Account Management Statements ALTER USER ’jeffrey’@’localhost’ IDENTIFIED WITH mysql_native_password BY ’ password ’ REPLACE ’ current_password ’; ALTER USER ’jeffrey’@’localhost’ IDENTIFIED BY ’ new_password ’ RETAIN CURRENT PASSWORD; ALTER USER ’jeffrey’@’localhost’ IDENTIFIED WITH mysql_native_password AS ’*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4’; The preceding statement fails unless the current user is  jeffrey  because  REPLACE  is permitted only for changes to the current user’s password. Example: Establish a new primary password and retain the existing password as the secondary password: Example: Discard the secondary password, leaving the account with only its primary password: Example: Specify the authentication plugin, along with a hashed password value: For additional information about setting passwords and authentication plugins, see Section 6.2.14, “Assigning Account Passwords” , and Section 6.2.17, “Pluggable Authentication” . ALTER USER ’jeffery’@’localhost’ DISCARD OLD PASSWORD; ALTER USER Role Options ALTER USER ... DEFAULT ROLE  defines which roles become active when the user connects to the server and authenticates, or when the user executes the  SET ROLE DEFAULT  statement during a session. ALTER USER ... DEFAULT ROLE  is alternative syntax for  SET DEFAULT ROLE  (see Section 13.7.1.9, “SET DEFAULT ROLE Statement” ). However,  ALTER USER  can set the default for only a single user, whereas  SET DEFAULT ROLE  can set the default for multiple users. On the other hand, you can specify CURRENT_USER  as the user name for the  ALTER USER  statement, whereas you cannot for  SET DEFAULT ROLE . Each user account name uses the format described previously. Each role name uses the format described in Section 6.2.5, “Specifying Role Names” . For example: The host name part of the role name, if omitted, defaults to  ’%’ . The clause following the  DEFAULT ROLE  keywords permits these values: MySQL can check X.509 certificate attributes in addition to the usual authentication that is based on the user name and credentials. For background information on the use of SSL/TLS with MySQL, see Section 6.3, “Using Encrypted Connections” . ALTER USER ’joe’@’10.0.0.1’ DEFAULT ROLE administrator, developer; • NONE : Set the default to  NONE  (no roles). • ALL : Set the default to all roles granted to the account. • role  [,  role  ] ... : Set the default to the named roles, which must exist and be granted to the account at the time  ALTER USER ... DEFAULT ROLE  is executed. ALTER USER SSL/TLS Options 2843