Prior to MySQL 5.7, the CREATE USER
command had a
number of limitations:
- No way to set both authentication plugin and password
- No way to disable a user
- No way to define user resource limitations
- No way to set a non-default password expiration policy
- No way to require SSL/x509
All of these things could be done through other means, but
typically involved other statements, such as GRANT
commands. Starting with MySQL 5.7.6, these can all be done
through a new and improved CREATE USER
syntax:
Passwords and authentication plugin
The most important aspect to me, from a security perspective, is the ability to now create user accounts with non-default authentication plugins (like sha256_password) and a non-blank password:
mysql> CREATE USER new@localhost
-> IDENTIFIED WITH sha256_password …