Syntax
------

ALTER USER [IF EXISTS] 
 user_specification [,user_specification] ...
 [REQUIRE {NONE | tls_option [[AND] tls_option] ...}]
 [WITH resource_option [resource_option] ...]
 [lock_option] [password_option]

user_specification:
 username [authentication_option]

authentication_option:
 IDENTIFIED BY 'password'
 | IDENTIFIED BY PASSWORD 'password_hash'
 | IDENTIFIED {VIA|WITH} authentication_rule [OR authentication_rule] ...

authentication_rule:
 authentication_plugin
 | authentication_plugin {USING|AS} 'authentication_string'
 | authentication_plugin {USING|AS} PASSWORD('password')

tls_option
 SSL
 | X509
 | CIPHER 'cipher'
 | ISSUER 'issuer'
 | SUBJECT 'subject'

resource_option
 MAX_QUERIES_PER_HOUR count
 | MAX_UPDATES_PER_HOUR count
 | MAX_CONNECTIONS_PER_HOUR count
 | MAX_USER_CONNECTIONS count
 | MAX_STATEMENT_TIME time

password_option:
 PASSWORD EXPIRE
 | PASSWORD EXPIRE DEFAULT
 | PASSWORD EXPIRE NEVER
 | PASSWORD EXPIRE INTERVAL N DAY

lock_option:
  ACCOUNT LOCK
 | ACCOUNT UNLOCK
}

Description
-----------

The ALTER USER statement modifies existing MariaDB accounts. To use it, you
must have the global CREATE USER privilege or the UPDATE privilege for the
mysql database. The global SUPER privilege is also required if the read_only
system variable is enabled.

If any of the specified user accounts do not yet exist, an error results. If
an error occurs, ALTER USER will still modify the accounts that do not result
in an error. Only one error is produced for all users which have not been
modified.

IF EXISTS
---------

When the IF EXISTS clause is used, MariaDB will return a warning instead of an
error for each specified user that does not exist.

Account Names
-------------

For ALTER USER statements, account names are specified as the username
argument in the same way as they are for CREATE USER statements. See account
names from the CREATE USER page for details on how account names are specified.

CURRENT_USER or CURRENT_USER() can also be used to alter the account logged
into the current session. For example, to change the current user's password
to mariadb:

ALTER USER CURRENT_USER() IDENTIFIED BY 'mariadb';

Authentication Options
----------------------

MariaDB starting with 10.4
--------------------------
From MariaDB 10.4, it is possible to use more than one authentication plugin
for each user account. For example, this can be useful to slowly migrate users
to the more secure ed25519 authentication plugin over time, while allowing the
old mysql_native_password authentication plugin as an alternative for the
transitional period. See Authentication from MariaDB 10.4 for more.

When running ALTER USER, not specifying an authentication option in the
IDENTIFIED VIA clause will remove that authentication method. (However this
was not the case before MariaDB 10.4.13, see MDEV-21928)

For example, a user is created with the ability to authenticate via both a
password and unix_socket:

CREATE USER 'bob'@'localhost' 
 IDENTIFIED VIA mysql_native_password USING PASSWORD('pwd')
 OR unix_socket;

SHOW CREATE USER 'bob'@'localhost'\G
*************************** 1. row ***************************
CREATE USER for bob@localhost: CREATE USER `bob`@`localhost` 
 IDENTIFIED VIA mysql_native_password
 USING '*975B2CD4FF9AE554FE8AD33168FBFC326D2021DD'
 OR unix_socket

If the user's password is updated, but unix_socket authentication is not
specified in the IDENTIFIED VIA clause, unix_socket authentication will no
longer be permitted.

ALTER USER 'bob'@'localhost' IDENTIFIED VIA mysql_native_password 
 USING PASSWORD('pwd2');

SHOW CREATE USER 'bob'@'localhost'\G
*************************** 1. row ***************************
CREATE USER for bob@localhost: CREATE USER `bob`@`localhost` 
 IDENTIFIED BY PASSWORD '*38366FDA01695B6A5A9DD4E428D9FB8F7EB75512'

IDENTIFIED BY 'password'
------------------------

The optional IDENTIFIED BY clause can be used to provide an account with a
password. The password should be specified in plain text. It will be hashed by
the PASSWORD function prior to being stored to the mysql.user table.

For example, if our password is mariadb, then we can set the account's
password with:

ALTER USER foo2@test IDENTIFIED BY 'mariadb';

If you do not specify a password with the IDENTIFIED BY clause, the user will
be able to connect without a password. A blank password is not a wildcard to
match any password. The user must connect without providing a password if no
password is set.

The only authentication plugins that this clause supports are
mysql_native_password and mysql_old_password.

IDENTIFIED BY PASSWORD 'password_hash'
--------------------------------------

The optional IDENTIFIED BY PASSWORD clause can be used to provide an account
with a password that has already been hashed. The password should be specified
as a hash that was provided by the PASSWORD#function. It will be stored to the
mysql.user table as-is.

For example, if our password is mariadb, then we can find the hash with:

SELECT PASSWORD('mariadb');
+-------------------------------------------+
| PASSWORD('mariadb')                       |
+-------------------------------------------+
| *54958E764CE10E50764C2EECBB71D01F08549980 |
+-------------------------------------------+

And then we can set an account's password with the hash:

ALTER USER foo2@test 