
| REQUIRE SUBJECT 'subject' | The account must use TLS and must have a       |
|                           | valid X509 certificate. Also, the              |
|                           | certificate's Subject must be the one          |
|                           | specified via the string subject. This option  |
|                           | implies REQUIRE X509. This option can be       |
|                           | combined with the ISSUER, and CIPHER options   |
|                           | in any order.                                  |
+---------------------------+------------------------------------------------+
| REQUIRE CIPHER 'cipher'   | The account must use TLS, but no valid X509    |
|                           | certificate is required. Also, the encryption  |
|                           | used for the connection must use a specific    |
|                           | cipher method specified in the string cipher.  |
|                           | This option implies REQUIRE SSL. This option   |
|                           | can be combined with the ISSUER, and SUBJECT   |
|                           | options in any order.                          |
+---------------------------+------------------------------------------------+

The REQUIRE keyword must be used only once for all specified options, and the
AND keyword can be used to separate individual options, but it is not required.

For example, you can create a user account that requires these TLS options
with the following:

GRANT USAGE ON *.* TO 'alice'@'%'
 REQUIRE SUBJECT '/CN=alice/O=My Dom, Inc./C=US/ST=Oregon/L=Portland'
 AND ISSUER '/C=FI/ST=Somewhere/L=City/ O=Some Company/CN=Peter
Parker/emailAddress=p.parker@marvel.com'
 AND CIPHER 'SHA-DES-CBC3-EDH-RSA';

If any of these options are set for a specific user account, then any client
who tries to connect with that user account will have to be configured to
connect with TLS.

See Securing Connections for Client and Server for information on how to
enable TLS on the client and server.

Roles
-----

Syntax
------

GRANT role TO grantee [, grantee ... ]
[ WITH ADMIN OPTION ]

grantee:
  rolename
  username [authentication_option]

The GRANT statement is also used to grant the use of a role to one or more
users or other roles. In order to be able to grant a role, the grantor doing
so must have permission to do so (see WITH ADMIN in the CREATE ROLE article).

Specifying the WITH ADMIN OPTION permits the grantee to in turn grant the role
to another.

For example, the following commands show how to grant the same role to a
couple different users.

GRANT journalist TO hulda;

GRANT journalist TO berengar WITH ADMIN OPTION;

If a user has been granted a role, they do not automatically obtain all
permissions associated with that role. These permissions are only in use when
the user activates the role with the SET ROLE statement.

TO PUBLIC
---------

MariaDB starting with 10.11
---------------------------

Syntax
------

GRANT <privilege> ON <database>.<object> TO PUBLIC;
REVOKE <privilege> ON <database>.<object> FROM PUBLIC;

GRANT ... TO PUBLIC grants privileges to all users with access to the server.
The privileges also apply to users created after the privileges are granted.
This can be useful when one only wants to state once that all users need to
have a certain set of privileges.

When running SHOW GRANTS, a user will also see all privileges inherited from
PUBLIC. SHOW GRANTS FOR PUBLIC will only show TO PUBLIC grants.

Grant Examples
--------------

Granting Root-like Privileges
-----------------------------

You can create a user that has privileges similar to the default root accounts
by executing the following:

CREATE USER 'alexander'@'localhost';
GRANT ALL PRIVILEGES ON  *.* to 'alexander'@'localhost' WITH GRANT OPTION;

URL: https://mariadb.com/kb/en/grant/