#### 17.1.2.3 Creating a User for Replication

 Each replica connects to the source using a MySQL user name and password, so there must be a user account on the source that the replica can use to connect. The user name is specified by the `SOURCE_USER` | `MASTER_USER` option of the [`CHANGE REPLICATION SOURCE TO`](change-replication-source-to.html) statement (from MySQL 8.0.23) or [`CHANGE MASTER TO`](change-master-to.html) statement (before MySQL 8.0.23) when you set up a replica. Any account can be used for this operation, providing it has been granted the [`REPLICATION SLAVE`](privileges-provided.html#priv_replication-slave) privilege. You can choose to create a different account for each replica, or connect to the source using the same account for each replica.

 Although you do not have to create an account specifically for replication, you should be aware that the replication user name and password are stored in plain text in the replica's connection metadata repository `mysql.slave_master_info` (see [Section 17.2.4.2, “Replication Metadata Repositories”](replica-logs-status.html)). Therefore, you may want to create a separate account that has privileges only for the replication process, to minimize the possibility of compromise to other accounts.

 To create a new account, use [`CREATE USER`](create-user.html). To grant this account the privileges required for replication, use the [`GRANT`](grant.html) statement. If you create an account solely for the purposes of replication, that account needs only the [`REPLICATION SLAVE`](privileges-provided.html#priv_replication-slave) privilege. For example, to set up a new user, `repl`, that can connect for replication from any host within the `example.com` domain, issue these statements on the source:

```
mysql> CREATE USER 'repl'@'%.example.com' IDENTIFIED BY 'password';
mysql> GRANT REPLICATION SLAVE ON *.* TO 'repl'@'%.example.com';
```

 See [Section 13.7.1, “Account Management Statements”](account-management-statements.html), for more information on statements for manipulation of user accounts.

Important

 To connect to the source using a user account that authenticates with the `caching_sha2_password` plugin, you must either set up a secure connection as described in [Section 17.3.1, “Setting Up Replication to Use Encrypted Connections”](replication-solutions-encrypted-connections.html), or enable the unencrypted connection to support password exchange using an RSA key pair. The `caching_sha2_password` authentication plugin is the default for new users created from MySQL 8.0 (for details, see [Section 6.4.1.2, “Caching SHA-2 Pluggable Authentication”](caching-sha2-pluggable-authentication.html)). If the user account that you create or use for replication (as specified by the `MASTER_USER` option) uses this authentication plugin, and you are not using a secure connection, you must enable RSA key pair-based password exchange for a successful connection.

