
names or IP addresses. Use 'localhost' as the host name to allow only local
client connections.

You can use a netmask to match a range of IP addresses using 'base_ip/netmask'
as the host name. A user with an IP address ip_addr will be allowed to connect
if the following condition is true:

ip_addr & netmask = base_ip

For example, given a user:

CREATE USER 'maria'@'247.150.130.0/255.255.255.0';

the IP addresses satisfying this condition range from 247.150.130.0 to
247.150.130.255.

Using 255.255.255.255 is equivalent to not using a netmask at all. Netmasks
cannot be used for IPv6 addresses.

Note that the credentials added when creating a user with the '%' wildcard
host will not grant access in all cases. For example, some systems come with
an anonymous localhost user, and when connecting from localhost this will take
precedence.

Before MariaDB 10.6, the host name component could be up to 60 characters in
length. Starting from MariaDB 10.6, it can be up to 255 characters.

User Name Component
-------------------

User names must match exactly, including case. A user name that is empty is
known as an anonymous account and is allowed to match a login attempt with any
user name component. These are described more in the next section.

For valid identifiers to use as user names, see Identifier Names.

It is possible for more than one account to match when a user connects.
MariaDB selects the first matching account after sorting according to the
following criteria:

* Accounts with an exact host name are sorted before accounts using a wildcard
in the
host name. Host names using a netmask are considered to be exact for sorting.
* Accounts with a wildcard in the host name are sorted according to the
position of
the first wildcard character. Those with a wildcard character later in the
host name
sort before those with a wildcard character earlier in the host name.
* Accounts with a non-empty user name sort before accounts with an empty user
name.
* Accounts with an empty user name are sorted last. As mentioned previously,
these are known as anonymous accounts. These are described more in the next
section.

The following table shows a list of example account as sorted by these
criteria:

+---------+-------------+
| User    | Host        |
+---------+-------------+
| joffrey | 192.168.0.3 |
|         | 192.168.0.% |
| joffrey | 192.168.%   |
|         | 192.168.%   |
+---------+-------------+

Once connected, you only have the privileges granted to the account that
matched, not all accounts that could have matched. For example, consider the
following commands:

CREATE USER 'joffrey'@'192.168.0.3';
CREATE USER 'joffrey'@'%';
GRANT SELECT ON test.t1 to 'joffrey'@'192.168.0.3';
GRANT SELECT ON test.t2 to 'joffrey'@'%';

If you connect as joffrey from 192.168.0.3, you will have the SELECT privilege
on the table test.t1, but not on the table test.t2. If you connect as joffrey
from any other IP address, you will have the SELECT privilege on the table
test.t2, but not on the table test.t1.

Usernames can be up to 80 characters long before 10.6 and starting from 10.6
it can be 128 characters long.

Anonymous Accounts
------------------

Anonymous accounts are accounts where the user name portion of the account
name is empty. These accounts act as special catch-all accounts. If a user
attempts to log into the system from a host, and an anonymous account exists
with a host name portion that matches the user's host, then the user will log
in as the anonymous account if there is no more specific account match for the
user name that the user entered.

For example, here are some anonymous accounts:

CREATE USER ''@'localhost';
CREATE USER ''@'192.168.0.3';

Fixing a Legacy Default Anonymous Account
-----------------------------------------

On some systems, the mysql.db table has some entries for the ''@'%' anonymous
account by default. Unfortunately, there is no matching entry in the
mysql.user/mysql.global_priv_table table, which means that this anonymous
account doesn't exactly exist, but it does have privileges--usually on the
default test database created by mysql_install_db. These account-less
privileges are a legacy that is leftover from a time when MySQL's privilege
system was less advanced.

This situation means that you will run into errors if you try to create a
''@'%' account. For example:

CREATE USER ''@'%';
ERROR 1396 (HY000): Operation CREATE USER failed for ''@'%'

The fix is to DELETE the row in the mysql.db table and then execute FLUSH
PRIVILEGES:

DELETE FROM mysql.db WHERE User='' AND Host='%';
FLUSH PRIVILEGES;

And then the account can be created:

CREATE USER ''@'%';
Query OK, 0 rows affected (0.01 sec)

See MDEV-13486 for more information.

Password Expiry
---------------

MariaDB starting with 10.4.3
----------------------------
Besides automatic password expiry, as determined by default_password_lifetime,
password expiry times can be set on an individual user basis, overriding the
global setting, for example:

CREATE USER 'monty'@'localhost' PASSWORD EXPIRE INTERVAL 120 DAY;

See User Password Expiry for more details.

Account Locking
---------------

MariaDB starting with 10.4.2
----------------------------
Account locking permits privileged administrators to lock/unlock user
accounts. No new client connections will be permitted if an account is locked