Account Locking -- grant to proxy account the -- PROXY privilege for proxied account GRANT PROXY ON ’proxied_user’@’localhost’ TO ’proxy_user’@’localhost’; To use the proxy account, connect to the server using its name and password: shell>  mysql -u proxy_user -p Enter password:  (enter proxy_user password here) Authentication succeeds, the server finds that  proxy_user  has the  PROXY  privilege for  proxied_user , and the session proceeds with  proxy_user  having the privileges of  proxied_user . Proxy user mapping performed by the server is subject to these restrictions: •The server does not proxy to or from an anonymous user, even if the associated  PROXY  privilege is granted. •When a single account has been granted proxy privileges for more than one proxied account, server proxy user mapping is nondeterministic. Therefore, granting to a single account proxy privileges for multiple proxied accounts is discouraged. Proxy User System Variables Two system variables help trace the proxy login process: • proxy_user : This value is  NULL  if proxying is not used. Otherwise, it indicates the proxy user account. For example, if a client authenticates through the  ’’@’’  proxy account, this variable is set as follows: • external_user : Sometimes the authentication plugin may use an external user to authenticate to the MySQL server. For example, when using Windows native authentication, a plugin that authenticates using the windows API does not need the login ID passed to it. However, it still uses a Windows user ID to authenticate. The plugin may return this external user ID (or the first 512 UTF-8 bytes of it) to the server using the  external_user  read-only session variable. If the plugin does not set this variable, its value is  NULL . mysql>  SELECT @@proxy_user; +--------------+ | @@proxy_user | +--------------+ | ’’@’’ | +--------------+ 6.2.19 Account Locking MySQL supports locking and unlocking user accounts using the  ACCOUNT LOCK  and  ACCOUNT UNLOCK clauses for the  CREATE USER  and  ALTER USER  statements: If the  validate_password  component is enabled, creating an account without a password is not permitted, even if the account is locked. See Section 6.4.3, “The Password Validation Component” . •When used with  CREATE USER , these clauses specify the initial locking state for a new account. In the absence of either clause, the account is created in an unlocked state. •When used with  ALTER USER , these clauses specify the new locking state for an existing account. In the absence of either clause, the account locking state remains unchanged. 1271