MySQL 5.7和8.0用户管理操作说明

-- 切换到mysql数据库
USE mysql;

-- 查看用户信息（三个核心字段）
SELECT host, user, authentication_string FROM user;

CREATE USER '用户名'@'主机名' IDENTIFIED BY '密码';

-- 基本创建
CREATE USER '用户名'@'主机名' IDENTIFIED BY '密码';

-- 如果用户不存在则创建（避免重复创建报错）
CREATE USER IF NOT EXISTS '用户名'@'主机名' IDENTIFIED BY '密码';

-- 指定认证插件（解决客户端兼容性问题）
CREATE USER '用户名'@'主机名' 
IDENTIFIED WITH mysql_native_password BY '密码';

-- 随机生成密码（8.0新特性）
CREATE USER '用户名'@'主机名' IDENTIFIED BY RANDOM PASSWORD;

-- 账户锁定（创建后立即锁定，需手动解锁）
CREATE USER '用户名'@'主机名' IDENTIFIED BY '密码' ACCOUNT LOCK;

-- 创建一个只能从本机登录的用户（最安全）
CREATE USER 'zhangsan'@'localhost' IDENTIFIED BY 'MySecurePass123!';

-- 创建一个可以从192.168.1.x网段登录的用户
CREATE USER 'lisi'@'192.168.1.%' IDENTIFIED BY 'LiSiPass456!';

-- 创建一个可以从任意主机登录的用户（⚠️ 生产环境慎用）
CREATE USER 'wangwu'@'%' IDENTIFIED BY 'WangWuPass789!';

DROP USER '用户名'@'主机名';

-- 如果用户存在则删除（避免报错）
DROP USER IF EXISTS '用户名'@'主机名';

-- 正确写法：必须指定主机名
DROP USER 'zhangsan'@'localhost';

-- 错误写法：不指定主机名默认匹配'%'，会报错
DROP USER 'zhangsan';  -- ERROR 1396 (HY000)

-- 用户自己修改自己的密码
SET PASSWORD = PASSWORD('新密码');

-- root用户修改指定用户的密码
SET PASSWORD FOR '用户名'@'主机名' = PASSWORD('新密码');

-- 修改指定用户密码（8.0标准方式）
ALTER USER '用户名'@'主机名' IDENTIFIED BY '新密码';

-- 修改当前用户自己的密码
ALTER USER USER() IDENTIFIED BY '新密码';

-- 修改密码时验证旧密码（增强安全性）
ALTER USER '用户名'@'主机名' 
IDENTIFIED BY '新密码' REPLACE '旧密码';

-- 随机生成新密码
ALTER USER '用户名'@'主机名' IDENTIFIED BY RANDOM PASSWORD;

-- 账户解锁/锁定
ALTER USER '用户名'@'主机名' ACCOUNT UNLOCK;
ALTER USER '用户名'@'主机名' ACCOUNT LOCK;

SHOW VARIABLES LIKE 'validate_password.%';

-- 降低密码强度要求（仅当前会话生效）
SET GLOBAL validate_password.length = 6;
SET GLOBAL validate_password.policy = 'LOW';

-- 永久生效（写入配置文件）
SET PERSIST validate_password.length = 6;

-- 如果用户不存在则自动创建，并授予权限
GRANT 权限列表 ON 库名.对象名 TO '用户名'@'主机名' IDENTIFIED BY '密码';

-- 5.7：创建用户并授权一步完成
GRANT SELECT, INSERT, UPDATE ON mydb.* TO 'zhangsan'@'localhost' IDENTIFIED BY 'pass123';

-- ❌ 8.0中以下写法会报错
GRANT SELECT ON mydb.* TO 'zhangsan'@'localhost' IDENTIFIED BY 'pass123';
-- ERROR: You are not allowed to create a user with GRANT

-- ✅ 正确做法：分两步
-- 步骤1：创建用户
CREATE USER 'zhangsan'@'localhost' IDENTIFIED BY 'pass123';
-- 步骤2：授予权限
GRANT SELECT, INSERT, UPDATE ON mydb.* TO 'zhangsan'@'localhost';

-- 授予单张表的查询权限
GRANT SELECT ON mydb.users TO 'zhangsan'@'localhost';

-- 授予某个库的所有权限
GRANT ALL PRIVILEGES ON mydb.* TO 'zhangsan'@'localhost';

-- 授予所有库的所有权限（⚠️ 等同于root，极度危险）
GRANT ALL PRIVILEGES ON *.* TO 'zhangsan'@'localhost';

-- 授予多个权限
GRANT SELECT, INSERT, UPDATE, DELETE ON mydb.* TO 'zhangsan'@'localhost';

-- 授予权限并允许该用户将权限授予他人
GRANT SELECT ON mydb.* TO 'zhangsan'@'localhost' WITH GRANT OPTION;

-- 查看当前用户的权限
SHOW GRANTS;

-- 查看指定用户的权限
SHOW GRANTS FOR '用户名'@'主机名';

mysql> SHOW GRANTS FOR 'zhangsan'@'localhost';
+--------------------------------------------------+
| Grants for zhangsan@localhost                     |
+--------------------------------------------------+
| GRANT USAGE ON *.* TO 'zhangsan'@'localhost'      |
| GRANT SELECT, INSERT, UPDATE ON `mydb`.* TO ...   |
+--------------------------------------------------+

REVOKE 权限列表 ON 库名.对象名 FROM '用户名'@'主机名';

-- 回收用户对mydb库的所有权限
REVOKE ALL PRIVILEGES ON mydb.* FROM 'zhangsan'@'localhost';

-- 回收特定权限
REVOKE DELETE ON mydb.* FROM 'zhangsan'@'localhost';

-- 回收GRANT OPTION权限
REVOKE GRANT OPTION ON mydb.* FROM 'zhangsan'@'localhost';

-- 如果用户不存在则忽略（避免报错）
REVOKE IF EXISTS SELECT ON mydb.* FROM 'zhangsan'@'localhost';

-- 重新加载权限表，使修改立即生效
FLUSH PRIVILEGES;

-- 创建时指定认证插件
CREATE USER 'zhangsan'@'localhost' 
IDENTIFIED WITH mysql_native_password BY 'password';

-- 修改已存在用户的认证插件
ALTER USER 'zhangsan'@'localhost' 
IDENTIFIED WITH mysql_native_password BY 'new_password';

-- 1. 创建角色
CREATE ROLE 'app_read', 'app_write', 'app_admin';

-- 2. 为角色授予权限
GRANT SELECT ON app_db.* TO 'app_read';
GRANT SELECT, INSERT, UPDATE, DELETE ON app_db.* TO 'app_write';
GRANT ALL PRIVILEGES ON app_db.* TO 'app_admin';

-- 3. 将角色授予用户
GRANT 'app_read' TO 'zhangsan'@'localhost';
GRANT 'app_write' TO 'lisi'@'localhost';

-- 4. 设置默认激活的角色（登录时自动激活）
SET DEFAULT ROLE 'app_read' TO 'zhangsan'@'localhost';

-- 5. 查看当前激活的角色
SELECT CURRENT_ROLE();

-- 6. 手动切换角色（会话内临时切换）
SET ROLE 'app_write';

-- 7. 回收角色
REVOKE 'app_read' FROM 'zhangsan'@'localhost';

-- 8. 删除角色
DROP ROLE 'app_read';

-- 开发人员：创建并授权一步完成
GRANT ALL PRIVILEGES ON app_db.* TO 'dev_user'@'localhost' IDENTIFIED BY 'DevPass@2024';

-- 只读用户
GRANT SELECT ON app_db.* TO 'read_user'@'localhost' IDENTIFIED BY 'ReadPass@2024';

-- 运维人员：所有库只读
GRANT SELECT ON *.* TO 'ops_user'@'localhost' IDENTIFIED BY 'OpsPass@2024';

-- 步骤1：创建角色
CREATE ROLE 'dev_role', 'read_role', 'ops_role';

-- 步骤2：为角色授予权限
GRANT ALL PRIVILEGES ON app_db.* TO 'dev_role';
GRANT SELECT ON app_db.* TO 'read_role';
GRANT SELECT ON *.* TO 'ops_role';

-- 步骤3：创建用户
CREATE USER 'dev_user'@'localhost' IDENTIFIED BY 'DevPass@2024';
CREATE USER 'read_user'@'localhost' IDENTIFIED BY 'ReadPass@2024';
CREATE USER 'ops_user'@'localhost' IDENTIFIED BY 'OpsPass@2024';

-- 步骤4：将角色授予用户
GRANT 'dev_role' TO 'dev_user'@'localhost';
GRANT 'read_role' TO 'read_user'@'localhost';
GRANT 'ops_role' TO 'ops_user'@'localhost';

-- 步骤5：设置默认激活角色
SET DEFAULT ROLE 'dev_role' TO 'dev_user'@'localhost';
SET DEFAULT ROLE 'read_role' TO 'read_user'@'localhost';
SET DEFAULT ROLE 'ops_role' TO 'ops_user'@'localhost';