
| REQUIRE CIPHER 'cipher'   | The account must use TLS, but no valid X509    |
|                           | certificate is required. Also, the encryption  |
|                           | used for the connection must use a specific    |
|                           | cipher method specified in the string cipher.  |
|                           | This option implies REQUIRE SSL. This option   |
|                           | can be combined with the ISSUER, and SUBJECT   |
|                           | options in any order.                          |
+---------------------------+------------------------------------------------+

The REQUIRE keyword must be used only once for all specified options, and the
AND keyword can be used to separate individual options, but it is not required.

For example, you can create a user account that requires these TLS options
with the following:

CREATE USER 'alice'@'%'
 REQUIRE SUBJECT '/CN=alice/O=My Dom, Inc./C=US/ST=Oregon/L=Portland'
 AND ISSUER '/C=FI/ST=Somewhere/L=City/ O=Some Company/CN=Peter
Parker/emailAddress=p.parker@marvel.com'
 AND CIPHER 'SHA-DES-CBC3-EDH-RSA';

If any of these options are set for a specific user account, then any client
who tries to connect with that user account will have to be configured to
connect with TLS.

See Securing Connections for Client and Server for information on how to
enable TLS on the client and server.

Resource Limit Options
----------------------

It is possible to set per-account limits for certain server resources. The
following table shows the values that can be set per account:

+--------------------------------------+--------------------------------------+
| Limit Type                           | Decription                           |
+--------------------------------------+--------------------------------------+
| MAX_QUERIES_PER_HOUR                 | Number of statements that the        |
|                                      | account can issue per hour           |
|                                      | (including updates)                  |
+--------------------------------------+--------------------------------------+
| MAX_UPDATES_PER_HOUR                 | Number of updates (not queries)      |
|                                      | that the account can issue per hour  |
+--------------------------------------+--------------------------------------+
| MAX_CONNECTIONS_PER_HOUR             | Number of connections that the       |
|                                      | account can start per hour           |
+--------------------------------------+--------------------------------------+
| MAX_USER_CONNECTIONS                 | Number of simultaneous connections   |
|                                      | that can be accepted from the same   |
|                                      | account; if it is 0,                 |
|                                      | max_connections will be used         |
|                                      | instead; if max_connections is 0,    |
|                                      | there is no limit for this           |
|                                      | account's simultaneous connections.  |
+--------------------------------------+--------------------------------------+
| MAX_STATEMENT_TIME                   | Timeout, in seconds, for statements  |
|                                      | executed by the user. See also       |
|                                      | Aborting Statements that Exceed a    |
|                                      | Certain Time to Execute.             |
+--------------------------------------+--------------------------------------+

If any of these limits are set to 0, then there is no limit for that resource
for that user.

Here is an example showing how to create a user with resource limits:

CREATE USER 'someone'@'localhost' WITH
  MAX_USER_CONNECTIONS 10
  MAX_QUERIES_PER_HOUR 200;

The resources are tracked per account, which means 'user'@'server'; not per
user name or per connection.

The count can be reset for all users using FLUSH USER_RESOURCES, FLUSH
PRIVILEGES or mysqladmin reload.

Per account resource limits are stored in the user table, in the mysql
database. Columns used for resources limits are named max_questions,
max_updates, max_connections (for MAX_CONNECTIONS_PER_HOUR), and
max_user_connections (for MAX_USER_CONNECTIONS).

Account Names
-------------

Account names have both a user name component and a host name component, and
are specified as 'user_name'@'host_name'.

The user name and host name may be unquoted, quoted as strings using double
quotes (") or single quotes ('), or quoted as identifiers using backticks (`).
You must use quotes when using special characters (such as a hyphen) or
wildcard characters. If you quote, you must quote the user name and host name
separately (for example 'user_name'@'host_name').

Host Name Component
-------------------

If the host name is not provided, it is assumed to be '%'.

Host names may contain the wildcard characters % and _. They are matched as if
by the LIKE clause. If you need to use a wildcard character literally (for
example, to match a domain name with an underscore), prefix the character with
a backslash. See LIKE for more information on escaping wildcard characters.

Host name matches are case-insensitive. Host names can match either domain