For proxying to occur for a given authentication plugin, these conditions must be satisfied:为了使给定的身份验证插件发生代理，必须满足以下条件：

The proxy mechanism permits mapping only the external client user name to the proxied user name. There is no provision for mapping host names:代理机制只允许将外部客户端用户名映射到代理用户名。没有映射主机名的规定：

Consider the following account definitions:考虑以下帐户定义：

-- create proxy account
CREATE USER 'employee_ext'@'localhost'
  IDENTIFIED WITH my_auth_plugin
  AS 'my_auth_string';

-- create proxied account and grant its privileges;
-- use mysql_no_login plugin to prevent direct login
CREATE USER 'employee'@'localhost'
  IDENTIFIED WITH mysql_no_login;
GRANT ALL
  ON employees.*
  TO 'employee'@'localhost';

-- grant to proxy account the
-- PROXY privilege for proxied account
GRANT PROXY
  ON 'employee'@'localhost'
  TO 'employee_ext'@'localhost';

When a client connects as employee_ext from the local host, MySQL uses the plugin named my_auth_plugin to perform authentication. 当客户端以employee_ext身份从本地主机连接时，MySQL使用名为my_auth_plugin的插件进行身份验证。Suppose that my_auth_plugin returns a user name of employee to the server, based on the content of 'my_auth_string' and perhaps by consulting some external authentication system. 假设my_auth_plugin根据'my_auth_string'的内容，并可能通过咨询一些外部身份验证系统，向服务器返回employee的用户名。The name employee differs from employee_ext, so returning employee serves as a request to the server to treat the employee_ext external user, for purposes of privilege checking, as the employee local user.名称employee与employee_ext不同，因此返回employee是向服务器发出的请求，要求将employee_ext外部用户视为employee本地用户，以便进行权限检查。

In this case, employee_ext is the proxy user and employee is the proxied user.在这种情况下，employee_ext是代理用户，employee是代理用户。

The server verifies that proxy authentication for employee is possible for the employee_ext user by checking whether employee_ext (the proxy user) has the PROXY privilege for employee (the proxied user). 服务器通过检查employee_ext（代理用户）是否具有employee（被代理用户）的代理权限，验证employee_ext用户是否可以对employee进行代理身份验证。If this privilege has not been granted, an error occurs. Otherwise, employee_ext assumes the privileges of employee. 如果未授予此特权，则会发生错误。否则，employee_ext将享有employee的特权。The server checks statements executed during the client session by employee_ext against the privileges granted to employee. 服务器检查employee_ext在客户端会话期间执行的语句与授予employee的权限。In this case, employee_ext can access tables in the employees database.在这种情况下，employee_ext可以访问employees数据库中的表。

The proxied account, employee, uses the mysql_no_login authentication plugin to prevent clients from using the account to log in directly. 代理帐户employee使用mysql_no_login身份验证插件来防止客户端使用该帐户直接登录。(This assumes that the plugin is installed. For instructions, see Section 6.4.1.8, “No-Login Pluggable Authentication”.) （这假设插件已安装。有关说明，请参阅第6.4.1.8节，“无登录可插拔身份验证”。）For alternative methods of protecting proxied accounts against direct use, see Preventing Direct Login to Proxied Accounts.有关保护代理帐户免受直接使用的替代方法，请参阅防止直接登录代理帐户。

When proxying occurs, the USER() and CURRENT_USER() functions can be used to see the difference between the connecting user (the proxy user) and the account whose privileges apply during the current session (the proxied user). 当代理发生时，可以使用USER()和CURRENT_USER()函数来查看连接用户（代理用户）和在当前会话期间特权适用的帐户（被代理用户）之间的差异。For the example just described, those functions return these values:对于刚才描述的示例，这些函数返回以下值：

mysql> SELECT USER(), CURRENT_USER();
+------------------------+--------------------+
| USER()                 | CURRENT_USER()     |
+------------------------+--------------------+
| employee_ext@localhost | employee@localhost |
+------------------------+--------------------+

In the CREATE USER statement that creates the proxy user account, the IDENTIFIED WITH clause that names the proxy-supporting authentication plugin is optionally followed by an AS 'auth_string' clause specifying a string that the server passes to the plugin when the user connects. 在创建代理用户帐户的CREATE USER语句中，命名支持身份验证插件的代理的IDENTIFIED WITH子句后面可选地跟有AS 'auth_string'子句，该子句指定了用户连接时服务器传递给插件的字符串。If present, the string provides information that helps the plugin determine how to map the proxy (external) client user name to a proxied user name. 如果存在，该字符串提供的信息有助于插件确定如何将代理（外部）客户端用户名映射到代理用户名。It is up to each plugin whether it requires the AS clause. 是否需要AS子句取决于每个插件。If so, the format of the authentication string depends on how the plugin intends to use it. Consult the documentation for a given plugin for information about the authentication string values it accepts.如果是这样，身份验证字符串的格式取决于插件打算如何使用它。有关它接受的身份验证字符串值的信息，请参阅给定插件的文档。

Proxied accounts generally are intended to be used only by means of proxy accounts. That is, clients connect using a proxy account, then are mapped onto and assume the privileges of the appropriate proxied user.代理帐户通常仅用于代理帐户。也就是说，客户端使用代理帐户进行连接，然后映射到相应的代理用户并承担其权限。

There are multiple ways to ensure that a proxied account cannot be used directly:有多种方法可以确保代理帐户不能直接使用：

The PROXY privilege is needed to enable an external user to connect as and have the privileges of another user. 需要PROXY权限才能使外部用户以其他用户的身份连接并拥有其他用户的权限。To grant this privilege, use the GRANT statement. For example:要授予此特权，请使用GRANT语句。例如：

GRANT PROXY ON 'proxied_user' TO 'proxy_user';

The statement creates a row in the mysql.proxies_priv grant table.该语句在mysql.proxies_priv授权表中创建一行。

At connect time, proxy_user must represent a valid externally authenticated MySQL user, and proxied_user must represent a valid locally authenticated user. Otherwise, the connection attempt fails.在连接时，proxy_user必须表示一个有效的外部身份验证的MySQL用户，而proxied_user必须代表一个合法的本地身份验证的用户。否则，连接尝试将失败。

The corresponding REVOKE syntax is:相应的REVOKE语法为：

REVOKE PROXY ON 'proxied_user' FROM 'proxy_user';

MySQL GRANT and REVOKE syntax extensions work as usual. Examples:MySQL GRANT和REVOKE语法扩展正常工作。示例：

-- grant PROXY to multiple accounts
GRANT PROXY ON 'a' TO 'b', 'c', 'd';

-- revoke PROXY from multiple accounts
REVOKE PROXY ON 'a' FROM 'b', 'c', 'd';

-- grant PROXY to an account and enable the account to grant
-- PROXY to the proxied account
GRANT PROXY ON 'a' TO 'd' WITH GRANT OPTION;

-- grant PROXY to default proxy account
GRANT PROXY ON 'a' TO ''@'';

The PROXY privilege can be granted in these cases:在以下情况下可以授予PROXY特权：

The initial root account created during MySQL installation has the PROXY ... WITH GRANT OPTION privilege for ''@'', that is, for all users and all hosts. MySQL安装过程中创建的初始root帐户具有PROXY ... WITH GRANT OPTION权限用于''@''（即所有用户和所有主机）。This enables root to set up proxy users, as well as to delegate to other accounts the authority to set up proxy users. For example, root can do this:这使root用户能够设置代理用户，并将设置代理用户的权限委托给其他帐户。例如，root可以这样做：

CREATE USER 'admin'@'localhost'
  IDENTIFIED BY 'admin_password';
GRANT PROXY
  ON ''@''
  TO 'admin'@'localhost'
  WITH GRANT OPTION;

Those statements create an admin user that can manage all GRANT PROXY mappings. For example, admin can do this:这些语句创建了一个可以管理所有GRANT PROXY映射的admin用户。例如，admin可以这样做：

GRANT PROXY ON sally TO joe;

To specify that some or all users should connect using a given authentication plugin, create a “blank” MySQL account with an empty user name and host name (''@''), associate it with that plugin, and let the plugin return the real authenticated user name (if different from the blank user). 要指定部分或所有用户应使用给定的身份验证插件进行连接，请使用空用户名和主机名（''@''）创建一个“空”MySQL帐户，将其与该插件相关联，并让插件返回真实的身份验证用户名（如果与空用户不同）。Suppose that there exists a plugin named ldap_auth that implements LDAP authentication and maps connecting users onto either a developer or manager account. 假设存在一个名为ldap_auth的插件，它实现了ldap身份验证，并将连接用户映射到开发人员或管理人员帐户上。To set up proxying of users onto these accounts, use the following statements:要设置用户在这些帐户上的代理，请使用以下语句：

-- create default proxy account
CREATE USER ''@''
  IDENTIFIED WITH ldap_auth
  AS 'O=Oracle, OU=MySQL';

-- create proxied accounts; use
-- mysql_no_login plugin to prevent direct login
CREATE USER 'developer'@'localhost'
  IDENTIFIED WITH mysql_no_login;
CREATE USER 'manager'@'localhost'
  IDENTIFIED WITH mysql_no_login;

-- grant to default proxy account the
-- PROXY privilege for proxied accounts
GRANT PROXY
  ON 'manager'@'localhost'
  TO ''@'';
GRANT PROXY
  ON 'developer'@'localhost'
  TO ''@'';

Now assume that a client connects as follows:现在假设客户端连接如下：

shell> mysql --user=myuser --password ...
Enter password: myuser_password

The server does not find myuser defined as a MySQL user, but because there is a blank user account (''@'') that matches the client user name and host name, the server authenticates the client against that account. 服务器找不到定义为MySQL用户的myuser，但由于有一个与客户端用户名和主机名匹配的空白用户帐户（''@''），服务器会根据该帐户对客户端进行身份验证。The server invokes the ldap_auth authentication plugin and passes myuser and myuser_password to it as the user name and password.服务器调用ldap_auth身份验证插件，并将myuser和myuser_password作为用户名和密码传递给它。

If the ldap_auth plugin finds in the LDAP directory that myuser_password is not the correct password for myuser, authentication fails and the server rejects the connection.如果ldap_auth插件在ldap目录中发现myuser_password不是myuser的正确密码，则身份验证失败，服务器拒绝连接。

If the password is correct and ldap_auth finds that myuser is a developer, it returns the user name developer to the MySQL server, rather than myuser. 如果密码正确并且ldap_auth发现myuser是开发人员，它会将用户名developer返回给MySQL服务器，而不是myuser。Returning a user name different from the client user name of myuser signals to the server that it should treat myuser as a proxy. 返回一个与myuser的客户端用户名不同的用户名，向服务器发出信号，表明它应该将myuser视为代理。The server verifies that ''@'' can authenticate as developer (because ''@'' has the PROXY privilege to do so) and accepts the connection. 服务器验证''@''是否可以作为developer进行身份验证（因为''@''具有PROXY权限），并接受连接。The session proceeds with myuser having the privileges of the developer proxied user. 会话继续进行，myuser具有developer代理用户的权限。(These privileges should be set up by the DBA using GRANT statements, not shown.) （这些特权应由DBA使用GRANT语句设置，未显示。）The USER() and CURRENT_USER() functions return these values:USER()和CURRENT_USER()函数返回以下值：

mysql> SELECT USER(), CURRENT_USER();
+------------------+---------------------+
| USER()           | CURRENT_USER()      |
+------------------+---------------------+
| myuser@localhost | developer@localhost |
+------------------+---------------------+

If the plugin instead finds in the LDAP directory that myuser is a manager, it returns manager as the user name and the session proceeds with myuser having the privileges of the manager proxied user.如果插件在LDAP目录中发现myuser是管理员，它将返回manager作为用户名，会话将继续进行，myuser具有管理员代理用户的权限。

mysql> SELECT USER(), CURRENT_USER();
+------------------+-------------------+
| USER()           | CURRENT_USER()    |
+------------------+-------------------+
| myuser@localhost | manager@localhost |
+------------------+-------------------+

For simplicity, external authentication cannot be multilevel: Neither the credentials for developer nor those for manager are taken into account in the preceding example. 为简单起见，外部身份验证不能是多级的：在前面的示例中，developer和manager的凭据都没有考虑在内。However, they are still used if a client tries to connect and authenticate directly as the developer or manager account, which is why those proxied accounts should be protected against direct login (see Preventing Direct Login to Proxied Accounts).但是，如果客户端试图直接以developer或manager帐户进行连接和身份验证，则仍然会使用它们，这就是为什么这些代理帐户应该受到保护，防止直接登录（请参阅防止直接登录到代理帐户）。

If you intend to create a default proxy user, check for other existing “match any user” accounts that take precedence over the default proxy user because they can prevent that user from working as intended.如果您打算创建默认代理用户，请检查其他优先于默认代理用户的现有“匹配任何用户”帐户，因为它们可能会阻止该用户按预期工作。

In the preceding discussion, the default proxy user account has '' in the host part, which matches any host. 在前面的讨论中，默认代理用户帐户在主机部分有''，它与任何主机都匹配。If you set up a default proxy user, take care to also check whether nonproxy accounts exist with the same user part and '%' in the host part, because '%' also matches any host, but has precedence over '' by the rules that the server uses to sort account rows internally (see Section 6.2.6, “Access Control, Stage 1: Connection Verification”).如果您设置了默认代理用户，请注意检查是否存在具有相同用户部分和主机部分中的“%”的非代理帐户，因为'%'也与任何主机匹配，但根据服务器内部用于对帐户行进行排序的规则，'%'优先于''（请参阅第6.2.6节，“访问控制，第1阶段：连接验证”）。

Suppose that a MySQL installation includes these two accounts:假设MySQL安装包括以下两个帐户：

-- create default proxy account
CREATE USER ''@''
  IDENTIFIED WITH some_plugin
  AS 'some_auth_string';
-- create anonymous account
CREATE USER ''@'%'
  IDENTIFIED BY 'anon_user_password';

The first account (''@'') is intended as the default proxy user, used to authenticate connections for users who do not otherwise match a more-specific account. 第一个帐户（''@''）旨在作为默认代理用户，用于对与更特定帐户不匹配的用户的连接进行身份验证。The second account (''@'%') is an anonymous-user account, which might have been created, for example, to enable users without their own account to connect anonymously.第二个帐户（''@'%'）是匿名用户帐户，例如，创建该帐户是为了使没有自己帐户的用户能够匿名连接。

Both accounts have the same user part (''), which matches any user. And each account has a host part that matches any host. 两个帐户具有相同的用户部分（''），该部分与任何用户匹配。每个帐户都有一个与任何主机匹配的主机部分。Nevertheless, there is a priority in account matching for connection attempts because the matching rules sort a host of '%' ahead of ''. 然而，在连接尝试的帐户匹配中有一个优先级，因为匹配规则将'%'的主机排在''之前。For accounts that do not match any more-specific account, the server attempts to authenticate them against ''@'%' (the anonymous user) rather than ''@'' (the default proxy user). 对于与任何其他特定帐户不匹配的帐户，服务器会尝试对其进行身份验证，验证对象是''@'%'（匿名用户），而不是''@''（默认代理用户）。As a result, the default proxy account is never used.因此，默认代理帐户永远不会被使用。

To avoid this problem, use one of the following strategies:要避免此问题，请使用以下策略之一：

Some authentication plugins implement proxy user mapping for themselves (for example, the PAM and Windows authentication plugins). Other authentication plugins do not support proxy users by default. 一些身份验证插件为自己实现了代理用户映射（例如，PAM和Windows身份验证插件）。默认情况下，其他身份验证插件不支持代理用户。Of these, some can request that the MySQL server itself map proxy users according to granted proxy privileges: mysql_native_password, sha256_password. 其中，有些可以请求MySQL服务器本身根据授予的代理权限映射代理用户：mysql_native_password、sha256_password。If the check_proxy_users system variable is enabled, the server performs proxy user mapping for any authentication plugins that make such a request:如果启用了check_proxy_users系统变量，服务器将对发出此类请求的任何身份验证插件执行代理用户映射：

For example, to enable all the preceding capabilities, start the server with these lines in the my.cnf file:例如，要启用上述所有功能，请在my.cnf文件中使用以下行启动服务器：

[mysqld]
check_proxy_users=ON
mysql_native_password_proxy_users=ON
sha256_password_proxy_users=ON

Assuming that the relevant system variables have been enabled, create the proxy user as usual using CREATE USER, then grant it the PROXY privilege to a single other account to be treated as the proxied user. 假设相关系统变量已启用，则使用CREATE USER像往常一样创建代理用户，然后将PROXY权限授予另一个被视为代理用户的帐户。When the server receives a successful connection request for the proxy user, it finds that the user has the PROXY privilege and uses it to determine the proper proxied user.当服务器收到代理用户的成功连接请求时，它会发现该用户具有PROXY权限，并使用该权限来确定正确的代理用户。

-- create proxy account
CREATE USER 'proxy_user'@'localhost'
  IDENTIFIED WITH mysql_native_password
  BY 'password';

-- create proxied account and grant its privileges;
-- use mysql_no_login plugin to prevent direct login
CREATE USER 'proxied_user'@'localhost'
  IDENTIFIED WITH mysql_no_login;
-- grant privileges to proxied account
GRANT ...
  ON ...
  TO 'proxied_user'@'localhost';

-- grant to proxy account the
-- PROXY privilege for proxied account
GRANT PROXY
  ON 'proxied_user'@'localhost'
  TO 'proxy_user'@'localhost';

To use the proxy account, connect to the server using its name and password:要使用代理帐户，请使用其名称和密码连接到服务器：

shell> mysql -u proxy_user -p
Enter password: (enter proxy_user password here)

Authentication succeeds, the server finds that proxy_user has the PROXY privilege for proxied_user, and the session proceeds with proxy_user having the privileges of proxied_user.身份验证成功，服务器发现proxy_user具有proxied_user的代理权限，会话继续进行，proxy_user具有proxied_user的权限。

Proxy user mapping performed by the server is subject to these restrictions:服务器执行的代理用户映射受以下限制：

Two system variables help trace the proxy login process:两个系统变量有助于跟踪代理登录过程：