Grant to each proxy account the  PROXY  privilege for the corresponding proxied account: Finally, grant appropriate privileges to the local and remote proxied users (not shown). Assume that the  some_plugin / ’ some_auth_string ’  combination causes  some_plugin  to map the client user name to  developer . Local connections match the  ’’@’localhost’  proxy user, which maps to the  ’developer’@’localhost’  proxied user. Remote connections match the  ’’@’%’  proxy user, which maps to the  ’developer’@’%’  proxied user. Some authentication plugins implement proxy user mapping for themselves (for example, the PAM and Windows authentication plugins). Other authentication plugins do not support proxy users by default. Of these, some can request that the MySQL server itself map proxy users according to granted proxy privileges:  mysql_native_password ,  sha256_password . If the  check_proxy_users  system variable is enabled, the server performs proxy user mapping for any authentication plugins that make such a request: For example, to enable all the preceding capabilities, start the server with these lines in the  my.cnf  file: Assuming that the relevant system variables have been enabled, create the proxy user as usual using CREATE USER , then grant it the  PROXY  privilege to a single other account to be treated as the proxied user. When the server receives a successful connection request for the proxy user, it finds that the user has the  PROXY  privilege and uses it to determine the proper proxied user. 1270 -- create proxy account CREATE USER ’proxy_user’@’localhost’ IDENTIFIED WITH mysql_native_password BY ’ password ’; -- create proxied account and grant its privileges; -- use mysql_no_login plugin to prevent direct login CREATE USER ’proxied_user’@’localhost’ IDENTIFIED WITH mysql_no_login; -- grant privileges to proxied account GRANT ... ON ... TO ’proxied_user’@’localhost’; [mysqld] check_proxy_users=ON mysql_native_password_proxy_users=ON sha256_password_proxy_users=ON GRANT PROXY ON ’developer’@’localhost’ TO ’’@’localhost’; GRANT PROXY ON ’developer’@’%’ TO ’’@’%’; Server Support for Proxy User Mapping •By default,  check_proxy_users  is disabled, so the server performs no proxy user mapping even for authentication plugins that request server support for proxy users. •If  check_proxy_users  is enabled, it may also be necessary to enable a plugin-specific system variable to take advantage of server proxy user mapping support: •For the  mysql_native_password  plugin, enable  mysql_native_password_proxy_users . •For the  sha256_password  plugin, enable  sha256_password_proxy_users . Proxy Users