Proxy Users This section describes how the proxy user capability works. For general information about authentication plugins, see Section 6.2.17, “Pluggable Authentication” . For information about specific plugins, see Section 6.4.1, “Authentication Plugins” . For information about writing authentication plugins that support proxy users, see Implementing Proxy User Support in Authentication Plugins. Note One administrative benefit to be gained by proxying is that the DBA can set up a single account with a set of privileges and then enable multiple proxy users to have those privileges without having to assign the privileges individually to each of those users. As an alternative to proxy users, DBAs may find that roles provide a suitable way to map users onto specific sets of named privileges. Each user can be granted a given single role to, in effect, be granted the appropriate set of privileges. See Section 6.2.10, “Using Roles” . For proxying to occur for a given authentication plugin, these conditions must be satisfied: Alternatively, for plugins that are provided proxy mapping by the server, the proxied user is determined from the  PROXY  privilege held by the proxy user. 1264 •For a client connecting to the proxy account to be treated as a proxy user, the authentication plugin must return a user name different from the client user name, to indicate the user name of the proxied account that defines the privileges to be assumed by the proxy user. •The proxy user account must have the  PROXY  privilege for the proxied account. Use the  GRANT statement for this. •Normally, the proxied user is configured so that it can be used only in proxying scenaries and not for direct logins. •The account for the proxied user must exist and be granted the privileges to be assumed by the proxy user. Use the  CREATE USER  and  GRANT  statements for this. •The account for the external proxy user must be set up to be authenticated by the plugin. Use the CREATE USER  statement to associate an account with an authentication plugin, or  ALTER USER  to change its plugin. •Proxying must be supported, either by the plugin itself, or by the MySQL server on behalf of the plugin. In the latter case, server support may need to be enabled explicitly; see Server Support for Proxy User Mapping. Requirements for Proxy User Support •Proxy User System Variables •Server Support for Proxy User Mapping •Default Proxy User and Anonymous User Conflicts •Default Proxy Users •Granting and Revoking the PROXY Privilege •Preventing Direct Login to Proxied Accounts •Simple Proxy User Example •Requirements for Proxy User Support