Authentication Plugins Using No-Login Pluggable Authentication Note This section describes how to use the no-login authentication plugin to prevent accounts from being used for connecting from MySQL client programs to the server. It is assumed that the server is running with the no-login plugin enabled, as described in Installing No-Login Pluggable Authentication. To refer to the no-login authentication plugin in the  IDENTIFIED WITH  clause of a  CREATE USER statement, use the name  mysql_no_login . An account that authenticates using  mysql_no_login  may be used as the  DEFINER  for stored program and view objects. If such an object definition also includes  SQL SECURITY DEFINER , it executes with that account’s privileges. DBAs can use this behavior to provide access to confidential or sensitive data that is exposed only through well-controlled interfaces. The following example illustrates these principles. It defines an account that does not permit client connections, and associates with it a view that exposes only certain columns of the  mysql.user  system table: To provide protected access to the view to an ordinary user, do this: Now the ordinary user can use the view to access the limited information it presents: GRANT SELECT ON nologindb.myview TO ’ordinaryuser’@’localhost’; SELECT * FROM nologindb.myview; Attempts by the user to access columns other than those exposed by the view result in an error, as do attempts to select from the view by users not granted access to it. Because the  nologin  account cannot be used directly, the operations required to set up objects that it uses must be performed by  root  or similar account that has the privileges required to create the objects and set  DEFINER  values. The  mysql_no_login  plugin is also useful in proxying scenarios. (For a discussion of concepts involved in proxying, see Section 6.2.18, “Proxy Users” .) An account that authenticates using  mysql_no_login may be used as a proxied user for proxy accounts: -- create proxied account CREATE USER ’proxied_user’@’localhost’ IDENTIFIED WITH mysql_no_login; -- grant privileges to proxied account GRANT ... ON ... TO ’proxied_user’@’localhost’; -- permit proxy_user to be a proxy account for proxied account GRANT PROXY CREATE DATABASE nologindb; CREATE USER ’nologin’@’localhost’ IDENTIFIED WITH mysql_no_login; GRANT ALL ON nologindb.* TO ’nologin’@’localhost’; GRANT SELECT ON mysql.user TO ’nologin’@’localhost’; CREATE DEFINER = ’nologin’@’localhost’ SQL SECURITY DEFINER VIEW nologindb.myview AS SELECT User, Host FROM mysql.user; 1355