Oracle 5.0, Reference Manual

Page: 1179 / 3232

Account Management Statements
1159
REQUIRE SUBJECT '/C=EE/ST=Some-State/L=Tallinn/
O=MySQL demo client certificate/
CN=Tonu Samuel/emailAddress=tonu@example.com';
The
'subject'
value should be entered as a single string. MySQL does a simple string comparison
of this value to the value in the certificate, so lettercase and component ordering must be given
exactly as present in the certificate.
Note
Regarding
emailAddress
, see the note in the description of
REQUIRE
ISSUER
.
•
REQUIRE CIPHER 'cipher'
is needed to ensure that ciphers and key lengths of sufficient
strength are used. SSL itself can be weak if old algorithms using short encryption keys are used.
Using this option, you can ask that a specific cipher method is used for a connection.
GRANT ALL PRIVILEGES ON test.* TO 'root'@'localhost'
IDENTIFIED BY 'goodsecret'
REQUIRE CIPHER 'EDH-RSA-DES-CBC3-SHA';
The
SUBJECT
,
ISSUER
, and
CIPHER
options can be combined in the
REQUIRE
clause like this:
GRANT ALL PRIVILEGES ON test.* TO 'root'@'localhost'
IDENTIFIED BY 'goodsecret'
REQUIRE SUBJECT '/C=EE/ST=Some-State/L=Tallinn/
O=MySQL demo client certificate/
CN=Tonu Samuel/emailAddress=tonu@example.com'
AND ISSUER '/C=FI/ST=Some-State/L=Helsinki/
O=MySQL Finland AB/CN=Tonu Samuel/emailAddress=tonu@example.com'
AND CIPHER 'EDH-RSA-DES-CBC3-SHA';
The order of the options does not matter, but no option can be specified twice. The
AND
keyword is
optional between
REQUIRE
options.
If you are using table, column, or routine privileges for even one user, the server examines table,
column, and routine privileges for all users and this slows down MySQL a bit. Similarly, if you limit the
number of queries, updates, or connections for any users, the server must monitor these values.
MySQL and Standard SQL Versions of
GRANT
The biggest differences between the MySQL and standard SQL versions of
GRANT
are:
• MySQL associates privileges with the combination of a host name and user name and not with only a
user name.
• Standard SQL does not have global or database-level privileges, nor does it support all the privilege
types that MySQL supports.
• MySQL does not support the standard SQL
UNDER
privilege, and does not support the
TRIGGER
privilege until MySQL 5.1.6.
• Standard SQL privileges are structured in a hierarchical manner. If you remove a user, all privileges
the user has been granted are revoked. This is also true in MySQL 5.0.2 and up if you use
DROP
USER
. Before 5.0.2, the granted privileges are not automatically revoked; you must revoke them
yourself. See Section 13.7.1.2, “
DROP USER
Syntax” .
• In standard SQL, when you drop a table, all privileges for the table are revoked. In standard SQL,
when you revoke a privilege, all privileges that were granted based on that privilege are also
revoked. In MySQL, privileges can be dropped only with explicit
DROP USER
or
REVOKE
statements
or by manipulating the MySQL grant tables directly.
• In MySQL, it is possible to have the
INSERT
[577] privilege for only some of the columns in a table.
In this case, you can still execute
INSERT
statements on the table, provided that you insert values