# Database Users and Roles Authorization (TiDB Dedicated)

+ Syntax: **`GRANT {privilege_list} ON {object_scope} TO {grantee_list} [WITH GRANT OPTION]`**
+ **`{object_scope}`**
  + Global level: **`*.*`**
  + Database/Schema level: **`{schema_name}.*`**
  + Table level : **`{schema_name}.{table_name}`**
+ **`WITH GRANT OPTION`**: Give the user the permission to grant others the specific privilege
+ **`{privilege_list}`** can be: **`ALL`**, **`ALTER`**, **`CREATE`**, **`DELETE`**, **`USAGE`**, etc
+ **`{grantee_list}`** can be users or roles
```
~!@-- Global level - Read all tables:@!~
GRANT SELECT ON *.* TO user1 WITH GRANT OPTION; ~!@-- grant@!~
REVOKE SELECT ON *.* FROM user1; ~!@-- revoke@!~

~!@-- Database level - Read all tables in the `universe` database:@!~
GRANT SELECT ON universe.* TO user1; ~!@-- grant@!~
REVOKE SELECT ON universe.* FROM user1; ~!@-- revoke@!~

~!@-- Table level - Read `universe.planets` table:@!~
GRANT SELECT ON universe.planets TO user1; ~!@-- grant@!~
REVOKE SELECT ON universe.planets FROM user1; ~!@-- revoke@!~
```
------------------------------------------------------------------------------
`GRANT` statement allocates privileges to `TiDB` users or roles. The privilege system in `TiDB` follows `MySQL`, where credentials are assigned based on a database/table pattern. Executing this statement requires the `GRANT OPTION` privilege and all privileges you allocate.

Similar to `MySQL`, the `USAGE` privilege denotes the ability to log into a `TiDB` server.
- Column level privileges are not currently supported.
- Similar to `MySQL`, when the `NO_AUTO_CREATE_USER sql mode` is not present, the `GRANT` statement will automatically create a new user with an empty password when a user does not exist Removing this `SQL MODE` (it is enabled by default) presents a security risk.

For detail about the `syntax` and the `{privilege_list}`, please refer to `https://docs.pingcap.com/tidb/stable/sql-statement-grant-privileges`.

For more detailed information, please refer to the following link: `https://www.pingcap.com/education/course-tidb-administration/`.