Specifying Role Names account host value is specified using netmask notation, the server performs this comparison as a string match, even for an account host value given as an IP address. This means that you should specify account host values in the same format used by DNS. Here are examples of problems to watch out for: To avoid problems like these, it is advisable to check the format in which your DNS returns host names and addresses. Use values in the same format in MySQL account names. MySQL role names refer to roles, which are named collections of privileges. For role usage examples, see Section 6.2.10, “Using Roles” . Role names have syntax and semantics similar to account names; see Section 6.2.4, “Specifying Account Names” . As stored in the grant tables, they have the same properties as account names, which are described in Grant Table Scope Column Properties. Role names differ from account names in these respects: It is possible for a row in the  mysql.user  system table to serve as both an account and a role. In this case, any special user or host name matching properties do not apply in contexts for which the name is used as a role name. For example, you cannot execute the following statement with the expectation that it sets the current session roles using all roles that have a user part of  myrole  and any host name: SET ROLE ’myrole’@’%’; Instead, the statement sets the active role for the session to the role with exactly the name ’myrole’@’%’ . For this reason, role names are often specified using only the user name part and letting the host name part implicitly be  ’%’ . Specifying a role with a non- ’%’  host part can be useful if you intend to create a name that works both as a role an as a user account that is permitted to connect from the given host. When you attempt to connect to a MySQL server, the server accepts or rejects the connection based on these conditions: •Your identity and whether you can verify it by supplying the proper credentials. 1216 6.2.6 Access Control, Stage 1: Connection Verification 6.2.5 Specifying Role Names •Suppose that a host on the local network has a fully qualified name of  host1.example.com . If DNS returns name lookups for this host as  host1.example.com , use that name in account host values. If DNS returns just  host1 , use  host1  instead. •If DNS returns the IP address for a given host as  198.51.100.2 , that matches an account host value of  198.51.100.2  but not  198.051.100.2 . Similarly, it matches an account host pattern like 198.51.100.%  but not  198.051.100.% . •The user part of role names cannot be blank. Thus, there is no “anonymous role”  analogous to the concept of “anonymous user.” •As for an account name, omitting the host part of a role name results in a host part of  ’%’ . But unlike ’%’  in an account name, a host part of  ’%’  in a role name has no wildcard properties. For example, for a name  ’me’@’%’  used as a role name, the host part ( ’%’ ) is just a literal value; it has no “any host” matching property. •Netmask notation in the host part of a role name has no significance. •An account name is permitted to be  CURRENT_USER()  in several contexts. A role name is not.