
         </p>
        </li>
        <li class="listitem">
         <p>
          <code class="literal">
           DISCARD OLD PASSWORD
          </code>
          discards the
                  secondary password, if one exists. The account retains
                  only its primary password, and clients can use the
                  account to connect to the server only with the primary
                  password.
         </p>
        </li>
       </ul>
      </div>
      <p>
       For more information about use of dual passwords, see
       <a class="xref" href="password-management.html" title="8.2.15 Password Management">
        Section 8.2.15, “Password Management”
       </a>
       .
      </p>
     </li>
    </ul>
   </div>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    permits these
    <em class="replaceable">
     <code>
      auth_option
     </code>
    </em>
    syntaxes:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        IDENTIFIED BY
              '
        <em class="replaceable">
         <code>
          auth_string
         </code>
        </em>
        ' [REPLACE
              '
        <em class="replaceable">
         <code>
          current_auth_string
         </code>
        </em>
        '] [RETAIN
              CURRENT PASSWORD]
       </code>
      </p>
      <p>
       Sets the account authentication plugin to the default
              plugin, passes the cleartext
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          auth_string
         </code>
        </em>
        '
       </code>
       value to the plugin for possible hashing, and stores the
              result in the account row in the
       <code class="literal">
        mysql.user
       </code>
       system table.
      </p>
      <p>
       The
       <code class="literal">
        REPLACE
       </code>
       clause, if given, specifies
              the account current password, as described previously in
              this section.
      </p>
      <p>
       The
       <code class="literal">
        RETAIN CURRENT PASSWORD
       </code>
       clause, if
              given, causes the account current password to be retained
              as its secondary password, as described previously in this
              section.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        IDENTIFIED BY RANDOM PASSWORD [REPLACE
              '
        <em class="replaceable">
         <code>
          current_auth_string
         </code>
        </em>
        '] [RETAIN
              CURRENT PASSWORD]
       </code>
      </p>
      <p>
       Sets the account authentication plugin to the default
              plugin, generates a random password, passes the cleartext
              password value to the plugin for possible hashing, and
              stores the result in the account row in the
       <code class="literal">
        mysql.user
       </code>
       system table. The statement
              also returns the cleartext password in a result set to
              make it available to the user or application executing the
              statement. For details about the result set and
              characteristics of randomly generated passwords, see
       <a class="xref" href="password-management.html#random-password-generation" title="Random Password Generation">
        Random Password Generation
       </a>
       .
      </p>
      <p>
       The
       <code class="literal">
        REPLACE
       </code>
       clause, if given, specifies
              the account current password, as described previously in
              this section.
      </p>
      <p>
       The
       <code class="literal">
        RETAIN CURRENT PASSWORD
       </code>
       clause, if
              given, causes the account current password to be retained
              as its secondary password, as described previously in this
              section.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        IDENTIFIED WITH
        <em class="replaceable">
         <code>
          auth_plugin
         </code>
        </em>
       </code>
      </p>
      <p>
       Sets the account authentication plugin to
       <em class="replaceable">
        <code>
         auth_plugin
        </code>
       </em>
       , clears the
              credentials to the empty string (the credentials are
              associated with the old authentication plugin, not the new
              one), and stores the result in the account row in the
       <code class="literal">
        mysql.user
       </code>
       system table.
      </p>
      <p>
       In addition, the password is marked expired. The user must
              choose a new one when next connecting.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        IDENTIFIED WITH
        <em class="replaceable">
         <code>
          auth_plugin
         </code>
        </em>
        BY
              '
        <em class="replaceable">
         <code>
          auth_string
         </code>
        </em>
        ' [REPLACE
              '
        <em class="replaceable">
         <code>
          current_auth_string
         </code>
        </em>
        '] [RETAIN
              CURRENT PASSWORD]
       </code>
      </p>
      <p>
       Sets the account authentication plugin to
       <em class="replaceable">
        <code>
         auth_plugin
        </code>
       </em>
       , passes the
              cleartext
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          auth_string
         </code>
        </em>
        '
       </code>
       value to the plugin for possible hashing, and stores the
              result in the account row in the
       <code class="literal">
        mysql.user
       </code>
       system table.
      </p>
      <p>
       The
       <code class="literal">
        REPLACE
       </code>
       clause, if given, specifies
              the account current password, as described previously in
              this section.
      </p>
      <p>
       The
       <code class="literal">
        RETAIN CURRENT PASSWORD
       </code>
       clause, if
              given, causes the account current password to be retained
              as its secondary password, as described previously in this
              section.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        IDENTIFIED WITH
        <em class="replaceable">
         <code>
          auth_plugin
         </code>
        </em>
        BY RANDOM PASSWORD
              [REPLACE '
        <em class="replaceable">
         <code>
          current_auth_string
         </code>
        </em>
        ']
              [RETAIN CURRENT PASSWORD]
       </code>
      </p>
      <p>
       Sets the account authentication plugin to
       <em class="replaceable">
        <code>
         auth_plugin
        </code>
       </em>
       , generates a random
              password, passes the cleartext password value to the
              plugin for possible hashing, and stores the result in the
              account row in the
       <code class="literal">
        mysql.user
       </code>
       system
              table. The statement also returns the cleartext password
              in a result set to make it available to the user or
              application executing the statement. For details about the
              result set and characteristics of randomly generated
              passwords, see
       <a class="xref" href="password-management.html#random-password-generation" title="Random Password Generation">
        Random Password Generation
       </a>
       .
      </p>
      <p>
       The
       <code class="literal">
        REPLACE
       </code>
       clause, if given, specifies
              the account current password, as described previously in
              this section.
      </p>
      <p>
       The
       <code class="literal">
        RETAIN CURRENT PASSWORD
       </code>
       clause, if
              given, causes the account current password to be retained
              as its secondary password, as described previously in this
              section.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        IDENTIFIED WITH
        <em class="replaceable">
         <code>
          auth_plugin
         </code>
        </em>
        AS
              '
        <em class="replaceable">
         <code>
          auth_string
         </code>
        </em>
        '
       </code>
      </p>
      <p>
       Sets the account authentication plugin to
       <em class="replaceable">
        <code>
         auth_plugin
        </code>
       </em>
       and stores the
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          auth_string
         </code>
        </em>
        '
       </code>
       value as is in the
       <code class="literal">
        mysql.user
       </code>
       account
              row. If the plugin requires a hashed string, the string is
              assumed to be already hashed in the format the plugin
              requires.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        DISCARD OLD PASSWORD
       </code>
      </p>
      <p>
       Discards the account secondary password, if there is one,
              as described previously in this section.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Example: Specify the password as cleartext; the default plugin
          is used:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa92526037"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Example: Specify the authentication plugin, along with a
          cleartext password value:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa56254447"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> mysql_native_password
             <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Example: Like the preceding example, but in addition, specify
          the current password as a cleartext value to satisfy any
          account requirement that the user making the change knows that
          password:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa23174469"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> mysql_native_password
             <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span>
             <span class="token keyword">REPLACE</span> <span class="token string">'<em class="replaceable">current_password</em>'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    The preceding statement fails unless the current user is
    <code class="literal">
     jeffrey
    </code>
    because
    <code class="literal">
     REPLACE
    </code>
    is permitted only for changes to the current user's password.
   </p>
   <p>
    Example: Establish a new primary password and retain the
          existing password as the secondary password:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa63387490"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">new_password</em>'</span>
  <span class="token keyword">RETAIN</span> <span class="token keyword">CURRENT</span> <span class="token keyword">PASSWORD</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Example: Discard the secondary password, leaving the account
          with only its primary password:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa13862416"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffery'</span>@<span class="token string">'localhost'</span> <span class="token keyword">DISCARD</span> <span class="token keyword">OLD</span> <span class="token keyword">PASSWORD</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Example: Specify the authentication plugin, along with a
          hashed password value:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa9170099"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> mysql_native_password
             <span class="token keyword">AS</span> <span class="token string">'*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    For additional information about setting passwords and
          authentication plugins, see
    <a class="xref" href="assigning-passwords.html" title="8.2.14 Assigning Account Passwords">
     Section 8.2.14, “Assigning Account Passwords”
    </a>
    , and
    <a class="xref" href="pluggable-authentication.html" title="8.2.17 Pluggable Authentication">
     Section 8.2.17, “Pluggable Authentication”
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="alter-user-multifactor-authentication">
       </a>
       ALTER USER Multifactor Authentication Options
      </h5>
     </div>
    </div>
   </div>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    has
    <code class="literal">
     ADD
    </code>
    ,
    <code class="literal">
     MODIFY
    </code>
    , and
    <code class="literal">
     DROP
    </code>
    clauses that enable authentication
          factors to be added, modified, or dropped. In each case, the
          clause specifies an operation to perform on one authentication
          factor, and optionally an operation on another authentication
          factor. For each operation, the
    <em class="replaceable">
     <code>
      factor
     </code>
    </em>
    item specifies the
    <code class="literal">
     FACTOR
    </code>
    keyword preceded by the number 2 or
          3 to indicate whether the operation applies to the second or
          third authentication factor. (1 is not permitted in this
          context. To act on the first authentication factor, use the
          syntax described in
    <a class="xref" href="alter-user.html#alter-user-authentication" title="ALTER USER Authentication Options">
     ALTER USER Authentication Options
    </a>
    .)
   </p>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    multifactor
          authentication clause constraints are defined by the
    <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
     <code class="literal">
      authentication_policy
     </code>
    </a>
    system
          variable. For example, the
    <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
     <code class="literal">
      authentication_policy
     </code>
    </a>
    setting
          controls the number of authentication factors that accounts
          may have, and for each factor, which authentication methods
          are permitted. See
    <a class="xref" href="multifactor-authentication.html#multifactor-authentication-policy" title="Configuring the Multifactor Authentication Policy">
     Configuring the Multifactor Authentication Policy
    </a>
    .
   </p>
   <p>
    When
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    adds, modifies,
          or drops second and third factors in a single statement,
          operations are executed sequentially, but if any operation in
          the sequence fails the entire
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER
          USER
     </code>
    </a>
    statement fails.
   </p>
   <p>
    For
    <code class="literal">
     ADD
    </code>
    , each named factor must not already
          exist or it cannot be added. For
    <code class="literal">
     MODIFY
    </code>
    and
    <code class="literal">
     DROP
    </code>
    , each named factor must exist to be
          modified or dropped. If a second and third factor are defined,
          dropping the second factor causes the third factor to take its
          place as the second factor.
   </p>
   <p>
    This statement drops authentication factors 2 and 3, which has
          the effect of converting the account from 3FA to 1FA:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa26974052"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'<em class="replaceable">user</em>'</span> <span class="token keyword">DROP</span> <span class="token number">2</span> FACTOR <span class="token number">3</span> FACTOR<span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    For additional
    <code class="literal">
     ADD
    </code>
    ,
    <code class="literal">
     MODIFY
    </code>
    , and
    <code class="literal">
     DROP
    </code>
    examples, see
    <a class="xref" href="multifactor-authentication.html#multifactor-authentication-getting-started" title="Getting Started with Multifactor Authentication">
     Getting Started with Multifactor Authentication
    </a>
    .
   </p>
   <p>
    For information about factor-specific rules that determine the
          default authentication plugin for authentication clauses that
          do not name a plugin, see
    <a class="xref" href="pluggable-authentication.html#pluggable-authentication-default-plugin" title="The Default Authentication Plugin">
     The Default Authentication Plugin
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="alter-user-registration-">
       </a>
       ALTER USER Registration Options
      </h5>
     </div>
    </div>
   </div>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    has clauses that
          enable FIDO/FIDO2 devices to be registered and unregistered.
          For more information, see
    <a class="xref" href="webauthn-pluggable-authentication.html#webauthn-pluggable-authentication-usage" title="Using WebAuthn Authentication">
     Using WebAuthn Authentication
    </a>
    ,
    <a class="xref" href="webauthn-pluggable-authentication.html#webauthn-pluggable-authentication-unregistration" title="Device Unregistration for WebAuthn">
     Device Unregistration for WebAuthn
    </a>
    ,
          and the
    <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
     <span class="command">
      <strong>
       mysql
      </strong>
     </span>
    </a>
    client
    <a class="link" href="mysql-command-options.html#option_mysql_register-factor">
     <code class="option">
      --register-factor
     </code>
    </a>
    option
          description.
   </p>
   <p>
    The
    <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
     <span class="command">
      <strong>
       mysql
      </strong>
     </span>
    </a>
    client
    <a class="link" href="mysql-command-options.html#option_mysql_register-factor">
     <code class="option">
      --register-factor
     </code>
    </a>
    option, used
          for FIDO/FIDO2 device registration, causes the
    <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
     <span class="command">
      <strong>
       mysql
      </strong>
     </span>
    </a>
    client to generate and execute
    <code class="literal">
     INITIATE REGISTRATION
    </code>
    and
    <code class="literal">
     FINISH
          REGISTRATION
    </code>
    statements. These statements are not
          intended for manual execution.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="alter-user-role">
       </a>
       ALTER USER Role Options
      </h5>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045174873184">
   </a>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER ...
          DEFAULT ROLE
     </code>
    </a>
    defines which roles become active when
          the user connects to the server and authenticates, or when the
          user executes the
    <a class="link" href="set-role.html" title="15.7.1.11 SET ROLE Statement">
     <code class="literal">
      SET ROLE
          DEFAULT
     </code>
    </a>
    statement during a session.
   </p>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER ...
          DEFAULT ROLE
     </code>
    </a>
    is alternative syntax for
    <a class="link" href="set-default-role.html" title="15.7.1.9 SET DEFAULT ROLE Statement">
     <code class="literal">
      SET DEFAULT ROLE
     </code>
    </a>
    (see
    <a class="xref" href="set-default-role.html" title="15.7.1.9 SET DEFAULT ROLE Statement">
     Section 15.7.1.9, “SET DEFAULT ROLE Statement”
    </a>
    ). However,
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    can set the default
          for only a single user, whereas
    <a class="link" href="set-default-role.html" title="15.7.1.9 SET DEFAULT ROLE Statement">
     <code class="literal">
      SET
          DEFAULT ROLE
     </code>
    </a>
    can set the default for multiple users.
          On the other hand, you can specify
    <code class="literal">
     CURRENT_USER
    </code>
    as the user name for the
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    statement, whereas
          you cannot for
    <a class="link" href="set-default-role.html" title="15.7.1.9 SET DEFAULT ROLE Statement">
     <code class="literal">
      SET DEFAULT
          ROLE
     </code>
    </a>
    .
   </p>
   <p>
    Each user account name uses the format described previously.
   </p>
   <p>
    Each role name uses the format described in
    <a class="xref" href="role-names.html" title="8.2.5 Specifying Role Names">
     Section 8.2.5, “Specifying Role Names”
    </a>
    . For example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa78042097"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'joe'</span>@<span class="token string">'10.0.0.1'</span> <span class="token keyword">DEFAULT</span> <span class="token keyword">ROLE</span> administrator<span class="token punctuation">,</span> developer<span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    The host name part of the role name, if omitted, defaults to
    <code class="literal">
     '%'
    </code>
    .
   </p>
   <p>
    The clause following the
    <code class="literal">
     DEFAULT ROLE
    </code>
    keywords permits these values:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        NONE
       </code>
       : Set the default to
       <code class="literal">
        NONE
       </code>
       (no roles).
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        ALL
       </code>
       : Set the default to all roles
              granted to the account.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        <em class="replaceable">
         <code>
          role
         </code>
        </em>
        [,
        <em class="replaceable">
         <code>
          role
         </code>
        </em>
        ] ...
       </code>
       : Set the
              default to the named roles, which must exist and be
              granted to the account at the time
       <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
        <code class="literal">
         ALTER USER ...
              DEFAULT ROLE
        </code>
       </a>
       is executed.
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="alter-user-tls">
       </a>
       ALTER USER SSL/TLS Options
      </h5>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045174845264">
   </a>
   <a class="indexterm" name="idm46045174843808">
   </a>
   <a class="indexterm" name="idm46045174842320">
   </a>
   <p>
    MySQL can check X.509 certificate attributes in addition to
          the usual authentication that is based on the user name and
          credentials. For background information on the use of SSL/TLS
          with MySQL, see
    <a class="xref" href="encrypted-connections.html" title="8.3 Using Encrypted Connections">
     Section 8.3, “Using Encrypted Connections”
    </a>
    .
   </p>
   <p>
    To specify SSL/TLS-related options for a MySQL account, use a
    <code class="literal">
     REQUIRE
    </code>
    clause that specifies one or more
    <em class="replaceable">
     <code>
      tls_option
     </code>
    </em>
    values.
   </p>
   <p>
    Order of
    <code class="literal">
     REQUIRE
    </code>
    options does not matter,
          but no option can be specified twice. The
    <code class="literal">
     AND
    </code>
    keyword is optional between
    <code class="literal">
     REQUIRE
    </code>
    options.
   </p>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    permits these
    <em class="replaceable">
     <code>
      tls_option
     </code>
    </em>
    values:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        NONE
       </code>
      </p>
      <p>
       Indicates that all accounts named by the statement have no
              SSL or X.509 requirements. Unencrypted connections are
              permitted if the user name and password are valid.
              Encrypted connections can be used, at the client's option,
              if the client has the proper certificate and key files.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa57108356"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">NONE</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       Clients attempt to establish a secure connection by
              default. For clients that have
       <code class="literal">
        REQUIRE
              NONE
       </code>
       , the connection attempt falls back to an
              unencrypted connection if a secure connection cannot be
              established. To require an encrypted connection, a client
              need specify only the
       <a class="link" href="connection-options.html#option_general_ssl-mode">
        <code class="option">
         --ssl-mode=REQUIRED
        </code>
       </a>
       option; the connection attempt fails if a secure
              connection cannot be established.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        SSL
       </code>
      </p>
      <p>
       Tells the server to permit only encrypted connections for
              all accounts named by the statement.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa96493503"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">SSL</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       Clients attempt to establish a secure connection by
              default. For accounts that have
       <code class="literal">
        REQUIRE
              SSL
       </code>
       , the connection attempt fails if a secure
              connection cannot be established.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        X509
       </code>
      </p>
      <p>
       For all accounts named by the statement, requires that
              clients present a valid certificate, but the exact
              certificate, issuer, and subject do not matter. The only
              requirement is that it should be possible to verify its
              signature with one of the CA certificates. Use of X.509
              certificates always implies encryption, so the
       <code class="literal">
        SSL
       </code>
       option is unnecessary in this case.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa41000606"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">X509</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       For accounts with
       <code class="literal">
        REQUIRE X509
       </code>
       , clients
              must specify the
       <a class="link" href="connection-options.html#option_general_ssl-key">
        <code class="option">
         --ssl-key
        </code>
       </a>
       and
       <a class="link" href="connection-options.html#option_general_ssl-cert">
        <code class="option">
         --ssl-cert
        </code>
       </a>
       options to
              connect. (It is recommended but not required that
       <a class="link" href="connection-options.html#option_general_ssl-ca">
        <code class="option">
         --ssl-ca
        </code>
       </a>
       also be specified
              so that the public certificate provided by the server can
              be verified.) This is true for
       <code class="literal">
        ISSUER
       </code>
       and
       <code class="literal">
        SUBJECT
       </code>
       as well because those
       <code class="literal">
        REQUIRE
       </code>
       options imply the requirements
              of
       <code class="literal">
        X509
       </code>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        ISSUER
              '
        <em class="replaceable">
         <code>
          issuer
         </code>
        </em>
        '
       </code>
      </p>
      <p>
       For all accounts named by the statement, requires that
              clients present a valid X.509 certificate issued by CA
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          issuer
         </code>
        </em>
        '
       </code>
       . If
              a client presents a certificate that is valid but has a
              different issuer, the server rejects the connection. Use
              of X.509 certificates always implies encryption, so the
       <code class="literal">
        SSL
       </code>
       option is unnecessary in this case.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa33925901"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">REQUIRE</span> <span class="token keyword">ISSUER</span> <span class="token string">'/C=SE/ST=Stockholm/L=Stockholm/
    O=MySQL/CN=CA/emailAddress=ca@example.com'</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       Because
       <code class="literal">
        ISSUER
       </code>
       implies the requirements
              of
       <code class="literal">
        X509
       </code>
       , clients must specify the
       <a class="link" href="connection-options.html#option_general_ssl-key">
        <code class="option">
         --ssl-key
        </code>
       </a>
       and
       <a class="link" href="connection-options.html#option_general_ssl-cert">
        <code class="option">
         --ssl-cert
        </code>
       </a>
       options to
              connect. (It is recommended but not required that
       <a class="link" href="connection-options.html#option_general_ssl-ca">
        <code class="option">
         --ssl-ca
        </code>
       </a>
       also be specified
              so that the public certificate provided by the server can
              be verified.)
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        SUBJECT
              '
        <em class="replaceable">
         <code>
          subject
         </code>
        </em>
        '
       </code>
      </p>
      <p>
       For all accounts named by the statement, requires that
              clients present a valid X.509 certificate containing the
              subject
       <em class="replaceable">
        <code>
         subject
        </code>
       </em>
       . If a client
              presents a certificate that is valid but has a different
              subject, the server rejects the connection. Use of X.509
              certificates always implies encryption, so the
       <code class="literal">
        SSL
       </code>
       option is unnecessary in this case.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa99408873"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">REQUIRE</span> <span class="token keyword">SUBJECT</span> <span class="token string">'/C=SE/ST=Stockholm/L=Stockholm/
    O=MySQL demo client certificate/
    CN=client/emailAddress=client@example.com'</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       MySQL does a simple string comparison of the
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          subject
         </code>
        </em>
        '
       </code>
       value to the value in the certificate, so lettercase and
              component ordering must be given exactly as present in the
              certificate.
      </p>
      <p>
       Because
       <code class="literal">
        SUBJECT
       </code>
       implies the
              requirements of
       <code class="literal">
        X509
       </code>
       , clients must
              specify the
       <a class="link" href="connection-options.html#option_general_ssl-key">
        <code class="option">
         --ssl-key
        </code>
       </a>
       and
       <a class="link" href="connection-options.html#option_general_ssl-cert">
        <code class="option">
         --ssl-cert
        </code>
       </a>
       options to
              connect. (It is recommended but not required that
       <a class="link" href="connection-options.html#option_general_ssl-ca">
        <code class="option">
         --ssl-ca
        </code>
       </a>
       also be specified
              so that the public certificate provided by the server can
              be verified.)
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        CIPHER
              '
        <em class="replaceable">
         <code>
          cipher
         </code>
        </em>
        '
       </code>
      </p>
      <p>
       For all accounts named by the statement, requires a
              specific cipher method for encrypting connections. This
              option is needed to ensure that ciphers and key lengths of
              sufficient strength are used. Encryption can be weak if
              old algorithms using short encryption keys are used.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa16431891"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">REQUIRE</span> <span class="token keyword">CIPHER</span> <span class="token string">'EDH-RSA-DES-CBC3-SHA'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    The
    <code class="literal">
     SUBJECT
    </code>
    ,
    <code class="literal">
     ISSUER
    </code>
    , and
    <code class="literal">
     CIPHER
    </code>
    options can be combined in the
    <code class="literal">
     REQUIRE
    </code>
    clause:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa98185184"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">REQUIRE</span> <span class="token keyword">SUBJECT</span> <span class="token string">'/C=SE/ST=Stockholm/L=Stockholm/
    O=MySQL demo client certificate/
    CN=client/emailAddress=client@example.com'</span>
  <span class="token operator">AND</span> <span class="token keyword">ISSUER</span> <span class="token string">'/C=SE/ST=Stockholm/L=Stockholm/
    O=MySQL/CN=CA/emailAddress=ca@example.com'</span>
  <span class="token operator">AND</span> <span class="token keyword">CIPHER</span> <span class="token string">'EDH-RSA-DES-CBC3-SHA'</span><span class="token punctuation">;</span></code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="alter-user-resource-limits">
       </a>
       ALTER USER Resource-Limit Options
      </h5>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045174780048">
   </a>
   <a class="indexterm" name="idm46045174778560">
   </a>
   <p>
    It is possible to place limits on use of server resources by
          an account, as discussed in
    <a class="xref" href="user-resources.html" title="8.2.21 Setting Account Resource Limits">
     Section 8.2.21, “Setting Account Resource Limits”
    </a>
    .
          To do so, use a
    <code class="literal">
     WITH
    </code>
    clause that specifies
          one or more
    <em class="replaceable">
     <code>
      resource_option
     </code>
    </em>
    values.
   </p>
   <p>
    Order of
    <code class="literal">
     WITH
    </code>
    options does not matter,
          except that if a given resource limit is specified multiple
          times, the last instance takes precedence.
   </p>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    permits these
    <em class="replaceable">
     <code>
      resource_option
     </code>
    </em>
    values:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        MAX_QUERIES_PER_HOUR
        <em class="replaceable">
         <code>
          count
         </code>
        </em>
       </code>
       ,
       <code class="literal">
        MAX_UPDATES_PER_HOUR
        <em class="replaceable">
         <code>
          count
         </code>
        </em>
       </code>
       ,
       <code class="literal">
        MAX_CONNECTIONS_PER_HOUR
        <em class="replaceable">
         <code>
          count
         </code>
        </em>
       </code>
      </p>
      <p>
       For all accounts named by the statement, these options
              restrict how many queries, updates, and connections to the
              server are permitted to each account during any given
              one-hour period. If
       <em class="replaceable">
        <code>
         count
        </code>
       </em>
       is
       <code class="literal">
        0
       </code>
       (the default), this means that there
              is no limitation for the account.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        MAX_USER_CONNECTIONS
        <em class="replaceable">
         <code>
          count
         </code>
        </em>
       </code>
      </p>
      <p>
       For all accounts named by the statement, restricts the
              maximum number of simultaneous connections to the server
              by each account. A nonzero
       <em class="replaceable">
        <code>
         count
        </code>
       </em>
       specifies the limit for
              the account explicitly. If
       <em class="replaceable">
        <code>
         count
        </code>
       </em>
       is
       <code class="literal">
        0
       </code>
       (the default), the server determines the number of
              simultaneous connections for the account from the global
              value of the
       <a class="link" href="server-system-variables.html#sysvar_max_user_connections">
        <code class="literal">
         max_user_connections
        </code>
       </a>
       system variable. If
       <a class="link" href="server-system-variables.html#sysvar_max_user_connections">
        <code class="literal">
         max_user_connections
        </code>
       </a>
       is
              also zero, there is no limit for the account.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa48641154"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">WITH</span> <span class="token keyword">MAX_QUERIES_PER_HOUR</span> <span class="token number">500</span> <span class="token keyword">MAX_UPDATES_PER_HOUR</span> <span class="token number">100</span><span class="token punctuation">;</span></code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="alter-user-password-management">
       </a>
       ALTER USER Password-Management Options
      </h5>
     </div>
    </div>
   </div>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    supports several
    <em class="replaceable">
     <code>
      password_option
     </code>
    </em>
    values for password
          management:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Password expiration options: You can expire an account
              password manually and establish its password expiration
              policy. Policy options do not expire the password.
              Instead, they determine how the server applies automatic
              expiration to the account based on password age, which is
              assessed from the date and time of the most recent account
              password change.
      </p>
     </li>
     <li class="listitem">
      <p>
       Password reuse options: You can restrict password reuse
              based on number of password changes, time elapsed, or
              both.
      </p>
     </li>
     <li class="listitem">
      <p>
       Password verification-required options: You can indicate
              whether attempts to change an account password must
              specify the current password, as verification that the
              user attempting to make the change actually knows the
              current password.
      </p>
     </li>
     <li class="listitem">
      <p>
       Incorrect-password failed-login tracking options: You can
              cause the server to track failed login attempts and
              temporarily lock accounts for which too many consecutive
              incorrect passwords are given. The required number of
              failures and the lock time are configurable.
      </p>
     </li>
    </ul>
   </div>
   <p>
    This section describes the syntax for password-management
          options. For information about establishing policy for
          password management, see
    <a class="xref" href="password-management.html" title="8.2.15 Password Management">
     Section 8.2.15, “Password Management”
    </a>
    .
   </p>
   <p>
    If multiple password-management options of a given type are
          specified, the last one takes precedence. For example,
    <code class="literal">
     PASSWORD EXPIRE DEFAULT PASSWORD EXPIRE
          NEVER
    </code>
    is the same as
    <code class="literal">
     PASSWORD EXPIRE
          NEVER
    </code>
    .
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     Except for the options that pertain to failed-login
            tracking, password-management options apply only to accounts
            that use an authentication plugin that stores credentials
            internally to MySQL. For accounts that use a plugin that
            performs authentication against a credentials system that is
            external to MySQL, password management must be handled
            externally against that system as well. For more information
            about internal credentials storage, see
     <a class="xref" href="password-management.html" title="8.2.15 Password Management">
      Section 8.2.15, “Password Management”
     </a>
     .
    </p>
   </div>
   <p>
    A client has an expired password if the account password was
          expired manually or the password age is considered greater
          than its permitted lifetime per the automatic expiration
          policy. In this case, the server either disconnects the client
          or restricts the operations permitted to it (see
    <a class="xref" href="expired-password-handling.html" title="8.2.16 Server Handling of Expired Passwords">
     Section 8.2.16, “Server Handling of Expired Passwords”
    </a>
    ). Operations
          performed by a restricted client result in an error until the
          user establishes a new account password.
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     Although it is possible to
     <span class="quote">
      “
      <span class="quote">
       reset
      </span>
      ”
     </span>
     an expired
            password by setting it to its current value, it is
            preferable, as a matter of good policy, to choose a
            different password. DBAs can enforce non-reuse by
            establishing an appropriate password-reuse policy. See
     <a class="xref" href="password-management.html#password-reuse-policy" title="Password Reuse Policy">
      Password Reuse Policy
     </a>
     .
    </p>
   </div>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    permits these
    <em class="replaceable">
     <code>
      password_option
     </code>
    </em>
    values for
          controlling password expiration:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD EXPIRE
       </code>
      </p>
      <p>
       Immediately marks the password expired for all accounts
              named by the statement.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa49410916"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD EXPIRE DEFAULT
       </code>
      </p>
      <p>
       Sets all accounts named by the statement so that the
              global expiration policy applies, as specified by the
       <a class="link" href="server-system-variables.html#sysvar_default_password_lifetime">
        <code class="literal">
         default_password_lifetime
        </code>
       </a>
       system variable.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa93400001"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span> <span class="token keyword">DEFAULT</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD EXPIRE NEVER
       </code>
      </p>
      <p>
       This expiration option overrides the global policy for all
              accounts named by the statement. For each, it disables
              password expiration so that the password never expires.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa67479292"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span> <span class="token keyword">NEVER</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD EXPIRE INTERVAL
        <em class="replaceable">
         <code>
          N
         </code>
        </em>
        DAY
       </code>
      </p>
      <p>
       This expiration option overrides the global policy for all
              accounts named by the statement. For each, it sets the
              password lifetime to
       <em class="replaceable">
        <code>
         N
        </code>
       </em>
       days.
              The following statement requires the password to be
              changed every 180 days:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa61811744"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span> <span class="token keyword">INTERVAL</span> <span class="token number">180</span> <span class="token keyword">DAY</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    permits these
    <em class="replaceable">
     <code>
      password_option
     </code>
    </em>
    values for
          controlling reuse of previous passwords based on required
          minimum number of password changes:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD HISTORY DEFAULT
       </code>
      </p>
      <p>
       Sets all accounts named by the statement so that the
              global policy about password history length applies, to
              prohibit reuse of passwords before the number of changes
              specified by the
       <a class="link" href="server-system-variables.html#sysvar_password_history">
        <code class="literal">
         password_history
        </code>
       </a>
       system
              variable.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa22732652"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">HISTORY</span> <span class="token keyword">DEFAULT</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD HISTORY
        <em class="replaceable">
         <code>
          N
         </code>
        </em>
       </code>
      </p>
      <p>
       This history-length option overrides the global policy for
              all accounts named by the statement. For each, it sets the
              password history length to
       <em class="replaceable">
        <code>
         N
        </code>
       </em>
       passwords, to prohibit reusing any of the
       <em class="replaceable">
        <code>
         N
        </code>
       </em>
       most recently chosen
              passwords. The following statement prohibits reuse of any
              of the previous 6 passwords:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa55828753"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">HISTORY</span> <span class="token number">6</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    permits these
    <em class="replaceable">
     <code>
      password_option
     </code>
    </em>
    values for
          controlling reuse of previous passwords based on time elapsed:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD REUSE INTERVAL DEFAULT
       </code>
      </p>
      <p>
       Sets all statements named by the account so that the
              global policy about time elapsed applies, to prohibit
              reuse of passwords newer than the number of days specified
              by the
       <a class="link" href="server-system-variables.html#sysvar_password_reuse_interval">
        <code class="literal">
         password_reuse_interval
        </code>
       </a>
       system variable.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa54920998"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REUSE</span> <span class="token keyword">INTERVAL</span> <span class="token keyword">DEFAULT</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD REUSE INTERVAL
        <em class="replaceable">
         <code>
          N
         </code>
        </em>
        DAY
       </code>
      </p>
      <p>
       This time-elapsed option overrides the global policy for
              all accounts named by the statement. For each, it sets the
              password reuse interval to
       <em class="replaceable">
        <code>
         N
        </code>
       </em>
       days, to prohibit reuse of passwords newer than that many
              days. The following statement prohibits password reuse for
              360 days:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa87239801"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REUSE</span> <span class="token keyword">INTERVAL</span> <span class="token number">360</span> <span class="token keyword">DAY</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    permits these
    <em class="replaceable">
     <code>
      password_option
     </code>
    </em>
    values for
          controlling whether attempts to change an account password
          must specify the current password, as verification that the
          user attempting to make the change actually knows the current
          password:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD REQUIRE CURRENT
       </code>
      </p>
      <p>
       This verification option overrides the global policy for
              all accounts named by the statement. For each, it requires
              that password changes specify the current password.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa86323638"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">CURRENT</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD REQUIRE CURRENT OPTIONAL
       </code>
      </p>
      <p>
       This verification option overrides the global policy for
              all accounts named by the statement. For each, it does not
              require that password changes specify the current
              password. (The current password may but need not be
              given.)
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa45689100"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">CURRENT</span> <span class="token keyword">OPTIONAL</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD REQUIRE CURRENT DEFAULT
       </code>
      </p>
      <p>
       Sets all statements named by the account so that the
              global policy about password verification applies, as
              specified by the
       <a class="link" href="server-system-variables.html#sysvar_password_require_current">
        <code class="literal">
         password_require_current
        </code>
       </a>
       system variable.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa88097517"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">CURRENT</span> <span class="token keyword">DEFAULT</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    permits these
    <em class="replaceable">
     <code>
      password_option
     </code>
    </em>
    values for
          controlling failed-login tracking:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        FAILED_LOGIN_ATTEMPTS
        <em class="replaceable">
         <code>
          N
         </code>
        </em>
       </code>
      </p>
      <p>
       Whether to track account login attempts that specify an
              incorrect password.
       <em class="replaceable">
        <code>
         N
        </code>
       </em>
       must be a
              number from 0 to 32767. A value of 0 disables failed-login
              tracking. Values greater than 0 indicate how many
              consecutive password failures cause temporary account
              locking (if
       <code class="literal">
        PASSWORD_LOCK_TIME
       </code>
       is also
              nonzero).
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD_LOCK_TIME {
        <em class="replaceable">
         <code>
          N
         </code>
        </em>
        | UNBOUNDED}
       </code>
      </p>
      <p>
       How long to lock the account after too many consecutive
              login attempts provide an incorrect password.
       <em class="replaceable">
        <code>
         N
        </code>
       </em>
       must be a number from 0 to
              32767, or
       <code class="literal">
        UNBOUNDED
       </code>
       . A value of 0
              disables temporary account locking. Values greater than 0
              indicate how long to lock the account in days. A value of
       <code class="literal">
        UNBOUNDED
       </code>
       causes the account locking
              duration to be unbounded; once locked, the account remains
              in a locked state until unlocked. For information about
              the conditions under which unlocking occurs, see
       <a class="xref" href="password-management.html#failed-login-tracking" title="Failed-Login Tracking and Temporary Account Locking">
        Failed-Login Tracking and Temporary Account Locking
       </a>
       .
      </p>
     </li>
    </ul>
   </div>
   <p>
    For failed-login tracking and temporary locking to occur, an
          account's
    <code class="literal">
     FAILED_LOGIN_ATTEMPTS
    </code>
    and
    <code class="literal">
     PASSWORD_LOCK_TIME
    </code>
    options both must be
          nonzero. The following statement modifies an account such that
          it remains locked for two days after four consecutive password
          failures:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa25796352"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">FAILED_LOGIN_ATTEMPTS</span> <span class="token number">4</span> <span class="token keyword">PASSWORD_LOCK_TIME</span> <span class="token number">2</span><span class="token punctuation">;</span></code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="alter-user-comments-attributes">
       </a>
       ALTER USER Comment and Attribute Options
      </h5>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045174671568">
   </a>
   <a class="indexterm" name="idm46045174670080">
   </a>
   <p>
    MySQL 8.4 supports user comments and user
          attributes, as described in
    <a class="xref" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     Section 15.7.1.3, “CREATE USER Statement”
    </a>
    .
          These can be modified employing
    <code class="literal">
     ALTER USER
    </code>
    by means of the
    <code class="literal">
     COMMENT
    </code>
    and
    <code class="literal">
     ATTRIBUTE
    </code>
    options, respectively. You cannot
          specify both options in the same
    <code class="literal">
     ALTER USER
    </code>
    statement; attempting to do so results in a syntax error.
   </p>
   <p>
    The user comment and user attribute are stored in the
          Information Schema
    <a class="link" href="information-schema-user-attributes-table.html" title="28.3.45 The INFORMATION_SCHEMA USER_ATTRIBUTES Table">
     <code class="literal">
      USER_ATTRIBUTES
     </code>
    </a>
    table as a JSON
          object; the user comment is stored as the value for a
    <code class="literal">
     comment
    </code>
    key in the ATTRIBUTE column of this
          table, as shown later in this discussion. The
    <code class="literal">
     COMMENT
    </code>
    text can be any arbitrary quoted
          text, and replaces any existing user comment. The
    <code class="literal">
     ATTRIBUTE
    </code>
    value must be the valid string
          representation of a JSON object. This is merged with any
          existing user attribute as if the
    <a class="link" href="json-modification-functions.html#function_json-merge-patch">
     <code class="literal">
      JSON_MERGE_PATCH()
     </code>
    </a>
    function had
          been used on the existing user attribute and the new one; for
          any keys that are re-used, the new value overwrites the old
          one, as shown here:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa84092051"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token operator">*</span> <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span>USER_ATTRIBUTES
<span class="token prompt">    -&gt;</span>     <span class="token keyword">WHERE</span> <span class="token keyword">USER</span><span class="token operator">=</span><span class="token string">'bill'</span> <span class="token operator">AND</span> <span class="token keyword">HOST</span><span class="token operator">=</span><span class="token string">'localhost'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> USER <span class="token punctuation">|</span> HOST      <span class="token punctuation">|</span> ATTRIBUTE      <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> bill <span class="token punctuation">|</span> localhost <span class="token punctuation">|</span> {"foo": "bar"} <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output">1 row in set (0.11 sec)</span>

<span class="token prompt">mysql&gt;</span> <span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'bill'</span>@<span class="token string">'localhost'</span> <span class="token keyword">ATTRIBUTE</span> <span class="token string">'{"baz": "faz", "foo": "moo"}'</span><span class="token punctuation">;</span>
<span class="token output">Query OK, 0 rows affected (0.22 sec)</span>

<span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token operator">*</span> <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span>USER_ATTRIBUTES
<span class="token prompt">    -&gt;</span>     <span class="token keyword">WHERE</span> <span class="token keyword">USER</span><span class="token operator">=</span><span class="token string">'bill'</span> <span class="token operator">AND</span> <span class="token keyword">HOST</span><span class="token operator">=</span><span class="token string">'localhost'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> USER <span class="token punctuation">|</span> HOST      <span class="token punctuation">|</span> ATTRIBUTE                    <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> bill <span class="token punctuation">|</span> localhost <span class="token punctuation">|</span> {"baz": "faz", "foo": "moo"} <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output">1 row in set (0.00 sec)</span></code></pre>
   </div>
   <p>
    To remove a key and its value from the user attribute, set the
          key to JSON
    <code class="literal">
     null
    </code>
    (must be lowercase and
          unquoted), like this:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa48709285"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'bill'</span>@<span class="token string">'localhost'</span> <span class="token keyword">ATTRIBUTE</span> <span class="token string">'{"foo": null}'</span><span class="token punctuation">;</span>
<span class="token output">Query OK, 0 rows affected (0.08 sec)</span>

<span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token operator">*</span> <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span>USER_ATTRIBUTES
<span class="token prompt">    -&gt;</span>     <span class="token keyword">WHERE</span> <span class="token keyword">USER</span><span class="token operator">=</span><span class="token string">'bill'</span> <span class="token operator">AND</span> <span class="token keyword">HOST</span><span class="token operator">=</span><span class="token string">'localhost'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> USER <span class="token punctuation">|</span> HOST      <span class="token punctuation">|</span> ATTRIBUTE      <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> bill <span class="token punctuation">|</span> localhost <span class="token punctuation">|</span> {"baz": "faz"} <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output">1 row in set (0.00 sec)</span></code></pre>
   </div>
   <p>
    To set an existing user comment to an empty string, use
    <code class="literal">
     ALTER USER ... COMMENT ''
    </code>
    . This leaves an
          empty
    <code class="literal">
     comment
    </code>
    value in the
    <a class="link" href="information-schema-user-attributes-table.html" title="28.3.45 The INFORMATION_SCHEMA USER_ATTRIBUTES Table">
     <code class="literal">
      USER_ATTRIBUTES
     </code>
    </a>
    table; to remove
          the user comment completely, use
    <code class="literal">
     ALTER USER ...
          ATTRIBUTE ...
    </code>
    with the value for the column key set
          to JSON
    <code class="literal">
     null
    </code>
    (unquoted, in lower case).
          This is illustrated by the following sequence of SQL
          statements:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa99499874"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'bill'</span>@<span class="token string">'localhost'</span> <span class="token keyword">COMMENT</span> <span class="token string">'Something about Bill'</span><span class="token punctuation">;</span>
<span class="token output">Query OK, 0 rows affected (0.06 sec)</span>

<span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token operator">*</span> <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span>USER_ATTRIBUTES
<span class="token prompt">    -&gt;</span>     <span class="token keyword">WHERE</span> <span class="token keyword">USER</span><span class="token operator">=</span><span class="token string">'bill'</span> <span class="token operator">AND</span> <span class="token keyword">HOST</span><span class="token operator">=</span><span class="token string">'localhost'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> USER <span class="token punctuation">|</span> HOST      <span class="token punctuation">|</span> ATTRIBUTE                                         <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> bill <span class="token punctuation">|</span> localhost <span class="token punctuation">|</span> {"baz": "faz", "comment": "Something about Bill"} <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output">1 row in set (0.00 sec)</span>

<span class="token prompt">mysql&gt;</span> <span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'bill'</span>@<span class="token string">'localhost'</span> <span class="token keyword">COMMENT</span> <span class="token string">''</span><span class="token punctuation">;</span>
<span class="token output">Query OK, 0 rows affected (0.09 sec)</span>

<span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token operator">*</span> <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span>USER_ATTRIBUTES
<span class="token prompt">    -&gt;</span>     <span class="token keyword">WHERE</span> <span class="token keyword">USER</span><span class="token operator">=</span><span class="token string">'bill'</span> <span class="token operator">AND</span> <span class="token keyword">HOST</span><span class="token operator">=</span><span class="token string">'localhost'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> USER <span class="token punctuation">|</span> HOST      <span class="token punctuation">|</span> ATTRIBUTE                     <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> bill <span class="token punctuation">|</span> localhost <span class="token punctuation">|</span> {"baz": "faz", "comment": ""} <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output">1 row in set (0.00 sec)</span>

<span class="token prompt">mysql&gt;</span> <span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'bill'</span>@<span class="token string">'localhost'</span> <span class="token keyword">ATTRIBUTE</span> <span class="token string">'{"comment": null}'</span><span class="token punctuation">;</span>
<span class="token output">Query OK, 0 rows affected (0.07 sec)</span>

<span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token operator">*</span> <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span>USER_ATTRIBUTES
<span class="token prompt">    -&gt;</span>     <span class="token keyword">WHERE</span> <span class="token keyword">USER</span><span class="token operator">=</span><span class="token string">'bill'</span> <span class="token operator">AND</span> <span class="token keyword">HOST</span><span class="token operator">=</span><span class="token string">'localhost'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> USER <span class="token punctuation">|</span> HOST      <span class="token punctuation">|</span> ATTRIBUTE      <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> bill <span class="token punctuation">|</span> localhost <span class="token punctuation">|</span> {"baz": "faz"} <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output">1 row in set (0.00 sec)</span></code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="alter-user-account-locking">
       </a>
       ALTER USER Account-Locking Options
      </h5>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045174632752">
   </a>
   <p>
    MySQL supports account locking and unlocking using the
    <code class="literal">
     ACCOUNT LOCK
    </code>
    and
    <code class="literal">
     ACCOUNT
          UNLOCK
    </code>
    options, which specify the locking state for
          an account. For additional discussion, see
    <a class="xref" href="account-locking.html" title="8.2.20 Account Locking">
     Section 8.2.20, “Account Locking”
    </a>
    .
   </p>
   <p>
    If multiple account-locking options are specified, the last
          one takes precedence.
   </p>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER ...
          ACCOUNT UNLOCK
     </code>
    </a>
    unlocks any account named by the
          statement that is temporarily locked due to too many failed
          logins. See
    <a class="xref" href="password-management.html" title="8.2.15 Password Management">
     Section 8.2.15, “Password Management”
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="alter-user-binary-logging">
       </a>
       ALTER USER Binary Logging
      </h5>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045174624352">
   </a>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    is written to the
          binary log if it succeeds, but not if it fails; in that case,
          rollback occurs and no changes are made. A statement written
          to the binary log includes all named users. If the
    <code class="literal">
     IF
          EXISTS
    </code>
    clause is given, this includes even users
          that do not exist and were not altered.
   </p>
   <p>
    If the original statement changes the credentials for a user,
          the statement written to the binary log specifies the
          applicable authentication plugin for that user, determined as
          follows:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The plugin named in the original statement, if one was
              specified.
      </p>
     </li>
     <li class="listitem">
      <p>
       Otherwise, the plugin associated with the user account if
              the user exists, or the default authentication plugin if
              the user does not exist. (If the statement written to the
              binary log must specify a particular authentication plugin
              for a user, include it in the original statement.)
      </p>
     </li>
    </ul>
   </div>
   <p>
    If the server adds the default authentication plugin for any
          users in the statement written to the binary log, it writes a
          warning to the error log naming those users.
   </p>
   <p>
    If the original statement specifies the
    <code class="literal">
     FAILED_LOGIN_ATTEMPTS
    </code>
    or
    <code class="literal">
     PASSWORD_LOCK_TIME
    </code>
    option, the statement
          written to the binary log includes the option.
   </p>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    statements with
          clauses that support multifactor authentication (MFA) are
          written to the binary log with the exception of
    <code class="literal">
     ALTER
          USER
     <em class="replaceable">
      <code>
       user factor
      </code>
     </em>
     INITIATE
          REGISTRATION
    </code>
    statements.
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        ALTER USER
        <em class="replaceable">
         <code>
          user factor
         </code>
        </em>
        FINISH REGISTRATION SET CHALLENGE_RESPONSE AS
              '
        <em class="replaceable">
         <code>
          auth_string
         </code>
        </em>
        '
       </code>
       statements are written to the binary log as
       <code class="literal">
        ALTER
              USER
        <em class="replaceable">
         <code>
          user
         </code>
        </em>
        MODIFY
        <em class="replaceable">
         <code>
          factor
         </code>
        </em>
        IDENTIFIED WITH
              authentication_webauthn AS
        <em class="replaceable">
         <code>
          webauthn_hash_string
         </code>
        </em>
       </code>
       ;
      </p>
     </li>
     <li class="listitem">
      <p>
       In a replication context, the replication user requires
       <a class="link" href="privileges-provided.html#priv_passwordless-user-admin">
        <code class="literal">
         PASSWORDLESS_USER_ADMIN
        </code>
       </a>
       privilege to execute
       <code class="literal">
        ALTER USER ...
              MODIFY
       </code>
       operations on accounts configured for
              passwordless authentication using the
       <code class="literal">
        authentication_webauthn
       </code>
       plugin.
      </p>
     </li>
    </ul>
   </div>
  </div>
 </div>
 <br/>
</div>
