Proxy Users -- revoke PROXY from multiple accounts REVOKE PROXY ON ’a’ FROM ’b’, ’c’, ’d’; -- grant PROXY to an account and enable the account to grant -- PROXY to the proxied account GRANT PROXY ON ’a’ TO ’d’ WITH GRANT OPTION; -- grant PROXY to default proxy account GRANT PROXY ON ’a’ TO ’’@’’; CREATE USER ’admin’@’localhost’ IDENTIFIED BY ’ admin_password ’; GRANT PROXY ON ’’@’’ TO ’admin’@’localhost’ WITH GRANT OPTION; GRANT PROXY ON sally TO joe; -- create default proxy account CREATE USER ’’@’’ IDENTIFIED WITH ldap_auth AS ’O=Oracle, OU=MySQL’; -- create proxied accounts; use -- mysql_no_login plugin to prevent direct login CREATE USER ’developer’@’localhost’ IDENTIFIED WITH mysql_no_login; CREATE USER ’manager’@’localhost’ IDENTIFIED WITH mysql_no_login; -- grant to default proxy account the -- PROXY privilege for proxied accounts GRANT PROXY ON ’manager’@’localhost’ TO ’’@’’; GRANT PROXY ON ’developer’@’localhost’ TO ’’@’’; 1267 To specify that some or all users should connect using a given authentication plugin, create a “blank” MySQL account with an empty user name and host name ( ’’@’’ ), associate it with that plugin, and let the plugin return the real authenticated user name (if different from the blank user). Suppose that there exists a plugin named  ldap_auth  that implements LDAP authentication and maps connecting users onto either a developer or manager account. To set up proxying of users onto these accounts, use the following statements: Those statements create an  admin  user that can manage all  GRANT PROXY  mappings. For example, admin  can do this: The initial  root  account created during MySQL installation has the  PROXY ... WITH GRANT OPTION privilege for  ’’@’’ , that is, for all users and all hosts. This enables  root  to set up proxy users, as well as to delegate to other accounts the authority to set up proxy users. For example,  root  can do this: The  PROXY  privilege can be granted in these cases: •By a user that has  GRANT PROXY ... WITH GRANT OPTION  for  proxied_user . •By  proxied_user  for itself: The value of  USER()  must exactly match  CURRENT_USER()  and proxied_user , for both the user name and host name parts of the account name. Default Proxy Users