---
title: "Managing MySQL semi-sync users"
sidebar_label: "User management"
sidebar_position: 6
description: "How to create a user, change their password, configure MySQL semi-sync database access, and work with privileges"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import MoreVerticalIcon from '@selectel/docux/icons/more-vertical'

# Managing MySQL semi-sync users

Users are created to access databases in a MySQL semi-sync cluster.

Only the cluster itself is available to users—cluster nodes cannot be accessed as they are located on the Selectel side. By default, all users in a cluster have the same permissions.

Access to a single MySQL semi-sync database can be granted to multiple users.

## Create a user \{#create-user}

1. In the [Dashboard](https://my.selectel.ru/vpc/default/dbaas/), on the top menu click **Products** and select **Managed Databases**.
2. Open the **Active** tab.
3. Open the database cluster page → **Users** tab.
4. Click **Create User**.
5. Enter a username and password. Save the password—it will not be stored in the Dashboard.
6. Click **Save**.

## Change a user password \{#change-user-password}

After a cluster is created, the user password can be changed. Do not forget to update the password in your application.

1. In the [Dashboard](https://my.selectel.ru/vpc/default/dbaas/), on the top menu click **Products** and select **Managed Databases**.
2. Open the **Active** tab.
3. Open the cluster page → **Users** tab.
4. In the <MoreVerticalIcon /> user menu, select **Change password**.
5. Enter or generate a new password and save the changes.

## Configure database access \{#configure-access-to-database}

### Grant access to a user \{#grant-user-access}

Access to a single MySQL semi-sync database can be granted to multiple users.

1. In the [Dashboard](https://my.selectel.ru/vpc/default/dbaas/), on the top menu, click **Products** and select **Managed Databases**.
2. Open the **Active** tab.
3. Open the database cluster page → **Databases** tab → database page.
4. In the **Have access** block, click **Add** and select a user.

The user can only connect to the database (`CONNECT`) and cannot perform object operations. To grant the user access to objects, [grant them the necessary privileges](/managed-databases/mysql-semi-sync/manage-users.mdx#grant-privileges).

### Revoke user access \{#revoke-access-for-user}

1. In the [Dashboard](https://my.selectel.ru/vpc/default/dbaas/), on the top menu, click **Products** and select **Managed Databases**.
2. Open the **Active** tab.
3. Open the database cluster page → **Databases** tab → database page.
4. In the **Have access** block, remove the user.

## Configure user privileges \{#configure-user-privileges}

### Grant privileges \{#grant-privileges}

You can grant database and table privileges to users using the [GRANT](https://dev.mysql.com/doc/refman/8.0/en/grant.html) command. Privileges can be as follows: `SELECT`, `INSERT`, `DELETE`, `USAGE` and others.

Example of granting read access (`SELECT`) to the `table` table in the `database` database to the `user`:

```bash
GRANT SELECT ON table TO user;
```

Example of granting read access (`SELECT`) to the `database` database to the `user`:

```bash
GRANT SELECT ON database.* TO user;
```

### Create a user with read-only permissions \{#create-read-only-user}

1. [Create a user](#create-user).
2. [Grant the user access](/managed-databases/mysql-semi-sync/manage-users.mdx#grant-user-access) to the database.
3. Create another user who will have only read-only (read-only) privileges.
4. [Connect to the database](/managed-databases/mysql-semi-sync/connect-to-cluster.mdx) using the first user.
5. Grant read-only privileges to the database to the second user:

   ```bash
   REVOKE ALL PRIVILEGES ON <database_name>.* FROM '<username>'@'%';
   GRANT SELECT ON <database_name>.* TO '<username>'@'%';
   ```

   Specify:

   * `<database_name>` — database name;
   * `<username>` — the name of the user who will be granted read-only rights.

### Revoke privileges \{#revoke-privileges}

You can revoke user privileges using the [REVOKE](https://dev.mysql.com/doc/refman/8.0/en/revoke.html) command.

Example of revoking a privilege from user `user` on table `table` and database `database`:

```bash
REVOKE SELECT ON table FROM user;
REVOKE SELECT ON database.* FROM user;
```

<Formbricks />