Account Management Statements As of MySQL 8.0.19,  CREATE USER  permits these  password_option  values for controlling failed-login tracking: • PASSWORD_LOCK_TIME { N  | UNBOUNDED} • FAILED_LOGIN_ATTEMPTS  N Whether to track account login attempts that specify an incorrect password.  N  must be a number from 0 to 32767. A value of 0 disables failed-login tracking. Values greater than 0 indicate how many consecutive password failures cause temporary account locking (if  PASSWORD_LOCK_TIME  is also nonzero). How long to lock the account after too many consecutive login attempts provide an incorrect password. N  must be a number from 0 to 32767, or  UNBOUNDED . A value of 0 disables temporary account locking. Values greater than 0 indicate how long to lock the account in days. A value of  UNBOUNDED  causes the account locking duration to be unbounded; once locked, the account remains in a locked state until unlocked. For information about the conditions under which unlocking occurs, see Failed-Login Tracking and Temporary Account Locking. For failed-login tracking and temporary locking to occur, an account’s  FAILED_LOGIN_ATTEMPTS  and PASSWORD_LOCK_TIME  options both must be nonzero. The following statement creates an account that remains locked for two days after four consecutive password failures: MySQL supports account locking and unlocking using the  ACCOUNT LOCK  and  ACCOUNT UNLOCK  options, which specify the locking state for an account. For additional discussion, see Section 6.2.19, “Account Locking” . CREATE USER ’jeffrey’@’localhost’ FAILED_LOGIN_ATTEMPTS 4 PASSWORD_LOCK_TIME 2; CREATE USER Account-Locking Options CREATE USER Binary Logging 13.7.1.4 DROP ROLE Statement DROP ROLE [IF EXISTS]  role  [,  role  ] ... If the original statement specifies the  FAILED_LOGIN_ATTEMPTS  or  PASSWORD_LOCK_TIME  option, the statement written to the binary log includes the option. If the server adds the default authentication plugin for any nonexisting users in the statement written to the binary log, it writes a warning to the error log naming those users. The statement written to the binary log specifies an authentication plugin for each user, determined as follows: •The plugin named in the original statement, if one was specified. •Otherwise, the default authentication plugin. In particular, if a user  u1  already exists and uses a nondefault authentication plugin, the statement written to the binary log for  CREATE USER IF NOT EXISTS u1  names the default authentication plugin. (If the statement written to the binary log must specify a nondefault authentication plugin for a user, include it in the original statement.) CREATE USER  is written to the binary log if it succeeds, but not if it fails; in that case, rollback occurs and no changes are made. A statement written to the binary log includes all named users. If the  IF NOT EXISTS  clause is given, this includes even users that already exist and were not created. If multiple account-locking options are specified, the last one takes precedence. 2861