Description\n-----------\n\nThe CREATE USER statement creates new MariaDB accounts. To use it, you must have the global CREATE USER privilege or the INSERT privilege for the mysql database.\n\nFor each account, CREATE USER creates a new row in the mysql.user view (and the underlying mysql.global_priv table) that has no privileges.\n\nFor each account, CREATE USER creates a new row in mysql.user table that has no privileges.\n\nIf any of the specified accounts, or any permissions for the specified accounts, already exist, then the server returns ERROR 1396 (HY000). If an error occurs, CREATE USER will still create the accounts that do not result in an error. Only one error is produced for all users which have not been created:\n\n``\nERROR 1396 (HY000): \n  Operation CREATE USER failed for 'u1'@'%','u2'@'%'\n`\n\nCREATE USER, DROP USER, CREATE ROLE, and DROP ROLE all produce the same error code when they fail.\n\nSee Account Names below for details on how account names are specified.\n\nOne can also create users with GRANT if SQL_MODE does not have NO_AUTO_CREATE_USER set. NO_AUTO_CREATE_USER is set by default.\n\nOR REPLACE\n\nIf the optional OR REPLACE clause is used, it is basically a shortcut for:\n\n`sql\nDROP USER IF EXISTS name;\nCREATE USER name ...;\n`\n\nFor example:\n\n`sql\nCREATE USER foo2@test IDENTIFIED BY 'password';\nERROR 1396 (HY000): Operation CREATE USER failed for 'foo2'@'test'\n\nCREATE OR REPLACE USER foo2@test IDENTIFIED BY 'password';\nQuery OK, 0 rows affected (0.00 sec)\n`\n\nIF NOT EXISTS\n\nWhen the IF NOT EXISTS clause is used, MariaDB will return a warning instead of an error if the specified user already exists.\n\nFor example:\n\n`sql\nCREATE USER foo2@test IDENTIFIED BY 'password';\nERROR 1396 (HY000): Operation CREATE USER failed for 'foo2'@'test'\n\nCREATE USER IF NOT EXISTS foo2@test IDENTIFIED BY 'password';\nQuery OK, 0 rows affected, 1 warning (0.00 sec)\n\nSHOW WARNINGS;\n+-------+------+----------------------------------------------------+\n| Level | Code | Message                                            |\n+-------+------+----------------------------------------------------+\n| Note  | 1973 | Can't create user 'foo2'@'test'; it already exists |\n+-------+------+----------------------------------------------------+\n`\n\nAuthentication Options\n\nIf more than one authentication mechanism is declared using the OR keyword, the mechanisms are attempted in the order they are declared in the CREATE USER statement. As soon as one of the authentication mechanisms is successful, authentication is complete. If none of them is successful, the authentication has failed.\n\nIDENTIFIED BY 'password'\n\nThe optional IDENTIFIED BY clause can be used to provide an account with a password. The password should be specified in plain text. It will be hashed by the PASSWORD function prior to being stored in the mysql.user/mysql.global_priv_table table.\n\nFor example, if our password is mariadb, then we can create the user with:\n\n`sql\nCREATE USER foo2@test IDENTIFIED BY 'mariadb';\n`\n\nIf you do not specify a password with the IDENTIFIED BY clause, the user\\\nwill be able to connect without a password. A blank password is not a wildcard\\\nto match any password. The user must connect without providing a password if no\\\npassword is set.\n\nThe only authentication plugins that this clause supports are mysql_native_password and mysql_old_password.\n\nIDENTIFIED BY PASSWORD 'password_hash'\n\nThe optional IDENTIFIED BY PASSWORD clause can be used to provide an account with a password that has already been hashed. The password should be specified as a hash that was provided by the PASSWORD function. It will be stored in the mysql.user/mysql.global_priv_table table as-is.\n\nFor example, if our password is mariadb, then we can find the hash with:\n\n`sql\nSELECT PASSWORD('mariadb');\n+-------------------------------------------+\n| PASSWORD('mariadb')                       |\n+-------------------------------------------+\n| 54958E764CE10E50764C2EECBB71D01F08549980 |\n+-------------------------------------------+\n1 row in set (0.00 sec)\n`\n\nAnd then we can create a user with the hash:\n\n`sql\nCREATE USER foo2@test IDENTIFIED BY PASSWORD '54958E764CE10E50764C2EECBB71D01F08549980';\n`\n\nIf you do not specify a password with the IDENTIFIED BY clause, the user will be able to connect without a password. A blank password is not a wildcard to match any password. The user must connect without providing a password if no password is set.\n\nThe only authentication plugins that this clause supports are mysql_native_password and mysql_old_password.\n\nIDENTIFIED {VIA|WITH} authentication_plugin\n\nThe optional IDENTIFIED VIA authentication_plugin allows you to specify that the account should be authenticated by a specific authentication plugin. The plugin name must be an active authentication plugin as per SHOW PLUGINS. If it doesn't show up in that output, then you will need to install it with INSTALL PLUGIN or INSTALL SONAME.\n\nVIA and WITH are synonyms.\n\nFor example, this could be used with the PAM authentication plugin:\n\n`sql\nCREATE USER foo2@test IDENTIFIED VIA pam;\n`\n\nSome authentication plugins allow additional arguments to be specified after a USING or AS keyword. For example, the PAM authentication plugin accepts a service name:\n\n`sql\nCREATE USER foo2@test IDENTIFIED VIA pam USING 'mariadb';\n`\n\nThe exact meaning of the additional argument would depend on the specific authentication plugin.\n\nThe USING or AS keyword can also be used to provide a plain-text password to a plugin if it's provided as an argument to the PASSWORD() function. This is only valid for authentication plugins that have implemented a hook for the PASSWORD() function. For example, the ed25519 authentication plugin supports this:\n\n`sql\nCREATE USER safe@'%' IDENTIFIED VIA ed25519 USING PASSWORD('secret');\n`\n\nOne can specify many authentication plugins, they all work as alternatives ways of authenticating a user:\n\n`sql\nCREATE USER safe@'%' IDENTIFIED VIA ed25519 USING PASSWORD('secret') OR unix_socket;\n`\n\nBy default, when you create a user without specifying an authentication plugin, MariaDB uses the mysql_native_password plugin.\n\nTLS Options\n\nMariaDB allows you to encrypt data in transit between the server and clients using the Transport Layer Security (TLS) protocol. TLS was formerly known as Secure Socket Layer (SSL), but strictly speaking the SSL protocol is a predecessor to TLS and, that version of the protocol is now considered insecure. The documentation still uses the term SSL often and for compatibility reasons TLS-related server system and status variables still use the prefix ssl_, but internally, MariaDB only supports its secure successors.\n\nBy default, MariaDB transmits data between the server and clients without encrypting it. This is generally acceptable when the server and client run on the same host or in networks where security is guaranteed through other means. However, in cases where the server and client exist on separate networks or they are in a high-risk network, the lack of encryption does introduce security concerns as a malicious actor could potentially eavesdrop on the traffic as it is sent over the network between them.\n\nTo mitigate this concern, MariaDB allows you to encrypt data in transit between the server and clients using the Transport Layer Security (TLS) protocol. TLS was formerly known as Secure Socket Layer (SSL), but strictly speaking the SSL protocol is a predecessor to TLS and, that version of the protocol is now considered insecure. The documentation still uses the term SSL often and for compatibility reasons TLS-related server system and status variables still use the prefix ssl_, but internally, MariaDB only supports its secure successors.\n\nSee Secure Connections Overview for more information about how to determine whether your MariaDB server has TLS support.\n\nYou can set certain TLS-related restrictions for specific user accounts. For instance, you might use this with user accounts that require access to sensitive data while sending it across networks that you do not control. These restrictions can be enabled for a user account with the CREATE USER, ALTER USER, or GRANT statements. The following options are available:\n\n| Option                    | Description                                                                                                                                                                                                                                                                                         |\n| ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| REQUIRE NONE              | TLS is not required for this account, but can still be used.                                                                                                                                                                                                                                        |\n| REQUIRE SSL               | The account must use TLS, but no valid X509 certificate is required. This option cannot be combined with other TLS options.                                                                                                                                                                         |\n| REQUIRE X509              | The account must use TLS and must have a valid X509 certificate. This option implies REQUIRE SSL. This option cannot be combined with other TLS options.                                                                                                                                            |\n| REQUIRE ISSUER 'issuer'   | The account must use TLS and must have a valid X509 certificate. Also, the Certificate Authority must be the one specified via the string issuer. This option implies REQUIRE X509. This option can be combined with the SUBJECT, and CIPHER options in any order.                                  |\n| REQUIRE SUBJECT 'subject' | The account must use TLS and must have a valid X509 certificate. Also, the certificate's Subject must be the one specified via the string subject. This option implies REQUIRE X509. This option can be combined with the ISSUER, and CIPHER options in any order.                                  |\n| REQUIRE CIPHER 'cipher'   | The account must use TLS, but no valid X509 certificate is required. Also, the encryption used for the connection must use a specific cipher method specified in the string cipher. This option implies REQUIRE SSL. This option can be combined with the ISSUER, and SUBJECT options in any order. |\n\nThe REQUIRE keyword must be used only once for all specified options, and the AND keyword can be used to separate individual options, but it is not required.\n\nFor example, you can create a user account that requires these TLS options with the following:\n\n`sql\nCREATE USER 'alice'@'%'\n REQUIRE SUBJECT '/CN=alice/O=My Dom, Inc./C=US/ST=Oregon/L=Portland'\n AND ISSUER '/C=FI/ST=Somewhere/L=City/ O=Some Company/CN=Peter Parker/emailAddress=p.parker@marvel.com'\n AND CIPHER 'SHA-DES-CBC3-EDH-RSA';\n`\n\nIf any of these options are set for a specific user account, then any client who tries to connect with that user account will have to be configured to connect with TLS.\n\nSee Securing Connections for Client and Server for information on how to enable TLS on the client and server.\n\nResource Limit Options\n\nIt is possible to set per-account limits for certain server resources. The following table shows the values that can be set per account:\n\n| Limit Type                  | Decription                                                                                                                                                                                                                      |\n| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| MAX_QUERIES_PER_HOUR     | Number of statements that the account can issue per hour (including updates)                                                                                                                                                    |\n| MAX_UPDATES_PER_HOUR     | Number of updates (not queries) that the account can issue per hour                                                                                                                                                             |\n| MAX_CONNECTIONS_PER_HOUR | Number of connections that the account can start per hour                                                                                                                                                                       |\n| MAX_USER_CONNECTIONS      | Number of simultaneous connections that can be accepted from the same account; if it is 0, max_connections will be used instead; if max_connections is 0, there is no limit for this account's simultaneous connections.      |\n| MAX_STATEMENT_TIME        | Timeout, in seconds, for statements executed by the user. See also Aborting Statements that Exceed a Certain Time to Execute. |\n\nIf any of these limits are set to 0, then there is no limit for that resource for that user.\n\nHere is an example showing how to create a user with resource limits:\n\n`sql\nCREATE USER 'someone'@'localhost' WITH\n    MAX_USER_CONNECTIONS 10\n    MAX_QUERIES_PER_HOUR 200;\n`\n\nThe resources are tracked per account, which means 'user'@'server'; not per user name or per connection.\n\nThe count can be reset for all users using FLUSH USER_RESOURCES, FLUSH PRIVILEGES or mariadb-admin reload.\n\nPer account resource limits are stored in the user table, in the mysql database. Columns used for resources limits are named max_questions, max_updates, max_connections (for MAX_CONNECTIONS_PER_HOUR), and max_user_connections (for MAX_USER_CONNECTIONS).\n\nAccount Names\n\nAccount names have both a user name component and a host name component, and are specified as 'user_name'@'host_name'.\n\nThe user name and host name may be unquoted, quoted as strings using double quotes (") or\\\nsingle quotes ('), or quoted as identifiers using backticks (\\\\\\). You must use quotes\\\nwhen using special characters (such as a hyphen) or wildcard characters. If you quote, you\\\nmust quote the user name and host name separately (for example 'user_name'@'host_name').\n\nHost Name Component\n\nIf the host name is not provided, it is assumed to be '%'.\n\nHost names may contain the wildcard characters % and _. They are matched as if by\\\nthe LIKE clause. If you need to use a wildcard character literally (for example, to\\\nmatch a domain name with an underscore), prefix the character with a backslash. See LIKE\\\n\n[Truncated — full content at mariadb.com/docs]