// Metadata created by nebel
//

[id="create-a-mysql-user-for-cdc_{context}"]
= Creating a MySQL user for {prodname}

You have to define a MySQL user with appropriate permissions on all databases that the {prodname} MySQL connector monitors.

.Prerequisites

* You must have a MySQL server.
* You must know basic SQL commands.

.Procedure

. Create the MySQL user:
[source,SQL]
----
mysql> CREATE USER 'user'@'localhost' IDENTIFIED BY 'password';
----

[start=2]
. Grant the required permissions to the user:

[source,SQL]
----
mysql> GRANT SELECT, RELOAD, SHOW DATABASES, REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'user' IDENTIFIED BY 'password';
----

TIP: See xref:permissions-explained-mysql-connector[permissions explained] for notes on each permission.

IMPORTANT: If using a hosted option such as Amazon RDS or Amazon Aurora that do not allow a *global read lock*, table-level locks are used to create the _consistent snapshot_. In this case, you need to also grant `LOCK_TABLES` permissions to the user that you create. See <<overview-of-how-the-mysql-connector-works>> for more details.

[start=3]
. Finalize the user's permissions:
[source,SQL]
----
mysql> FLUSH PRIVILEGES;
----

== Permissions explained
[[permissions-explained-mysql-connector]]

[cols="3,7"]
|===
|Permission/item |Description

|`SELECT`
a| enables the connector to select rows from tables in databases

NOTE: This is only used when performing a snapshot.

|`RELOAD`
a| enables the connector the use of the `FLUSH` statement to clear or reload internal caches, flush tables, or acquire locks.

NOTE: This is only used when performing a snapshot.

|`SHOW DATABASES`
a| enables the connector to see database names by issuing the `SHOW DATABASE` statement.

NOTE: This is only used when performing a snapshot.

|`REPLICATION SLAVE`
| enables the connector to connect to and read the MySQL server binlog.

|`REPLICATION CLIENT`
a| enables the connector the use of following statements:

* `SHOW MASTER STATUS`
* `SHOW SLAVE STATUS`
* `SHOW BINARY LOGS`

IMPORTANT: This is always required for the connector.

|`ON`
a| Identifies the *database* to which the permission apply. 

|`TO 'user'`
| Specifies the *user* to which the permissions are granted.

|`IDENTIFIED BY 'password'`
| Specifies the *password* for the user.

|===
