<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="role-names">
      </a>
      8.2.5 Specifying Role Names
     </h3>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045249894160">
  </a>
  <a class="indexterm" name="idm46045249893088">
  </a>
  <a class="indexterm" name="idm46045249891600">
  </a>
  <p>
   MySQL role names refer to roles, which are named collections of
      privileges. For role usage examples, see
   <a class="xref" href="roles.html" title="8.2.10 Using Roles">
    Section 8.2.10, “Using Roles”
   </a>
   .
  </p>
  <p>
   Role names have syntax and semantics similar to account names; see
   <a class="xref" href="account-names.html" title="8.2.4 Specifying Account Names">
    Section 8.2.4, “Specifying Account Names”
   </a>
   . As stored in the grant tables,
      they have the same properties as account names, which are
      described in
   <a class="xref" href="grant-tables.html#grant-tables-scope-column-properties" title="Grant Table Scope Column Properties">
    Grant Table Scope Column Properties
   </a>
   .
  </p>
  <p>
   Role names differ from account names in these respects:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      The user part of role names cannot be blank. Thus, there is no
      <span class="quote">
       “
       <span class="quote">
        anonymous role
       </span>
       ”
      </span>
      analogous to the concept of
      <span class="quote">
       “
       <span class="quote">
        anonymous user.
       </span>
       ”
      </span>
     </p>
    </li>
    <li class="listitem">
     <p>
      As for an account name, omitting the host part of a role name
          results in a host part of
      <code class="literal">
       '%'
      </code>
      . But unlike
      <code class="literal">
       '%'
      </code>
      in an account name, a host part of
      <code class="literal">
       '%'
      </code>
      in a role name has no wildcard
          properties. For example, for a name
      <code class="literal">
       'me'@'%'
      </code>
      used as a role name, the host part
          (
      <code class="literal">
       '%'
      </code>
      ) is just a literal value; it has no
      <span class="quote">
       “
       <span class="quote">
        any host
       </span>
       ”
      </span>
      matching property.
     </p>
    </li>
    <li class="listitem">
     <p>
      Netmask notation in the host part of a role name has no
          significance.
     </p>
    </li>
    <li class="listitem">
     <p>
      An account name is permitted to be
      <a class="link" href="information-functions.html#function_current-user">
       <code class="literal">
        CURRENT_USER()
       </code>
      </a>
      in several
          contexts. A role name is not.
     </p>
    </li>
   </ul>
  </div>
  <p>
   It is possible for a row in the
   <code class="literal">
    mysql.user
   </code>
   system table to serve as both an account and a role. In this case,
      any special user or host name matching properties do not apply in
      contexts for which the name is used as a role name. For example,
      you cannot execute the following statement with the expectation
      that it sets the current session roles using all roles that have a
      user part of
   <code class="literal">
    myrole
   </code>
   and any host name:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa66019502"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SET</span> <span class="token keyword">ROLE</span> <span class="token string">'myrole'</span>@<span class="token string">'%'</span><span class="token punctuation">;</span></code></pre>
  </div>
  <p>
   Instead, the statement sets the active role for the session to the
      role with exactly the name
   <code class="literal">
    'myrole'@'%'
   </code>
   .
  </p>
  <p>
   For this reason, role names are often specified using only the
      user name part and letting the host name part implicitly be
   <code class="literal">
    '%'
   </code>
   . Specifying a role with a
      non-
   <code class="literal">
    '%'
   </code>
   host part can be useful if you intend
      to create a name that works both as a role an as a user account
      that is permitted to connect from the given host.
  </p>
 </div>
 <br/>
</div>
