Account Management Statements CREATE USER ’jeffrey’@’localhost’ IDENTIFIED WITH mysql_native_password BY ’ password ’; IDENTIFIED BY ’ password ’; CREATE USER ’joe’@’10.0.0.1’ DEFAULT ROLE administrator, developer; CREATE USER ’jeffrey’@’localhost’ REQUIRE NONE; Example: Specify the authentication plugin, along with a cleartext password value: In each case, the password value stored in the account row is the cleartext value  ’ password ’  after it has been hashed by the authentication plugin associated with the account. For additional information about setting passwords and authentication plugins, see Section 6.2.14, “Assigning Account Passwords” , and Section 6.2.17, “Pluggable Authentication” . The  DEFAULT ROLE  clause defines which roles become active when the user connects to the server and authenticates, or when the user executes the  SET ROLE DEFAULT  statement during a session. Each role name uses the format described in Section 6.2.5, “Specifying Role Names” . For example: The host name part of the role name, if omitted, defaults to  ’%’ . The  DEFAULT ROLE  clause permits a list of one or more comma-separated role names. These roles need not exist at the time  CREATE USER  is executed. MySQL can check X.509 certificate attributes in addition to the usual authentication that is based on the user name and credentials. For background information on the use of SSL/TLS with MySQL, see Section 6.3, “Using Encrypted Connections” . To specify SSL/TLS-related options for a MySQL account, use a  REQUIRE  clause that specifies one or more  tls_option  values. Order of  REQUIRE  options does not matter, but no option can be specified twice. The  AND  keyword is optional between  REQUIRE  options. Indicates that all accounts named by the statement have no SSL or X.509 requirements. Unencrypted connections are permitted if the user name and password are valid. Encrypted connections can be used, at the client’s option, if the client has the proper certificate and key files. Clients attempt to establish a secure connection by default. For clients that have  REQUIRE NONE , the connection attempt falls back to an unencrypted connection if a secure connection cannot be established. To require an encrypted connection, a client need specify only the  --ssl- mode=REQUIRED  option; the connection attempt fails if a secure connection cannot be established. NONE  is the default if no SSL-related  REQUIRE  options are specified. CREATE USER  permits these  tls_option  values: Tells the server to permit only encrypted connections for all accounts named by the statement. 2856 • NONE • SSL CREATE USER Role Options CREATE USER SSL/TLS Options