Are Users 'User'@'%' and 'User

Question

I created a user per the first command but cannot logon via localhost (linux). This link mysqldoc indicates that I need to create a second user by the same name, but using the syntax in the second block of commands.

mysql> CREATE USER 'myuser'@'%' IDENTIFIED BY '4myuser';
Query OK, 0 rows affected (0.00 sec)

mysql> GRANT ALL ON my_upload.* TO 'myuser'@'%' IDENTIFIED BY '4myuser';
Query OK, 0 rows affected (0.00 sec)

So I tried that as below, and it indeed worked. But are these two separate users? If I change the pw for one, will the other one sync, or are they truly separate users?

mysql> CREATE USER 'myuser'@'localhost' IDENTIFIED BY '4myuser';
Query OK, 0 rows affected (0.00 sec)

mysql> GRANT ALL PRIVILEGES ON my_upload.* TO  'myuser'@'localhost';
Query OK, 0 rows affected (0.00 sec)

Answer 1

User@% would allow access from all locations. User@localhost would only allow access from localhost. They are two different users with two different passwords (though you can set them to the same password, but if you update one password the other will not auto-update)

Answer 2

Even if they would mean the same, or if one would include the other, they ARE indeed separate users!

13.7.1.3. GRANT Syntax

MySQL and Standard SQL Versions of GRANT

The biggest differences between the MySQL and standard SQL versions of GRANT are:

• MySQL associates privileges with the combination of a host name and user name and not with only a user name.

Answer 3

I encountered the same situation as described - Adding an entry for user@% was not working.

Yet adding an entry for the same user@localhost would start to work again though. This did seem unintuitive, given our understanding of the % pattern!

An issue identified by Kent above was that: We had an entry row in the users table for host:localhost but the user was blank. This apparently resolved to a rule for %@localhost which was being used as a match before my user@% rule.

Short answer - check for blank or wildcard usernames in your user table.

... I have no idea how that blank got there or if it was intentional.

Answer 4

Basically yes, those are two different users with (possibly) different permissions and (possibly) different passwords.

• myuser@% : User myuser, connecting from any host.
• myuser@localhost : User myuser, connecting from localhost only.

A good read is the MySQL manual about connection access, it demonstrates how it works.