These mysql database tables contain grant information:这些mysql数据库表包含授权信息：

For information about the differences between static and dynamic global privileges, see Static Versus Dynamic Privileges.)有关静态和动态全局权限之间差异的信息，请参阅静态权限和动态权限的对比。）

In MySQL 8.0, grant tables use the InnoDB storage engine and are transactional. Before MySQL 8.0, grant tables used the MyISAM storage engine and were nontransactional. 在MySQL 8.0中，授权表使用InnoDB存储引擎，并且是事务性的。在MySQL 8.0之前，授权表使用MyISAM存储引擎，并且是非事务性的。This change of grant table storage engine enables an accompanying change to the behavior of account-management statements such as CREATE USER or GRANT. 授权表存储引擎的这种更改允许对帐户管理语句（如CREATE USER或GRANT）的行为进行相应的更改。Previously, an account-management statement that named multiple users could succeed for some users and fail for others. Now, each statement is transactional and either succeeds for all named users or rolls back and has no effect if any error occurs.以前，命名多个用户的帐户管理语句可能会对某些用户成功，而对其他用户失败。现在，每条语句都是事务性的，要么对所有命名用户成功，要么回滚，如果发生任何错误，则无效。

Each grant table contains scope columns and privilege columns:每个授权表都包含作用域列和权限列：

In addition, a grant table may contain columns used for purposes other than scope or privilege assessment.此外，授权表可能包含用于作用域或权限评估以外目的的列。

The server uses the grant tables in the following manner:服务器按以下方式使用授权表：

The server reads the contents of the grant tables into memory when it starts. 服务器在启动时将授权表的内容读入内存。You can tell it to reload the tables by issuing a FLUSH PRIVILEGES statement or executing a mysqladmin flush-privileges or mysqladmin reload command. 您可以通过发出FLUSH PRIVILEGES语句或执行mysqladmin flush-privileges或mysqladmin reload命令来告诉它重新加载表。Changes to the grant tables take effect as indicated in Section 6.2.13, “When Privilege Changes Take Effect”.对授权表的更改将按照第6.2.13节，“特权更改生效时”的指示生效。

When you modify an account, it is a good idea to verify that your changes have the intended effect. 修改帐户时，最好验证您的更改是否具有预期效果。To check the privileges for a given account, use the SHOW GRANTS statement. 要检查给定帐户的权限，请使用SHOW GRANTS语句。For example, to determine the privileges that are granted to an account with user name and host name values of bob and pc84.example.com, use this statement:例如，要确定授予用户名和主机名值为bob和pc84.example.com的帐户的权限，请使用以下语句：

SHOW GRANTS FOR 'bob'@'pc84.example.com';

To display nonprivilege properties of an account, use SHOW CREATE USER:要显示帐户的非特权属性，请使用SHOW CREATE USER：

SHOW CREATE USER 'bob'@'pc84.example.com';

The server uses the user and db tables in the mysql database at both the first and second stages of access control (see Section 6.2, “Access Control and Account Management”). The columns in the user and db tables are shown here.服务器在访问控制的第一和第二阶段都使用mysql数据库中的user和db表（参阅第6.2节，“访问控制和帐户管理”）。user表和db表中的列显示在这里。

The user table plugin and authentication_string columns store authentication plugin and credential information.user表插件和authentication_string列存储身份验证插件和凭据信息。

The server uses the plugin named in the plugin column of an account row to authenticate connection attempts for the account.服务器使用帐户行的plugin列中命名的插件来验证帐户的连接尝试。

The plugin column must be nonempty. plugin列必须非空。At startup, and at runtime when FLUSH PRIVILEGES is executed, the server checks user table rows. For any row with an empty plugin column, the server writes a warning to the error log of this form:在启动时和运行时执行FLUSH PRIVILES时，服务器会检查user表行。对于任何plugin列为空的行，服务器都会向此表单的错误日志中写入警告：

[Warning] User entry 'user_name'@'host_name' has an empty plugin
value. The user will be ignored and no one can login with this user
anymore.

To assign a plugin to an account that is missing one, use the ALTER USER statement.要将插件分配给缺少插件的帐户，请使用ALTER USER语句。

The password_expired column permits DBAs to expire account passwords and require users to reset their password. password_expired列允许DBA使帐户密码过期，并要求用户重置密码。The default password_expired value is 'N', but can be set to 'Y' with the ALTER USER statement. 默认的password_expired值为'N'，但可以使用ALTER USER语句将其设置为'Y'。After an account's password has been expired, all operations performed by the account in subsequent connections to the server result in an error until the user issues an ALTER USER statement to establish a new account password.帐户密码过期后，帐户在后续连接到服务器时执行的所有操作都会导致错误，直到用户发出ALTER USER语句以建立新的帐户密码。

password_last_changed is a TIMESTAMP column indicating when the password was last changed. password_last_changed是一个TIMESTAMP列，指示密码上次更改的时间。The value is non-NULL only for accounts that use a MySQL built-in authentication plugin (mysql_native_password, sha256_password, or caching_sha2_password). 仅对于使用MySQL内置身份验证插件（mysql_native_password、sha256_password或caching_sha2_password）的帐户，该值才为非NULL。The value is NULL for other accounts, such as those authenticated using an external authentication system.对于其他帐户，该值为NULL，例如使用外部身份验证系统进行身份验证的帐户。

password_last_changed is updated by the CREATE USER, ALTER USER, and SET PASSWORD statements, and by GRANT statements that create an account or change an account password.password_last_changed由CREATE USER、ALTER USER和SET password语句以及创建帐户或更改帐户密码的GRANT语句更新。

password_lifetime indicates the account password lifetime, in days. password_lifetime表示帐户密码的有效期，以天为单位。If the password is past its lifetime (assessed using the password_last_changed column), the server considers the password expired when clients connect using the account. 如果密码已过其生命周期（使用password_last_changed列评估），则服务器在客户端使用该帐户连接时认为密码已过期。A value of N greater than zero means that the password must be changed every N days. 大于零的N值表示密码必须每N天更改一次。A value of 0 disables automatic password expiration. 值为0时禁用自动密码过期。If the value is NULL (the default), the global expiration policy applies, as defined by the default_password_lifetime system variable.如果该值为NULL（默认值），则应用全局过期策略，如default_password_lifetime系统变量所定义。

account_locked indicates whether the account is locked (see Section 6.2.19, “Account Locking”).account_locked表示帐户是否被锁定（参阅第6.2.19节，“帐户锁定”）。

Password_reuse_history is the value of the PASSWORD HISTORY option for the account, or NULL for the default history.Password_reuse_history是帐户的PASSWORD HISTORY选项的值，默认历史为NULL。

Password_reuse_time is the value of the PASSWORD REUSE INTERVAL option for the account, or NULL for the default interval.Password_reuse_time是帐户的PASSWORD REUSE INTERVAL选项的值，默认间隔为NULL。

Password_require_current (added in MySQL 8.0.13) corresponds to the value of the PASSWORD REQUIRE option for the account, as shown by the following table.Password_require_current（在MySQL 8.0.13中添加）对应于帐户的PASSWORD REQUIRE选项的值，如下表所示。

User_attributes (added in MySQL 8.0.14) is a JSON-format column that stores account attributes not stored in other columns:User_attributes（在MySQL 8.0.14中添加）是一个JSON格式的列，用于存储未存储在其他列中的帐户属性：

If no attributes apply, User_attributes is NULL.如果没有适用的属性，则User_attributes为NULL。

Example: An account that has a secondary password and partially revoked database privileges has additional_password and Restrictions attributes in the column value:示例：具有辅助密码和部分撤销的数据库权限的帐户在列值中具有additional_password和Restrictions属性：

mysql> SELECT User_attributes FROM mysql.User WHERE User = 'u'\G
*************************** 1. row ***************************
User_attributes: {"Restrictions":
                   [{"Database": "mysql", "Privileges": ["SELECT"]}],
                  "additional_password": "hashed_credentials"}

To determine which attributes are present, use the JSON_KEYS() function:要确定存在哪些属性，请使用JSON_KEYS()函数：

SELECT User, Host, JSON_KEYS(User_attributes)
FROM mysql.user WHERE User_attributes IS NOT NULL;

To extract a particular attribute, such as Restrictions, do this:要提取特定属性（如Restrictions），请执行以下操作：

SELECT User, Host, User_attributes->>'$.Restrictions'
FROM mysql.user WHERE User_attributes->>'$.Restrictions' <> '';

During the second stage of access control, the server performs request verification to ensure that each client has sufficient privileges for each request that it issues. 在访问控制的第二阶段，服务器执行请求验证，以确保每个客户端对它发出的每个请求都有足够的权限。In addition to the user and db grant tables, the server may also consult the tables_priv and columns_priv tables for requests that involve tables. 除了user和db授权表外，服务器还可以查询tables_priv和columns_priv表，以获取涉及表的请求。The latter tables provide finer privilege control at the table and column levels. They have the columns shown in the following table.后一种表在表和列级别提供了更精细的权限控制。它们的列如下表所示。

The Timestamp and Grantor columns are set to the current timestamp and the CURRENT_USER value, respectively, but are otherwise unused.Timestamp和Grantor列分别设置为当前时间戳和CURRENT_USER值，但在其他方面未使用。

For verification of requests that involve stored routines, the server may consult the procs_priv table, which has the columns shown in the following table.对于涉及存储例程的请求的验证，服务器可以查阅procs_priv表，该表具有下表所示的列。

The Routine_type column is an ENUM column with values of 'FUNCTION' or 'PROCEDURE' to indicate the type of routine the row refers to. Routine_type列是一个ENUM列，其值为'FUNCTION'或'PROCEDURE'，用于指示该行引用的例程类型。This column enables privileges to be granted separately for a function and a procedure with the same name.此列允许为同名函数和过程分别授予权限。

The Timestamp and Grantor columns are unused.Timestamp和Grantor（委托人）列未使用。

The proxies_priv table records information about proxy accounts. It has these columns:proxies_priv表记录有关代理帐户的信息。它有以下列：

For an account to be able to grant the PROXY privilege to other accounts, it must have a row in the proxies_priv table with With_grant set to 1 and Proxied_host and Proxied_user set to indicate the account or accounts for which the privilege can be granted. 为了使一个帐户能够将代理权限授予其他帐户，它必须在proxies_priv表中有一行，将with_grant设置为1，并将Proxied_host和Proxied_user设置为指示可以授予权限的帐户。For example, the 'root'@'localhost' account created during MySQL installation has a row in the proxies_priv table that enables granting the PROXY privilege for ''@'', that is, for all users and all hosts. 例如，在MySQL安装过程中创建的'root'@'localhost'帐户在proxies_priv表中有一行，可以为''@''授予PROXY权限，即为所有用户和所有主机授予代理权限。This enables root to set up proxy users, as well as to delegate to other accounts the authority to set up proxy users. See Section 6.2.18, “Proxy Users”.这使root用户能够设置代理用户，并将设置代理用户的权限委托给其他帐户。请参阅第6.2.18节，“代理用户”。

The global_grants table lists current assignments of dynamic global privileges to user accounts. The table has these columns:global_grants表列出了用户帐户的动态全局权限的当前分配。该表有以下列：

The default_roles table lists default user roles. It has these columns:default_roles表列出了默认用户角色。它有以下列：

The role_edges table lists edges for role subgraphs. It has these columns:role_edges表列出了角色子图的边。它有以下列：

The password_history table contains information about password changes. It has these columns:password_history表包含有关密码更改的信息。它有以下列：

The password_history table accumulates a sufficient number of nonempty passwords per account to enable MySQL to perform checks against both the account password history length and reuse interval. Automatic pruning of entries that are outside both limits occurs when password-change attempts occur.password_history表为每个帐户累积了足够数量的非空密码，使MySQL能够根据帐户密码历史长度和重用间隔进行检查。当密码更改尝试发生时，会自动修剪超出这两个限制的条目。

If an account is renamed, its entries are renamed to match. If an account is dropped or its authentication plugin is changed, its entries are removed.如果帐户被重命名，则其条目将被重命名以匹配。如果帐户被删除或其身份验证插件被更改，则其条目将被删除。

Scope columns in the grant tables contain strings. The default value for each is the empty string. The following table shows the number of characters permitted in each column.授权表中的作用域列包含字符串。每个列的默认值是空字符串。下表显示了每列中允许的字符数。

Host and Proxied_host values are converted to lowercase before being stored in the grant tables.Host和Proxied_host值在存储到授权表中之前会转换为小写。

For access-checking purposes, comparisons of User, Proxied_user, authentication_string, Db, and Table_name values are case-sensitive. 出于访问检查的目的，User、Proxied_User、authentication_string、Db和Table_name值的比较区分大小写。Comparisons of Host, Proxied_host, Column_name, and Routine_name values are not case-sensitive.Host、Proxied_Host、Column_name和Routing_name值的比较不区分大小写。

The user and db tables list each privilege in a separate column that is declared as ENUM('N','Y') DEFAULT 'N'. user表和db表在单独的列中列出了每个特权，该列声明为ENUM('N','Y') DEFAULT 'N'。In other words, each privilege can be disabled or enabled, with the default being disabled.换句话说，每个特权都可以被禁用或启用，默认设置为禁用。

The tables_priv, columns_priv, and procs_priv tables declare the privilege columns as SET columns. tables_priv、columns_priv和procs_priv表将特权列声明为SET列。Values in these columns can contain any combination of the privileges controlled by the table. Only those privileges listed in the column value are enabled.这些列中的值可以包含表控制的权限的任何组合。仅启用列值中列出的特权。

Only the user and global_grants tables specify administrative privileges, such as RELOAD, SHUTDOWN, and SYSTEM_VARIABLES_ADMIN. 只有user和global_grants表指定了管理权限，如RELOAD、SHUTDOWN和SYSTEM_VARIABLES_ADMIN。Administrative operations are operations on the server itself and are not database-specific, so there is no reason to list these privileges in the other grant tables. 管理操作是服务器本身的操作，不是特定于数据库的，因此没有理由在其他授权表中列出这些权限。Consequently, the server need consult only the user and global_grants tables to determine whether a user can perform an administrative operation.因此，服务器只需要查询user表和global_grants表来确定用户是否可以执行管理操作。

The FILE privilege also is specified only in the user table. FILE权限也仅在user表中指定。It is not an administrative privilege as such, but a user's ability to read or write files on the server host is independent of the database being accessed.这本身不是一种管理权限，但用户在服务器主机上读取或写入文件的能力与所访问的数据库无关。

As of MySQL 8.0.22, to permit concurrent DML and DDL operations on MySQL grant tables, read operations that previously acquired row locks on MySQL grant tables are executed as non-locking reads. Operations that are performed as non-locking reads on MySQL grant tables include:从MySQL 8.0.22开始，为了允许对MySQL授权表进行并发DML和DDL操作，以前在MySQL授权表上获取行锁的读取操作将作为非锁定读取执行。在MySQL授权表上作为非锁定读取执行的操作包括：

Statements that no longer acquire row locks when reading data from grant tables report a warning if executed while using statement-based replication.从授权表读取数据时不再获取行锁的语句在使用基于语句的复制时执行时会报告警告。

When using -binlog_format=mixed, DML operations that read data from grant tables are written to the binary log as row events to make the operations safe for mixed-mode replication.当使用binlog_format=mixed时，从授权表读取数据的DML操作将作为行事件写入二进制日志，以确保混合模式复制的操作安全。

SELECT ... FOR SHARE statements that read data from grant tables report a warning. With the FOR SHARE clause, read locks are not supported on grant tables.从授权表读取数据的SELECT ... FOR SHARE语句报告警告。使用FOR SHARE子句，授权表不支持读取锁。

DML operations that read data from grant tables and are executed using the SERIALIZABLE isolation level report a warning. Read locks that would normally be acquired when using the SERIALIZABLE isolation level are not supported on grant tables.从授权表读取数据并使用SERIALIZABLE隔离级别执行的DML操作会报告警告。授权表不支持使用SERIALIZABLE隔离级别时通常会获取的读取锁。