Proxy Users The proxy mechanism permits mapping only the external client user name to the proxied user name. There is no provision for mapping host names: Consider the following account definitions: In this case,  employee_ext  is the proxy user and  employee  is the proxied user. The server verifies that proxy authentication for  employee  is possible for the  employee_ext  user by checking whether  employee_ext  (the proxy user) has the  PROXY  privilege for  employee  (the proxied user). If this privilege has not been granted, an error occurs. Otherwise,  employee_ext  assumes the privileges of  employee . The server checks statements executed during the client session by employee_ext  against the privileges granted to  employee . In this case,  employee_ext  can access tables in the  employees  database. The proxied account,  employee , uses the  mysql_no_login  authentication plugin to prevent clients from using the account to log in directly. (This assumes that the plugin is installed. For instructions, see Section 6.4.1.8, “No-Login Pluggable Authentication” .) For alternative methods of protecting proxied accounts against direct use, see Preventing Direct Login to Proxied Accounts. When proxying occurs, the  USER()  and  CURRENT_USER()  functions can be used to see the difference between the connecting user (the proxy user) and the account whose privileges apply during the current session (the proxied user). For the example just described, those functions return these values: mysql>  SELECT USER(), CURRENT_USER(); -- create proxy account CREATE USER ’employee_ext’@’localhost’ IDENTIFIED WITH my_auth_plugin AS ’ my_auth_string ’; -- create proxied account and grant its privileges; -- use mysql_no_login plugin to prevent direct login CREATE USER ’employee’@’localhost’ IDENTIFIED WITH mysql_no_login; GRANT ALL ON employees.* TO ’employee’@’localhost’; -- grant to proxy account the -- PROXY privilege for proxied account GRANT PROXY ON ’employee’@’localhost’ TO ’employee_ext’@’localhost’; Simple Proxy User Example •When a client connects to the server, the server determines the proper account based on the user name passed by the client program and the host from which the client connects. •If that account is a proxy account, the server attempts to determine the appropriate proxied account by finding a match for a proxied account using the user name returned by the authentication plugin and the host name of the proxy account. The host name in the proxied account is ignored. 1265 When a client connects as  employee_ext  from the local host, MySQL uses the plugin named my_auth_plugin  to perform authentication. Suppose that  my_auth_plugin  returns a user name of employee  to the server, based on the content of  ’ my_auth_string ’  and perhaps by consulting some external authentication system. The name  employee  differs from  employee_ext , so returning  employee serves as a request to the server to treat the  employee_ext  external user, for purposes of privilege checking, as the  employee  local user.