MySQL 8.4 Release Notes
MySQL 支持使用 ACCOUNT LOCK 和 ACCOUNT
UNLOCK 子句对 CREATE
USER 和 ALTER USER 语句的用户账户进行锁定和解锁：MySQL supports locking and unlocking user accounts using the
ACCOUNT LOCK and ACCOUNT
UNLOCK clauses for the CREATE
USER and ALTER USER
statements:
在
CREATE USER中使用时，这些子句指定新账户的初始锁定状态。如果未使用任一子句，账户将以未锁定状态创建。When used withCREATE USER, these clauses specify the initial locking state for a new account. In the absence of either clause, the account is created in an unlocked state.如果启用了
validate_password组件，即使账户被锁定，也不允许创建没有密码的账户。请参阅第 8.4.3 节，“密码验证组件”。If thevalidate_passwordcomponent is enabled, creating an account without a password is not permitted, even if the account is locked. See Section 8.4.3, “The Password Validation Component”.当与
ALTER USER一起使用时，这些子句指定现有账户的新锁定状态。如果没有任何子句，账户的锁定状态保持不变。When used withALTER USER, these clauses specify the new locking state for an existing account. In the absence of either clause, the account locking state remains unchanged.ALTER USER ... UNLOCK用于解锁由于登录失败次数过多而暂时被锁定的账户。参见 第 8.2.15 节，“密码管理”。ALTER USER ... UNLOCKunlocks any account named by the statement that is temporarily locked due to too many failed logins. See Section 8.2.15, “Password Management”.
账户锁定状态记录在 mysql.user 系统表的 account_locked 列中。SHOW CREATE USER 的输出显示账户是锁定还是解锁状态。Account locking state is recorded in the
account_locked column of the
mysql.user system table. The output from
SHOW CREATE USER indicates whether
an account is locked or unlocked.
如果客户端尝试连接到已锁定的账户，连接将失败。服务器会增加Locked_connects状态变量，该变量指示尝试连接已锁定账户的次数，同时返回ER_ACCOUNT_HAS_BEEN_LOCKED错误，并将消息写入错误日志：If a client attempts to connect to a locked account, the attempt
fails. The server increments the
Locked_connects status variable
that indicates the number of attempts to connect to a locked
account, returns an
ER_ACCOUNT_HAS_BEEN_LOCKED error,
and writes a message to the error log:
Access denied for user 'user_name'@'host_name'. Account is locked.
锁定账户不会影响使用代理用户连接，该代理用户假定被锁定账户的身份。它也不会影响执行具有DEFINER属性并将被锁定账户命名为定义者的存储程序或视图的能力。也就是说，使用代理账户或存储程序或视图的能力不会因锁定账户而受到影响。Locking an account does not affect being able to connect using a
proxy user that assumes the identity of the locked account. It
also does not affect the ability to execute stored programs or
views that have a DEFINER attribute naming the
locked account. That is, the ability to use a proxied account or
stored programs or views is not affected by locking the account.
账户锁定功能依赖于 mysql.user 系统表中存在 account_locked 列。对于从 MySQL 5.7.6 之前的版本升级的情况，请执行 MySQL 升级程序以确保该列存在。参见第 3 章，升级 MySQL。对于没有 account_locked 列的未升级安装，服务器会将所有账户视为未锁定，使用 ACCOUNT
LOCK 或 ACCOUNT UNLOCK 子句会产生错误。The account-locking capability depends on the presence of the
account_locked column in the
mysql.user system table. For upgrades from
MySQL versions older than 5.7.6, perform the MySQL upgrade
procedure to ensure that this column exists. See
Chapter 3, Upgrading MySQL. For nonupgraded installations that
have no account_locked column, the server
treats all accounts as unlocked, and using the ACCOUNT
LOCK or ACCOUNT UNLOCK clauses
produces an error.