
The authentication options for the GRANT statement are the same as those for
the CREATE USER statement.

IDENTIFIED BY 'password'
------------------------

The optional IDENTIFIED BY clause can be used to provide an account with a
password. The password should be specified in plain text. It will be hashed by
the PASSWORD function prior to being stored.

For example, if our password is mariadb, then we can create the user with:

GRANT USAGE ON *.* TO foo2@test IDENTIFIED BY 'mariadb';

If you do not specify a password with the IDENTIFIED BY clause, the user will
be able to connect without a password. A blank password is not a wildcard to
match any password. The user must connect without providing a password if no
password is set.

If the user account already exists and if you provide the IDENTIFIED BY
clause, then the user's password will be changed. You must have the privileges
needed for the SET PASSWORD statement to change a user's password with GRANT.

The only authentication plugins that this clause supports are
mysql_native_password and mysql_old_password.

IDENTIFIED BY PASSWORD 'password_hash'
--------------------------------------

The optional IDENTIFIED BY PASSWORD clause can be used to provide an account
with a password that has already been hashed. The password should be specified
as a hash that was provided by the PASSWORD function. It will be stored as-is.

For example, if our password is mariadb, then we can find the hash with:

SELECT PASSWORD('mariadb');
+-------------------------------------------+
| PASSWORD('mariadb')                       |
+-------------------------------------------+
| *54958E764CE10E50764C2EECBB71D01F08549980 |
+-------------------------------------------+
1 row in set (0.00 sec)

And then we can create a user with the hash:

GRANT USAGE ON *.* TO foo2@test IDENTIFIED BY 
 PASSWORD '*54958E764CE10E50764C2EECBB71D01F08549980';

If you do not specify a password with the IDENTIFIED BY clause, the user will
be able to connect without a password. A blank password is not a wildcard to
match any password. The user must connect without providing a password if no
password is set.

If the user account already exists and if you provide the IDENTIFIED BY
clause, then the user's password will be changed. You must have the privileges
needed for the SET PASSWORD statement to change a user's password with GRANT.

The only authentication plugins that this clause supports are
mysql_native_password and mysql_old_password.

IDENTIFIED {VIA|WITH} authentication_plugin
-------------------------------------------

The optional IDENTIFIED VIA authentication_plugin allows you to specify that
the account should be authenticated by a specific authentication plugin. The
plugin name must be an active authentication plugin as per SHOW PLUGINS. If it
doesn't show up in that output, then you will need to install it with INSTALL
PLUGIN or INSTALL SONAME.

For example, this could be used with the PAM authentication plugin:

GRANT USAGE ON *.* TO foo2@test IDENTIFIED VIA pam;

Some authentication plugins allow additional arguments to be specified after a
USING or AS keyword. For example, the PAM authentication plugin accepts a
service name:

GRANT USAGE ON *.* TO foo2@test IDENTIFIED VIA pam USING 'mariadb';

The exact meaning of the additional argument would depend on the specific
authentication plugin.

MariaDB starting with 10.4.0
----------------------------
The USING or AS keyword can also be used to provide a plain-text password to a
plugin if it's provided as an argument to the PASSWORD() function. This is
only valid for authentication plugins that have implemented a hook for the
PASSWORD() function. For example, the ed25519 authentication plugin supports
this:

CREATE USER safe@'%' IDENTIFIED VIA ed25519 
 USING PASSWORD('secret');

MariaDB starting with 10.4.3
----------------------------
One can specify many authentication plugins, they all work as alternatives
ways of authenticating a user:

CREATE USER safe@'%' IDENTIFIED VIA ed25519 
 USING PASSWORD('secret') OR unix_socket;

By default, when you create a user without specifying an authentication
plugin, MariaDB uses the mysql_native_password plugin.

Resource Limit Options
----------------------

It is possible to set per-account limits for certain server resources. The
following table shows the values that can be set per account:

+--------------------------------------+--------------------------------------+
| Limit Type                           | Decription                           |
+--------------------------------------+--------------------------------------+
| MAX_QUERIES_PER_HOUR                 | Number of statements that the        |
|                                      | account can issue per hour           |
|                                      | (including updates)                  |
+--------------------------------------+--------------------------------------+
| MAX_UPDATES_PER_HOUR                 | Number of updates (not queries)      |
|                                      | that the account can issue per hour  |
+--------------------------------------+--------------------------------------+
| MAX_CONNECTIONS_PER_HOUR             | Number of connections that the       |
|                                      | account can start per hour           |
+--------------------------------------+--------------------------------------+