# mysql.user Table 1. PARTITION BY SYSTEM\_TIME is not supported for transaction-precise system-versioned tables. Attempting The [mysql.global\_priv table](https://mariadb.com/docs/server/reference/system-tables/the-mysql-database-tables/mysql-global_priv-table) has replaced the `mysql.user` table, and `mysql.user` should be considered obsolete. It is now a [view](https://mariadb.com/docs/server/server-usage/views) into `mysql.global_priv` created for compatibility with older applications and monitoring scripts. New tools are supposed to use `INFORMATION_SCHEMA` tables. The dedicated `mariadb.sys` user is created as the definer of the view. Previously, `root` was the definer, which resulted in privilege problems when this username was changed ([MDEV-19650](https://jira.mariadb.org/browse/MDEV-19650)). The `mysql.user` table contains information about users that have permission to access the MariaDB server, and their global privileges. The table can be queried and although it is possible to directly update it, it is best to use [GRANT](https://mariadb.com/docs/server/reference/sql-statements/account-management-sql-statements/grant) and [CREATE USER](https://mariadb.com/docs/server/reference/sql-statements/account-management-sql-statements/create-user) for adding users and privileges. Note that the MariaDB privileges occur at many levels. A user may not be granted `create` privilege at the user level, but may still have `create` permission on certain tables or databases, for example. See [privileges](https://mariadb.com/docs/server/reference/sql-statements/account-management-sql-statements/grant) for a more complete view of the MariaDB privilege system. The `mysql.user` table contains the following fields: | Field | Type | Null | Key | Default | Description | | ------------------------ | ------------------------------------ | ---- | --- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Host | char(60) | NO | PRI | | Host (together with User makes up the unique identifier for this account. | | User | char(80) | NO | PRI | | User (together with Host makes up the unique identifier for this account. | | Password | longtext | NO | | | Hashed password, generated by the [PASSWORD()](https://mariadb.com/docs/server/reference/sql-functions/secondary-functions/encryption-hashing-and-compression-functions/password) function. | | Select\_priv | enum('N','Y') | NO | | N | Can perform [SELECT](https://mariadb.com/docs/server/reference/sql-statements/data-manipulation/selecting-data/select) statements. | | Insert\_priv | enum('N','Y') | NO | | N | Can perform [INSERT](https://mariadb.com/docs/server/reference/sql-statements/data-manipulation/inserting-loading-data/insert) statements. | | Update\_priv | enum('N','Y') | NO | | N | Can perform [UPDATE](https://mariadb.com/docs/server/reference/sql-statements/data-manipulation/changing-deleting-data/update) statements. | | Delete\_priv | enum('N','Y') | NO | | N | Can perform [DELETE](https://mariadb.com/docs/server/reference/sql-statements/data-manipulation/changing-deleting-data/delete) statements. | | Create\_priv | enum('N','Y') | NO | | N | Can [CREATE DATABASE's](https://mariadb.com/docs/server/reference/sql-statements/data-definition/create/create-database) or [CREATE TABLE's](https://mariadb.com/docs/server/server-usage/tables/create-table). | | Drop\_priv | enum('N','Y') | NO | | N | Can [DROP DATABASE's](https://mariadb.com/docs/server/reference/sql-statements/data-definition/drop/drop-database) or [DROP TABLE's](https://mariadb.com/docs/server/server-usage/tables/drop-table). | | Reload\_priv | enum('N','Y') | NO | | N | Can execute [FLUSH](https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/flush-commands/flush) statements or equivalent [mariadb-admin](https://mariadb.com/docs/server/clients-and-utilities/administrative-tools/mariadb-admin) commands. | | Shutdown\_priv | enum('N','Y') | NO | | N | Can shut down the server with [SHUTDOWN](https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/shutdown) or [mariadb-admin shutdown](https://mariadb.com/docs/server/clients-and-utilities/administrative-tools/mariadb-admin). | | Process\_priv | enum('N','Y') | NO | | N | Can show information about active processes, via [SHOW PROCESSLIST](https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/show/show-processlist) or [mariadb-admin processlist](https://mariadb.com/docs/server/clients-and-utilities/administrative-tools/mariadb-admin). | | File\_priv | enum('N','Y') | NO | | N | Read and write files on the server, using statements like [LOAD DATA INFILE](https://mariadb.com/docs/server/reference/sql-statements/data-manipulation/inserting-loading-data/load-data-into-tables-or-index/load-data-infile) or functions like [LOAD\_FILE()](https://mariadb.com/docs/server/reference/sql-functions/string-functions/load_file). Also needed to create [CONNECT](https://mariadb.com/docs/server/server-usage/storage-engines/connect) outward tables. MariaDB server must have permission to access those files. | | Grant\_priv | enum('N','Y') | NO | | N | User can [grant](https://mariadb.com/docs/server/reference/sql-statements/account-management-sql-statements/grant) privileges they possess. | | References\_priv | enum('N','Y') | NO | | N | Unused | | Index\_priv | enum('N','Y') | NO | | N | Can create an index on a table using the [CREATE INDEX](https://mariadb.com/docs/server/reference/sql-statements/data-definition/create/create-index) statement. Without the INDEX privilege, user can still create indexes when creating a table using the [CREATE TABLE](https://mariadb.com/docs/server/server-usage/tables/create-table) statement if the user has have the CREATE privilege, and user can create indexes using the [ALTER TABLE](https://mariadb.com/docs/server/reference/sql-statements/data-definition/alter/alter-table) statement if they have the ALTER privilege. | | Alter\_priv | enum('N','Y') | NO | | N | Can perform [ALTER TABLE](https://mariadb.com/docs/server/reference/sql-statements/data-definition/alter/alter-table) statements. | | Show\_db\_priv | enum('N','Y') | NO | | N | Can list all databases using the [SHOW DATABASES](https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/show/show-databases) statement. Without the SHOW DATABASES privilege, user can still issue the SHOW DATABASES statement, but it will only list databases containing tables on which they have privileges. | | Super\_priv | enum('N','Y') | NO | | N | Can execute superuser statements: [CHANGE MASTER TO](https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/replication-statements/change-master-to), [KILL](https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/kill) (users who do not have this privilege can only KILL their own threads), [PURGE LOGS](https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/purge-binary-logs), [SET global system variables](https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/set-commands/set), or the [mariadb-admin debug](https://mariadb.com/docs/server/clients-and-utilities/administrative-tools/mariadb-admin) command. Also, this permission allows the user to write data even if the [read\_only](https://mariadb.com/docs/server/server-management/variables-and-modes/server-system-variables#read_only) startup option is set, enable or disable logging, enable or disable replication on slaves, specify a DEFINER for statements that support that clause, connect once after reaching the MAX\_CONNECTIONS. If a statement has been specified for the [init-connect](https://mariadb.com/docs/server/server-management/variables-and-modes/server-system-variables#init_connect) mysqld option, that command will not be executed when a user with SUPER privileges connects to the server. | | Create\_tmp\_table\_priv | enum('N','Y') | NO | | N | Can create temporary tables with the [CREATE TEMPORARY TABLE](https://mariadb.com/docs/server/server-usage/tables/create-table) statement. | | Lock\_tables\_priv | enum('N','Y') | NO | | N | Acquire explicit locks using the [LOCK TABLES](https://mariadb.com/docs/server/reference/sql-statements/transactions/lock-tables) statement; user also needs to have the SELECT privilege on a table in order to lock it. | | Execute\_priv | enum('N','Y') | NO | | N | Can execute [stored procedure](https://mariadb.com/docs/server/server-usage/stored-routines/stored-procedures) or functions. | | Repl\_slave\_priv | enum('N','Y') | NO | | N | Accounts used by slave servers on the master need this privilege. This is needed to get the updates made on the master. | | Repl\_client\_priv | enum('N','Y') | NO | | N | Can execute [SHOW MASTER STATUS](https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/show/show-binlog-status) and [SHOW SLAVE STATUS](https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/show/show-replica-status) statements. | | Create\_view\_priv | enum('N','Y') | NO | | N | Can create a view using the [CREATE\_VIEW](https://mariadb.com/docs/server/server-usage/views/create-view) statement. | | Show\_view\_priv | enum('N','Y') | NO | | N | Can show the [CREATE VIEW](https://mariadb.com/docs/server/server-usage/views/create-view) statement to create a view using the [SHOW CREATE VIEW](https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/show/show-create-view) statement. | | Create\_routine\_priv | enum('N','Y') | NO | | N | Can create stored programs using the [CREATE PROCEDURE](https://mariadb.com/docs/server/server-usage/stored-routines/stored-procedures/create-procedure) and [CREATE FUNCTION](https://mariadb.com/docs/server/reference/sql-statements/data-definition/create/create-function) statements. | | Alter\_routine\_priv | enum('N','Y') | NO | | N | Can change the characteristics of a stored function using the [ALTER FUNCTION](https://mariadb.com/docs/server/reference/sql-statements/data-definition/alter/alter-function) statement. | | Create\_user\_priv | enum('N','Y') | NO | | N | Can create a user using the [CREATE USER](https://mariadb.com/docs/server/reference/sql-statements/account-management-sql-statements/create-user) statement, or implicitly create a user with the [GRANT](https://mariadb.com/docs/server/reference/sql-statements/account-management-sql-statements/grant) statement. | | Event\_priv | enum('N','Y') | NO | | N | Create, drop and alter [events](https://mariadb.com/docs/server/server-usage/triggers-events/event-scheduler). | | Trigger\_priv | enum('N','Y') | NO | | N | Can execute [triggers](https://mariadb.com/docs/server/server-usage/triggers-events/triggers) associated with tables the user updates, execute the [CREATE TRIGGER](https://mariadb.com/docs/server/server-usage/triggers-events/triggers/create-trigger) and [DROP TRIGGER](https://mariadb.com/docs/server/reference/sql-statements/data-definition/drop/drop-trigger) statements. | | Create\_tablespace\_priv | enum('N','Y') | NO | | N | | | Delete\_history\_priv | enum('N','Y') | NO | | N | Can delete rows created through [system versioning](https://mariadb.com/docs/server/reference/sql-structure/temporal-tables/system-versioned-tables). | | ssl\_type | enum('', 'ANY', 'X509', 'SPECIFIED') | NO | | | TLS type - see [TLS options](https://mariadb.com/docs/server/sql-statements/account-management-sql-statements/grant#per-account-tls-options). | | ssl\_cipher | blob | NO | | NULL | TLS cipher - see [TLS options](https://mariadb.com/docs/server/sql-statements/account-management-sql-statements/grant#per-account-tls-options). | | x509\_issuer | blob | NO | | NULL | X509 cipher - see [TLS options](https://mariadb.com/docs/server/sql-statements/account-management-sql-statements/grant#per-account-tls-options). | | x509\_subject | blob | NO | | NULL | SSL subject - see [TLS options](https://mariadb.com/docs/server/sql-statements/account-management-sql-statements/grant#per-account-tls-options). | | max\_questions | int(11) unsigned | NO | | 0 | Number of queries the user can perform per hour. Zero is unlimited. See [per-account resource limits](https://mariadb.com/docs/server/sql-statements/account-management-sql-statements/grant#setting-per-account-resources-limits). | | max\_updates | int(11) unsigned | NO | | 0 | Number of updates the user can perform per hour. Zero is unlimited. See [per-account resource limits](https://mariadb.com/docs/server/sql-statements/account-management-sql-statements/grant#setting-per-account-resources-limits). | | max\_connections | int(11) unsigned | NO | | 0 | Number of connections the account can start per hour. Zero is unlimited. See [per-account resource limits](https://mariadb.com/docs/server/sql-statements/account-management-sql-statements/grant#setting-per-account-resources-limits). | | max\_user\_connections | int(11) | NO | | 0 | Number of simultaneous connections the account can have. Zero is unlimited. See [per-account resource limits](https://mariadb.com/docs/server/sql-statements/account-management-sql-statements/grant#setting-per-account-resources-limits). | | plugin | char(64) | NO | | | Authentication plugin used on connection. If empty, uses the [default](#authentication-plugin). | | authentication\_string | text | NO | | NULL | Authentication string for the authentication plugin. | | password\_expired | enum('N','Y') | NO | | N | MySQL-compatibility option, not implemented in MariaDB. | | is\_role | enum('N','Y') | NO | | N | Whether the user is a [role](https://mariadb.com/docs/server/security/user-account-management/roles). | | default\_role | char(80) | NO | | N | Role which will be enabled on user login automatically. | | max\_statement\_time | decimal(12,6) | NO | | 0.000000 | If non-zero, how long queries can run before being killed automatically. | | Field | Type | Null | Key | Default | Description | The [Acl\_roles](https://mariadb.com/docs/server/server-management/variables-and-modes/server-status-variables#acl_roles) status variable indicates how many rows the `mysql.user` table contains where `is_role='Y'`. The [Acl\_users](https://mariadb.com/docs/server/server-management/variables-and-modes/server-status-variables#acl_users) status variable, indicates how many rows the `mysql.user` table contains where `is_role='N'`. ### Authentication Plugin When the `plugin` column is empty, MariaDB defaults to authenticating accounts with either the [mysql\_native\_password](https://mariadb.com/docs/server/reference/plugins/authentication-plugins/authentication-plugin-mysql_native_password) or the [mysql\_old\_password](https://mariadb.com/docs/server/reference/plugins/authentication-plugins/authentication-plugin-mysql_old_password) plugins. It decides which based on the hash used in the value for the `Password` column. When there's no password set or when the 4.1 password hash is used, (which is 41 characters long), MariaDB uses the [mysql\_native\_password](https://mariadb.com/docs/server/reference/plugins/authentication-plugins/authentication-plugin-mysql_native_password) plugin. The [mysql\_old\_password](https://mariadb.com/docs/server/reference/plugins/authentication-plugins/authentication-plugin-mysql_old_password) plugin is used with pre-4.1 password hashes, (which are 16 characters long). MariaDB also supports the use of alternative [authentication plugins](https://mariadb.com/docs/server/reference/plugins/authentication-plugins). When the `plugin` column is not empty for the given account, MariaDB uses it to authenticate connection attempts. The specific plugin then uses the value of either the `Password` column or the `authentication_string` column to authenticate the user. A specific authentication plugin can be used for an account by providing the `IDENTIFIED VIA authentication_plugin` clause with the [CREATE USER](https://mariadb.com/docs/server/reference/sql-statements/account-management-sql-statements/create-user), [ALTER USER](https://mariadb.com/docs/server/reference/sql-statements/account-management-sql-statements/alter-user), or [GRANT](https://mariadb.com/docs/server/reference/sql-statements/account-management-sql-statements/grant) statements. For example, the following statement would create an account that authenticates with the [PAM authentication plugin](https://mariadb.com/docs/server/reference/plugins/authentication-plugins/authentication-with-pluggable-authentication-modules-pam/authentication-plugin-pam): ```sql CREATE USER foo2@test IDENTIFIED VIA pam; ``` If the specific authentication plugin uses the `authentication_string` column, then this value for the account can be specified after a `USING` or `AS` keyword. For example, the [PAM authentication plugin](https://mariadb.com/docs/server/reference/plugins/authentication-plugins/authentication-with-pluggable-authentication-modules-pam/authentication-plugin-pam) accepts a [service name](https://mariadb.com/docs/server/plugins/authentication-plugins/authentication-with-pluggable-authentication-modules-pam/authentication-plugin-pam#configuring-the-pam-service) that would go into the `authentication_string` column for the account: ```sql CREATE USER foo2@test IDENTIFIED VIA pam USING 'mariadb'; ``` *This page is licensed: CC BY-SA / Gnu FDL* {% @marketo/form formId="4316" %}