Bug #76560 CREATE USER binlog events include new ACCOUNT keyword

• Submitted: 1 Apr 2015 14:34
• Modified: 14 Apr 2015 20:01
• Reporter: Todd Farmer (OCA)
• Status: Closed
• Category: MySQL Server: Security: Privileges
• Severity: S2 (Serious)
• Version: 5.7.7
• OS: Any
• CPU Architecture: Any

[1 Apr 2015 14:34] Todd Farmer

Description:
MySQL 5.7 introduces support for new syntax in the CREATE USER statement.  All CREATE USER statements are rewritten into a format which includes the new ACCOUNT keyword when written to the binlog:

# at 757
#150401  8:23:58 server id 1  end_log_pos 943 CRC32 0x91699720  Query   thread_i
d=4     exec_time=0     error_code=0
use `mysql`/*!*/;
SET TIMESTAMP=1427898238/*!*/;
CREATE USER 't1'@'localhost' IDENTIFIED BY PASSWORD '*C720D8C695B25DC4CAAD629BA2
6CCE9FB0CCA5C0' ACCOUNT UNLOCK
/*!*/;

This happens regardless of how log_backward_compatible_user_definition is set (above binlog output was created while set to ON).  This will break replication to earlier MySQL servers, and undermines the purpose of log_backward_compatible_user_definition.

How to repeat:
* Start mysqld with binary logging
* Set log_backward_compatible_user_definition=ON
* Create user using pre-5.7 compatible syntax\
* View mysqlbinlog output

Suggested fix:
Ensure CREATE USER statements which are compatible with pre-5.7 syntax are written to the binary log in similar fashion.

[14 Apr 2015 20:01] Paul DuBois

Noted in 5.7.8, 5.8.0 changelogs.

CREATE USER events written to the binary log included the new ACCOUNT
syntax even with log_backward_compatible_user_definition enabled.