Important

You are viewing the documentation of TiDB v6.0 (DMR). PingCAP does not provide bug fixes for v6.0. Any bugs will be fixed in future releases.

For general purposes, please use the latest LTS version of the TiDB database.

GRANT <privileges>

This statement allocates privileges to a pre-existing user in TiDB. The privilege system in TiDB follows MySQL, where credentials are assigned based on a database/table pattern. Executing this statement requires the GRANT OPTION privilege and all privileges you allocate.

Synopsis

GrantStmt
GRANTPrivElemListONObjectTypePrivLevelTOUserSpecListRequireClauseOptWithGrantOptionOpt
PrivElemList
PrivElem,
PrivElem
PrivType(ColumnNameList)
PrivType
ALLPRIVILEGESALTERROUTINECREATEUSERTEMPORARYTABLESVIEWROLEROUTINETRIGGERDELETEDROPROLEPROCESSEXECUTEINDEXINSERTSELECTSUPERSHOWDATABASESVIEWUPDATEGRANTOPTIONREFERENCESREPLICATIONSLAVECLIENTUSAGERELOADFILECONFIGLOCKTABLESEVENTSHUTDOWN
ObjectType
TABLE
PrivLevel
*.*Identifier.*Identifier
UserSpecList
UserSpec,

Examples

mysql> CREATE USER 'newuser' IDENTIFIED BY 'mypassword';
Query OK, 1 row affected (0.02 sec)

mysql> GRANT ALL ON test.* TO 'newuser';
Query OK, 0 rows affected (0.03 sec)

mysql> SHOW GRANTS FOR 'newuser';
+-------------------------------------------------+
| Grants for newuser@%                            |
+-------------------------------------------------+
| GRANT USAGE ON *.* TO 'newuser'@'%'             |
| GRANT ALL PRIVILEGES ON test.* TO 'newuser'@'%' |
+-------------------------------------------------+
2 rows in set (0.00 sec)

MySQL compatibility

  • Similar to MySQL, the USAGE privilege denotes the ability to log into a TiDB server.
  • Column level privileges are not currently supported.
  • Similar to MySQL, when the NO_AUTO_CREATE_USER sql mode is not present, the GRANT statement will automatically create a new user with an empty password when a user does not exist. Removing this sql-mode (it is enabled by default) presents a security risk.

See also

Was this page helpful?