<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="group-replication-user-credentials">
      </a>
      20.2.1.3 User Credentials For Distributed Recovery
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045134177200">
  </a>
  <p>
   Group Replication uses a distributed recovery process to
        synchronize group members when joining them to the group.
        Distributed recovery involves transferring transactions from a
        donor's binary log to a joining member using a replication
        channel named
   <code class="literal">
    group_replication_recovery
   </code>
   . You
        must therefore set up a replication user with the correct
        permissions so that Group Replication can establish direct
        member-to-member replication channels. If group members have
        been set up to support the use of a remote cloning operation as
        part of distributed recovery, this replication user is also used
        as the clone user on the donor, and requires the correct
        permissions for this role too. For a complete description of
        distributed recovery, see
   <a class="xref" href="group-replication-distributed-recovery.html" title="20.5.4 Distributed Recovery">
    Section 20.5.4, “Distributed Recovery”
   </a>
   .
  </p>
  <p>
   The same replication user must be used for distributed recovery
        on every group member. The process of creating the replication
        user for distributed recovery can be captured in the binary log,
        and then you can rely on distributed recovery to replicate the
        statements used to create the user. Alternatively, you can
        disable binary logging before creating the replication user, and
        then create the user manually on each member, for example if you
        want to avoid the changes being propagated to other server
        instances. If you do this, ensure you re-enable binary logging
        once you have configured the user.
  </p>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    If distributed recovery connections for your group use SSL,
          the replication user must be created on each server
    <span class="emphasis">
     <em>
      before
     </em>
    </span>
    the joining member connects to the
          donor. For instructions to set up SSL for distributed recovery
          connections and create a replication user that requires SSL,
          see
    <a class="xref" href="group-replication-distributed-recovery-securing.html" title="20.6.3 Securing Distributed Recovery Connections">
     Section 20.6.3, “Securing Distributed Recovery Connections”
    </a>
   </p>
  </div>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    By default, users created in MySQL 8 use
    <a class="xref" href="caching-sha2-pluggable-authentication.html" title="8.4.1.2 Caching SHA-2 Pluggable Authentication">
     Section 8.4.1.2, “Caching SHA-2 Pluggable Authentication”
    </a>
    . If
          the replication user for distributed recovery uses the caching
          SHA-2 authentication plugin, and you are
    <span class="emphasis">
     <em>
      not
     </em>
    </span>
    using SSL for distributed recovery
          connections, RSA key-pairs are used for password exchange. You
          can either copy the public key of the replication user to the
          joining member, or configure the donors to provide the public
          key when requested. For instructions to do this, see
    <a class="xref" href="group-replication-secure-user.html" title="20.6.3.1 Secure User Credentials for Distributed Recovery">
     Section 20.6.3.1, “Secure User Credentials for Distributed Recovery”
    </a>
    .
   </p>
  </div>
  <p>
   To create the replication user for distributed recovery, follow
        these steps:
  </p>
  <div class="orderedlist">
   <ol class="orderedlist" type="1">
    <li class="listitem">
     <p>
      Start the MySQL server instance, then connect a client to
            it.
     </p>
    </li>
    <li class="listitem">
     <p>
      If you want to disable binary logging in order to create the
            replication user separately on each instance, do so by
            issuing the following statement:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa70098233"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SET</span> SQL_LOG_BIN<span class="token operator">=</span><span class="token number">0</span><span class="token punctuation">;</span></code></pre>
     </div>
    </li>
    <li class="listitem">
     <p>
      Create a MySQL user with the following privileges:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: disc; ">
       <li class="listitem">
        <p>
         <a class="link" href="privileges-provided.html#priv_replication-slave">
          <code class="literal">
           REPLICATION SLAVE
          </code>
         </a>
         , which
                is required for making a distributed recovery connection
                to a donor to retrieve data.
        </p>
       </li>
       <li class="listitem">
        <p>
         <a class="link" href="privileges-provided.html#priv_connection-admin">
          <code class="literal">
           CONNECTION_ADMIN
          </code>
         </a>
         , which
                ensures that Group Replication connections are not
                terminated if one of the servers involved is placed in
                offline mode.
        </p>
       </li>
       <li class="listitem">
        <p>
         <a class="link" href="privileges-provided.html#priv_backup-admin">
          <code class="literal">
           BACKUP_ADMIN
          </code>
         </a>
         , if the
                servers in the replication group are set up to support
                cloning (see
         <a class="xref" href="group-replication-cloning.html" title="20.5.4.2 Cloning for Distributed Recovery">
          Section 20.5.4.2, “Cloning for Distributed Recovery”
         </a>
         ). This
                privilege is required for a member to act as the donor
                in a cloning operation for distributed recovery.
        </p>
       </li>
       <li class="listitem">
        <p>
         <a class="link" href="privileges-provided.html#priv_group-replication-stream">
          <code class="literal">
           GROUP_REPLICATION_STREAM
          </code>
         </a>
         ,
                if the MySQL communication stack is in use for the
                replication group (see
         <a class="xref" href="group-replication-connection-security.html" title="20.6.1 Communication Stack for Connection Security Management">
          Section 20.6.1, “Communication Stack for Connection Security Management”
         </a>
         ).
                This privilege is required for the user account to be
                able to establish and maintain connections for Group
                Replication using the MySQL communication stack.
        </p>
       </li>
      </ul>
     </div>
     <p>
      In this example the user
      <em class="replaceable">
       <code>
        rpl_user
       </code>
      </em>
      with the password
      <em class="replaceable">
       <code>
        password
       </code>
      </em>
      is
            shown. When configuring your servers use a suitable user
            name and password:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa73889709"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <em class="replaceable">rpl_user</em>@<span class="token string">'%'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">GRANT</span> <span class="token keyword">REPLICATION</span> <span class="token keyword">SLAVE</span> <span class="token keyword">ON</span> <span class="token operator">*</span><span class="token punctuation">.</span><span class="token operator">*</span> <span class="token keyword">TO</span> <em class="replaceable">rpl_user</em>@<span class="token string">'%'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">GRANT</span> CONNECTION_ADMIN <span class="token keyword">ON</span> <span class="token operator">*</span><span class="token punctuation">.</span><span class="token operator">*</span> <span class="token keyword">TO</span> <em class="replaceable">rpl_user</em>@<span class="token string">'%'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">GRANT</span> BACKUP_ADMIN <span class="token keyword">ON</span> <span class="token operator">*</span><span class="token punctuation">.</span><span class="token operator">*</span> <span class="token keyword">TO</span> <em class="replaceable">rpl_user</em>@<span class="token string">'%'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">GRANT</span> GROUP_REPLICATION_STREAM <span class="token keyword">ON</span> <span class="token operator">*</span><span class="token punctuation">.</span><span class="token operator">*</span> <span class="token keyword">TO</span> <em class="replaceable">rpl_user</em>@<span class="token string">'%'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">FLUSH</span> <span class="token keyword">PRIVILEGES</span><span class="token punctuation">;</span></code></pre>
     </div>
    </li>
    <li class="listitem">
     <p>
      If you disabled binary logging, enable it again as soon as
            you have created the user, by issuing the following
            statement:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa64259609"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SET</span> SQL_LOG_BIN<span class="token operator">=</span><span class="token number">1</span><span class="token punctuation">;</span></code></pre>
     </div>
    </li>
    <li class="listitem">
     <p>
      When you have created the replication user, you must supply
            the user credentials to the server for use with distributed
            recovery. You can do this by setting the user credentials as
            the credentials for the
      <code class="literal">
       group_replication_recovery
      </code>
      channel, using
            a
      <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
       <code class="literal">
        CHANGE REPLICATION SOURCE
            TO
       </code>
      </a>
      statement. Alternatively, you can specify the
            user credentials for distributed recovery in a
      <a class="link" href="start-group-replication.html" title="15.4.3.1 START GROUP_REPLICATION Statement">
       <code class="literal">
        START GROUP_REPLICATION
       </code>
      </a>
      statement.
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: disc; ">
       <li class="listitem">
        <p>
         User credentials set using
         <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
          <code class="literal">
           CHANGE
                REPLICATION SOURCE TO
          </code>
         </a>
         are stored in plain text
                in the replication metadata repositories on the server.
                They are applied whenever Group Replication is started,
                including automatic starts if the
         <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_start_on_boot">
          <code class="literal">
           group_replication_start_on_boot
          </code>
         </a>
         system variable is set to
         <code class="literal">
          ON
         </code>
         .
        </p>
       </li>
       <li class="listitem">
        <p>
         User credentials specified on
         <a class="link" href="start-group-replication.html" title="15.4.3.1 START GROUP_REPLICATION Statement">
          <code class="literal">
           START
                GROUP_REPLICATION
          </code>
         </a>
         are saved in memory only,
                and are removed by a
         <a class="link" href="stop-group-replication.html" title="15.4.3.2 STOP GROUP_REPLICATION Statement">
          <code class="literal">
           STOP
                GROUP_REPLICATION
          </code>
         </a>
         statement or server
                shutdown. You must issue a
         <a class="link" href="start-group-replication.html" title="15.4.3.1 START GROUP_REPLICATION Statement">
          <code class="literal">
           START
                GROUP_REPLICATION
          </code>
         </a>
         statement to provide the
                credentials again, so you cannot start Group Replication
                automatically with these credentials. This method of
                specifying the user credentials helps to secure the
                Group Replication servers against unauthorized access.
        </p>
       </li>
      </ul>
     </div>
     <p>
      For more information on the security implications of each
            method of providing the user credentials, see
      <a class="xref" href="group-replication-secure-user.html#group-replication-secure-user-provide" title="20.6.3.1.3 Providing Replication User Credentials Securely">
       Section 20.6.3.1.3, “Providing Replication User Credentials Securely”
      </a>
      . If
            you choose to provide the user credentials using a
      <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
       <code class="literal">
        CHANGE REPLICATION SOURCE TO
       </code>
      </a>
      statement, issue the following statement on the server
            instance now, replacing
      <em class="replaceable">
       <code>
        rpl_user
       </code>
      </em>
      and
      <em class="replaceable">
       <code>
        password
       </code>
      </em>
      with the values used
            when creating the user:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa13015261"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">CHANGE</span> <span class="token keyword">REPLICATION</span> <span class="token keyword">SOURCE</span> <span class="token keyword">TO</span> <span class="token keyword">SOURCE_USER</span><span class="token operator">=</span><span class="token string">'<em class="replaceable">rpl_user</em>'</span><span class="token punctuation">,</span> 
<span class="token prompt">    -&gt;</span>   <span class="token keyword">SOURCE_PASSWORD</span><span class="token operator">=</span><span class="token string">'<em class="replaceable">password</em>'</span>
<span class="token prompt">    -&gt;</span>   <span class="token keyword">FOR</span> <span class="token keyword">CHANNEL</span> <span class="token string">'group_replication_recovery'</span><span class="token punctuation">;</span></code></pre>
     </div>
    </li>
   </ol>
  </div>
 </div>
 <br/>
</div>
