ALTER USER ’jeffrey’@’localhost’ IDENTIFIED WITH mysql_native_password BY ’ password ’ REPLACE ’ current_password ’; 

The preceding statement fails unless the current user is jeffrey  because REPLACE  is permitted only for changes to the current user’s password. 

Example: Establish a new primary password and retain the existing password as the secondary password: 

ALTER USER ’jeffrey’@’localhost’ IDENTIFIED BY ’ new_password ’ RETAIN CURRENT PASSWORD; 

Example: Discard the secondary password, leaving the account with only its primary password: 

ALTER USER ’jeffery’@’localhost’ DISCARD OLD PASSWORD; 

Example: Specify the authentication plugin, along with a hashed password value: 

ALTER USER ’jeffrey’@’localhost’ IDENTIFIED WITH mysql_native_password AS ’*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4’; 

For additional information about setting passwords and authentication plugins, see Section 6.2.14, “Assigning Account Passwords” , and Section 6.2.17, “Pluggable Authentication” . 

## ALTER USER Role Options 

ALTER USER ... DEFAULT ROLE  defines which roles become active when the user connects to the server and authenticates, or when the user executes the SET ROLE DEFAULT  statement during a session. 

ALTER USER ... DEFAULT ROLE  is alternative syntax for SET DEFAULT ROLE  (see Section 13.7.1.9, “SET DEFAULT ROLE Statement” ). However, ALTER USER  can set the default for only a single user, whereas SET DEFAULT ROLE  can set the default for multiple users. On the other hand, you can specify CURRENT_USER  as the user name for the ALTER USER  statement, whereas you cannot for SET DEFAULT ROLE . 

Each user account name uses the format described previously. 

Each role name uses the format described in Section 6.2.5, “Specifying Role Names” . For example: 

ALTER USER ’joe’@’10.0.0.1’ DEFAULT ROLE administrator, developer; 

The host name part of the role name, if omitted, defaults to ’%’ . 

The clause following the DEFAULT ROLE  keywords permits these values: 

• NONE : Set the default to NONE  (no roles). 

• ALL : Set the default to all roles granted to the account. 

• role  [, role  ] ... : Set the default to the named roles, which must exist and be granted to the account at the time ALTER USER ... DEFAULT ROLE  is executed. 

## ALTER USER SSL/TLS Options 

MySQL can check X.509 certificate attributes in addition to the usual authentication that is based on the user name and credentials. For background information on the use of SSL/TLS with MySQL, see Section 6.3, “Using Encrypted Connections” . 

