文档首页
MySQL 8.4 参考手册
8.4 中文镜像

MySQL 8.4 参考手册 · 中文镜像

正文为中文,英文原文默认隐藏。点击任意中文段落即可展开 / 收起对应英文原文。

打开官方英文原文 ↗

译文由机器翻译生成,仅供理解参考;有疑问请以官方英文原文为准。

中文点击中文段落可显示 / 隐藏英文原文本页译文覆盖 100%

8.2.4 指定账户名称8.2.4 Specifying Account Names

MySQL 账户名由用户名和主机名组成,这使得可以为从不同主机连接的相同用户名的用户创建不同的账户。本节描述了账户名的语法,包括特殊值和通配符规则。MySQL account names consist of a user name and a host name, which enables creation of distinct accounts for users with the same user name who connect from different hosts. This section describes the syntax for account names, including special values and wildcard rules.

在大多数方面,帐户名与 MySQL 角色名相似,其差异在第 8.2.5 节,“指定角色名”中有所描述。In most respects, account names are similar to MySQL role names, with some differences described at Section 8.2.5, “Specifying Role Names”.

帐户名出现在 SQL 语句中,例如 CREATE USER、GRANT 以及 SET PASSWORD 并遵循以下规则:Account names appear in SQL statements such as CREATE USER, GRANT, and SET PASSWORD and follow these rules:

  • 帐户名语法为 'user_name'@'host_name'。Account name syntax is 'user_name'@'host_name'.

  • @'host_name' 部分是可选的。仅由用户名组成的账号名称等同于 'user_name'@'%'。例如,'me' 等同于 'me'@'%'。The @'host_name' part is optional. An account name consisting only of a user name is equivalent to 'user_name'@'%'. For example, 'me' is equivalent to 'me'@'%'.

  • 如果用户名和主机名是合法的未加引号的标识符,则无需加引号。如果 user_name 字符串包含特殊字符(例如空格或 -),或者 host_name 字符串包含特殊字符或通配符(例如 . 或 %),则必须使用引号。例如,在账号名称 'test-user'@'%.com' 中,用户名和主机名部分都需要加引号。The user name and host name need not be quoted if they are legal as unquoted identifiers. Quotes must be used if a user_name string contains special characters (such as space or -), or a host_name string contains special characters or wildcard characters (such as . or %). For example, in the account name 'test-user'@'%.com', both the user name and host name parts require quotes.

  • 将用户名和主机名作为标识符或字符串引用,可使用反引号(`)、单引号(')或双引号(")。有关字符串引用和标识符引用的指南,请参见 第 11.1.1 节,“字符串字面值”,以及 第 11.2 节,“模式对象名称”。在 SHOW 语句结果中,用户名和主机名使用反引号(`)引用。Quote user names and host names as identifiers or as strings, using either backticks (`), single quotation marks ('), or double quotation marks ("). For string-quoting and identifier-quoting guidelines, see Section 11.1.1, “String Literals”, and Section 11.2, “Schema Object Names”. In SHOW statement results, user names and host names are quoted using backticks (`).

  • 用户名和主机名部分,如果加引号,必须分别加引号。也就是说,写 'me'@'localhost',而不是 'me@localhost'。(后者实际上相当于 'me@localhost'@'%',尽管这种行为现在已被弃用。)The user name and host name parts, if quoted, must be quoted separately. That is, write 'me'@'localhost', not 'me@localhost'. (The latter is actually equivalent to 'me@localhost'@'%', although this behavior is now deprecated.)

  • 引用 CURRENT_USER 或 CURRENT_USER() 函数等同于字面指定当前客户端的用户名和主机名。A reference to the CURRENT_USER or CURRENT_USER() function is equivalent to specifying the current client's user name and host name literally.

MySQL 在 mysql 系统数据库的授权表中存储账户名,用户名和主机名部分使用单独的列:MySQL stores account names in grant tables in the mysql system database using separate columns for the user name and host name parts:

  • user 表包含每个账户的一行记录。User 和 Host 列存储用户名和主机名。此表还指示该账户拥有的全局权限。The user table contains one row for each account. The User and Host columns store the user name and host name. This table also indicates which global privileges the account has.

  • 其他授权表指示账户对数据库及数据库内对象拥有的权限。这些表具有 User 和 Host 列来存储账户名称。这些表中的每一行都与 user 表中具有相同 User 和 Host 值的账户相关联。Other grant tables indicate privileges an account has for databases and objects within databases. These tables have User and Host columns to store the account name. Each row in these tables associates with the account in the user table that has the same User and Host values.

  • 出于访问检查的目的,用户值的比较是区分大小写的。主机值的比较不区分大小写。For access-checking purposes, comparisons of User values are case-sensitive. Comparisons of Host values are not case-sensitive.

有关存储在授权表中的用户名和主机名属性的更多详细信息,例如最大长度,请参阅授权表范围列属性。For additional detail about the properties of user names and host names as stored in the grant tables, such as maximum length, see Grant Table Scope Column Properties.

用户名和主机名具有某些特殊值或通配符约定,如下所述。User names and host names have certain special values or wildcard conventions, as described following.

账户名中的用户名部分要么是一个非空值,与传入连接尝试的用户名完全匹配,要么是空值(空字符串),可以匹配任何用户名。用户名为空的账户为匿名用户。要在 SQL 语句中指定匿名用户,请使用带引号的空用户名部分,例如 ''@'localhost'。The user name part of an account name is either a nonblank value that literally matches the user name for incoming connection attempts, or a blank value (the empty string) that matches any user name. An account with a blank user name is an anonymous user. To specify an anonymous user in SQL statements, use a quoted empty user name part, such as ''@'localhost'.

帐户名的主机名部分可以采用多种形式,并允许使用通配符:The host name part of an account name can take many forms, and wildcards are permitted:

  • 主机值可以是主机名或 IP 地址(IPv4 或 IPv6)。名称 'localhost' 表示本地主机。IP 地址 '127.0.0.1' 表示 IPv4 回环接口。IP 地址 '::1' 表示 IPv6 回环接口。A host value can be a host name or an IP address (IPv4 or IPv6). The name 'localhost' indicates the local host. The IP address '127.0.0.1' indicates the IPv4 loopback interface. The IP address '::1' indicates the IPv6 loopback interface.

  • 在主机名或 IP 地址值中允许使用 % 和 _ 通配符字符,但这些字符已被弃用,因此将在未来版本的 MySQL 中可能被移除。这些字符的含义与使用 LIKE 运算符进行模式匹配操作时相同。例如,主机值 '%' 匹配任何主机名,而值 '%.mysql.com' 匹配 mysql.com 域中的任何主机。'198.51.100.%' 匹配 198.51.100 C 类网络中的任何主机。Use of the % and _ wildcard characters is permitted in host name or IP address values, but is deprecated and thus subject to removal in a future version of MySQL. These characters have the same meaning as for pattern-matching operations performed with the LIKE operator. For example, a host value of '%' matches any host name, whereas a value of '%.mysql.com' matches any host in the mysql.com domain. '198.51.100.%' matches any host in the 198.51.100 class C network.

    因为在主机值中允许使用 IP 通配符值(例如,'198.51.100.%' 可以匹配一个子网内的所有主机),有人可能会尝试通过将主机命名为 198.51.100.somewhere.com 来利用此功能。为了防止此类尝试,MySQL 不会对以数字和点开头的主机名进行匹配。例如,如果主机名为 1.2.example.com,其名称永远不会与帐户名的主机部分匹配。IP 通配符值只能匹配 IP 地址,而不能匹配主机名。Because IP wildcard values are permitted in host values (for example, '198.51.100.%' to match every host on a subnet), someone could try to exploit this capability by naming a host 198.51.100.somewhere.com. To foil such attempts, MySQL does not perform matching on host names that start with digits and a dot. For example, if a host is named 1.2.example.com, its name never matches the host part of account names. An IP wildcard value can match only IP addresses, not host names.

    如果 partial_revokes 为 ON,MySQL 会将授权中的 % 和 _ 视为字面字符,而不是通配符。这些通配符的使用已被弃用(无论此变量的值如何);您应该预期此功能将在未来的 MySQL 版本中被移除。If partial_revokes is ON, MySQL treats % and _ in grants as literal characters, and not as wildcards. Use of these wildcards is deprecated (regardless of this variable's value); you should expect this functionality to be removed in a future version of MySQL.

  • 对于指定为 IPv4 地址的主机值,可以提供子网掩码以指示要用于网络号的地址位数。子网掩码表示法不能用于 IPv6 地址。For a host value specified as an IPv4 address, a netmask can be given to indicate how many address bits to use for the network number. Netmask notation cannot be used for IPv6 addresses.

    语法是 host_ip/netmask。例如:The syntax is host_ip/netmask. For example:

    CREATE USER 'david'@'198.51.100.0/255.255.255.0';
    

    这使得 david 可以从任何具有 IP 地址 client_ip 的客户端主机连接,只要满足以下条件:This enables david to connect from any client host having an IP address client_ip for which the following condition is true:

    client_ip & netmask = host_ip
    

    也就是说,对于刚才显示的 CREATE USER 语句:That is, for the CREATE USER statement just shown:

    client_ip & 255.255.255.0 = 198.51.100.0
    

    满足此条件的 IP 地址范围是从 198.51.100.0 到 198.51.100.255。IP addresses that satisfy this condition range from 198.51.100.0 to 198.51.100.255.

    子网掩码通常以设置为 1 的位开头,随后是设置为 0 的位。例如:A netmask typically begins with bits set to 1, followed by bits set to 0. Examples:

    • 198.0.0.0/255.0.0.0:198 类 A 网络上的任何主机198.0.0.0/255.0.0.0: Any host on the 198 class A network

    • 198.51.0.0/255.255.0.0:198.51 类 B 网络上的任何主机198.51.0.0/255.255.0.0: Any host on the 198.51 class B network

    • 198.51.100.0/255.255.255.0:198.51.100 类 C 网络上的任何主机198.51.100.0/255.255.255.0: Any host on the 198.51.100 class C network

    • 198.51.100.1:只有具有此特定 IP 地址的主机198.51.100.1: Only the host with this specific IP address

  • 以 IPv4 地址指定的主机值可以使用 CIDR 表示法书写,例如 198.51.100.44/24。A host value specified as an IPv4 address can be written using CIDR notation, such as 198.51.100.44/24.

服务器将帐户名称中的主机值与客户端主机进行匹配,使用系统 DNS 解析器返回的客户端主机名或 IP 地址的值。除非帐户主机值是使用网络掩码表示的,否则服务器将此比较作为字符串匹配进行,即使帐户主机值以 IP 地址形式给出。这意味着你应当以 DNS 使用的相同格式指定帐户主机值。以下是需要注意的问题示例:The server performs matching of host values in account names against the client host using the value returned by the system DNS resolver for the client host name or IP address. Except in the case that the account host value is specified using netmask notation, the server performs this comparison as a string match, even for an account host value given as an IP address. This means that you should specify account host values in the same format used by DNS. Here are examples of problems to watch out for:

  • 假设本地网络上的主机完全限定名为host1.example.com。如果 DNS 返回该主机的名称查询结果为host1.example.com,请在账户主机值中使用该名称。如果 DNS 仅返回host1,则使用host1。Suppose that a host on the local network has a fully qualified name of host1.example.com. If DNS returns name lookups for this host as host1.example.com, use that name in account host values. If DNS returns just host1, use host1 instead.

  • 如果 DNS 返回某个主机的 IP 地址为198.51.100.2,则它匹配账户主机值198.51.100.2,但不匹配198.051.100.2。同样,它匹配账户主机模式如198.51.100.%,但不匹配198.051.100.%。If DNS returns the IP address for a given host as 198.51.100.2, that matches an account host value of 198.51.100.2 but not 198.051.100.2. Similarly, it matches an account host pattern like 198.51.100.% but not 198.051.100.%.

为了避免此类问题,建议检查您的 DNS 返回主机名和地址的格式。在 MySQL 帐户名中使用相同格式的值。To avoid problems like these, it is advisable to check the format in which your DNS returns host names and addresses. Use values in the same format in MySQL account names.