# Database Users and Roles
+ Supported authentication plugins
  + `mysql_native_password`
  + `caching_sha2_password`
+ Role based access is also supported  (TiDB Dedicated only)
```
// Example of Using Native Password:
CREATE USER example_user1 ~!@IDENTIFIED BY@!~ '<password>';

// Example of Using Caching SHA2 Password:
CREATE USER example_user2 ~!@IDENTIFIED WITH CACHING_SHA2_PASSWORD BY@!~ '<password>';

// Example of Creating a Role:
CREATE ROLE r_test1;

// Example of Granting a Role to a User:
GRANT r_test1 TO example_user1;
SET DEFAULT ROLE 'r_test1' TO example_user1;
```
------------------------------------------------------------------------------
A MySQL USER is a database user that can to connect to the database and issue commands. A MySQL ROLE is a set of privileges that can be given, really GRANTED, to a user. You can grant permissions directly to USERS, but many times it makes more sense to group these privileges onto ROLEs.

TiDB Cloud can use two authentication plugins: `mysql_native_password` and `caching_sha2_password`.

Roles are stored in the `mysql.user` table and the host name part of the role name (if omitted) defaults to `'%'`.

You can use `SHOW GRANTS` or `SHOW GRANTS FOR CURRENT_USER()` to check the current user's privileges. `SHOW GRANTS` and `SHOW GRANTS FOR CURRENT_USER()` are different in the following aspects:
-` SHOW GRANTS` shows the privilege of the enabled role for the current user.
- `SHOW GRANTS FOR CURRENT_USER()` does not show the enabled role's privilege.

For more detailed information about user authentication and role based access control, please refer to the following course: `https://www.pingcap.com/education/course-tidb-administration/`.