13.7.1.1 CREATE USER Syntax

13.7.1.1 CREATE USER Syntax
Previous	13.7.1 Account Management Statements	Next

CREATE USER
    user [auth_option] [, user [auth_option]] ...

user:
    (see Section 6.2.3, “Specifying Account Names”)

auth_option: {
    IDENTIFIED BY 'auth_string'
  | IDENTIFIED BY PASSWORD 'hash_string'
  | IDENTIFIED WITH auth_plugin
  | IDENTIFIED WITH auth_plugin AS 'hash_string'
}

The CREATE USER statement creates new MySQL accounts. An error occurs if you try to create an account that already exists.

An account when first created has no privileges.

To use CREATE USER, you must have the global CREATE USER privilege, or the INSERT privilege for the mysql database. When the read_only system variable is enabled, CREATE USER additionally requires the SUPER privilege.

For each account, CREATE USER creates a new row in the mysql.user table with no privileges and (as of MySQL 5.5.7) assigns the account an authentication plugin. Depending on the syntax used, CREATE USER may also assign the account a password.

Each user value naming an account may be followed by an optional auth_option value that specifies how authentication occurs for clients that use the account. This part of CREATE USER syntax is shared with GRANT, so the description here applies to GRANT as well.

Each account name uses the format described in Section 6.2.3, “Specifying Account Names”. For example:

CREATE USER 'jeffrey'@'localhost' IDENTIFIED BY 'mypass';

The host name part of the account name, if omitted, defaults to '%'.

The server assigns an authentication plugin and password to each account as follows, depending on whether the user specification clause includes IDENTIFIED WITH to specify a plugin or IDENTIFIED BY to specify a password:

Note

IDENTIFIED WITH is available as of MySQL 5.5.7. Before 5.5.7, authentication plugins are not used, so only the remarks about IDENTIFIED BY apply.

With IDENTIFIED WITH, the server assigns the specified plugin and the account has no password. If the optional AS 'hash_string' clause is also given, the string is stored as is in the authentication_string column (it is assumed to be already hashed in the format required by the plugin).
With IDENTIFIED BY, the server assigns no plugin and assigns the specified password.
With neither IDENTIFIED WITH nor IDENTIFIED BY, the server assigns no plugin and the account has no password.

If the account has no password, the Password column in the account's mysql.user table row remains empty, which is insecure. To set the password, use SET PASSWORD. See Section 13.7.1.6, “SET PASSWORD Syntax”.

If the server assigns no plugin to the account, the plugin column in the account's mysql.user table row remains empty.

For client connections that use a given account, the server invokes the authentication plugin assigned to the account and the client must provide credentials as required by the authentication method that the plugin implements. If the server cannot find the plugin, either at account-creation time or connect time, an error occurs.

If an account's mysql.user table row has a nonempty plugin column:

The server authenticates client connection attempts using the named plugin.
Changes to the account password using SET PASSWORD with PASSWORD() must be made with the old_passwords system variable set to the value required by the authentication plugin, so that PASSWORD() uses the appropriate password hashing method. If the plugin is mysql_old_password, the password can also be changed using SET PASSWORD with OLD_PASSWORD(), which uses pre-4.1 password hashing regardless of the value of old_passwords.

If an account's mysql.user table row has an empty plugin column:

The server authenticates client connection attempts using the mysql_native_password or mysql_old_password authentication plugin, depending on the hash format of the password stored in the Password column.
Changes to the account password using SET PASSWORD can be made with PASSWORD(), with old_passwords set to 0 or 1 for 4.1 or pre-4.1 password hashing, respectively, or with OLD_PASSWORD(), which uses pre-4.1 password hashing regardless of the value of old_passwords.

CREATE USER examples:

To specify an authentication plugin for an account, use IDENTIFIED WITH auth_plugin. The plugin name can be a quoted string literal or an unquoted name. 'auth_string' is an optional quoted string literal to pass to the plugin. The plugin interprets the meaning of the string, so its format is plugin specific and it is stored in the authentication_string column as given. (This value is meaningful only for plugins that use that column.) Consult the documentation for a given plugin for information about the authentication string values it accepts, if any.
```
CREATE USER 'jeffrey'@'localhost' IDENTIFIED WITH mysql_native_password;
```
The server assigns the given authentication plugin to the account but no password. Clients must provide no password when they connect. However, an account with no password is insecure. To ensure that an account uses a specific authentication plugin and has a password with the corresponding hash format, specify the plugin explicitly with IDENTIFIED WITH, then use SET PASSWORD to set the password:
```
CREATE USER 'jeffrey'@'localhost' IDENTIFIED WITH mysql_native_password;
SET old_passwords = 0;
SET PASSWORD FOR 'jeffrey'@'localhost' = PASSWORD('mypass');
```
Changes to the account password using SET PASSWORD with PASSWORD() must be made with the old_passwords system variable set to the value required by the account's authentication plugin, so that PASSWORD() uses the appropriate password hashing method. Therefore, to use the mysql_old_password plugin instead, name that plugin in the CREATE USER statement and set old_passwords to 1 before using SET PASSWORD.
To specify a password for an account at account-creation time, use IDENTIFIED BY with the literal cleartext password value:
```
CREATE USER 'jeffrey'@'localhost' IDENTIFIED BY 'mypass';
```
The server assigns the given password to the account but no authentication plugin. Clients must provide the password when they connect.
To avoid specifying the cleartext password if you know its hash value (the value that PASSWORD() would return for the password), specify the hash value preceded by the keyword PASSWORD:
```
CREATE USER 'jeffrey'@'localhost'
IDENTIFIED BY PASSWORD '*90E462C37378CED12064BB3388827D2BA3A9B689';
```
The server assigns the given password to the account but no authentication plugin. Clients must provide the password when they connect.
To enable the user to connect with no password, include no IDENTIFIED BY clause:
```
CREATE USER 'jeffrey'@'localhost';
```
The server assigns no authentication plugin or password to the account. Clients must provide no password when they connect. However, an account with no password is insecure. To avoid this, use SET PASSWORD to set the account password.

For additional information about setting passwords and authentication plugins, see Section 6.3.5, “Assigning Account Passwords”, and Section 6.3.6, “Pluggable Authentication”.

Important

CREATE USER may be recorded in server logs or on the client side in a history file such as ~/.mysql_history, which means that cleartext passwords may be read by anyone having read access to that information. For information about password logging in the server logs, see Section 6.1.2.3, “Passwords and Logging”. For similar information about client-side logging, see Section 4.5.1.3, “mysql Logging”.