content_image/831103.jpg
This section describes how the proxy user capability works. For general information about authentication plugins, see Section 6.2.17, “Pluggable Authentication” . For information about specific plugins, see Section 6.4.1, “Authentication Plugins” . For information about writing authentication plugins that support proxy users, see Implementing Proxy User Support in Authentication Plugins. 

## Requirements for Proxy User Support 

•Requirements for Proxy User Support 

•Simple Proxy User Example 

•Preventing Direct Login to Proxied Accounts 

•Granting and Revoking the PROXY Privilege 

•Default Proxy Users 

•Default Proxy User and Anonymous User Conflicts 

•Server Support for Proxy User Mapping 

•Proxy User System Variables 

<img src='content_image/831103.jpg'>

Note 

One administrative benefit to be gained by proxying is that the DBA can set up a single account with a set of privileges and then enable multiple proxy users to have those privileges without having to assign the privileges individually to each of those users. As an alternative to proxy users, DBAs may find that roles provide a suitable way to map users onto specific sets of named privileges. Each user can be granted a given single role to, in effect, be granted the appropriate set of privileges. See Section 6.2.10, “Using Roles” . 

For proxying to occur for a given authentication plugin, these conditions must be satisfied: 

•Proxying must be supported, either by the plugin itself, or by the MySQL server on behalf of the plugin. In the latter case, server support may need to be enabled explicitly; see Server Support for Proxy User Mapping. 

•The account for the external proxy user must be set up to be authenticated by the plugin. Use the CREATE USER  statement to associate an account with an authentication plugin, or ALTER USER  to change its plugin. 

•The account for the proxied user must exist and be granted the privileges to be assumed by the proxy user. Use the CREATE USER  and GRANT  statements for this. 

•Normally, the proxied user is configured so that it can be used only in proxying scenaries and not for direct logins. 

•The proxy user account must have the PROXY  privilege for the proxied account. Use the GRANT statement for this. 

•For a client connecting to the proxy account to be treated as a proxy user, the authentication plugin must return a user name different from the client user name, to indicate the user name of the proxied account that defines the privileges to be assumed by the proxy user. 

Alternatively, for plugins that are provided proxy mapping by the server, the proxied user is determined from the PROXY  privilege held by the proxy user. 

