Should I understand that user is already created?
https://mariadb.com/kb/en/authentication-from-mariadb-104/

via

CREATE USER mysql@localhost IDENTIFIED VIA unix_socket OR mysql_native_password USING 'invalid'

If yes, just close this ticket (perhaps, the error message is not very clear...).

You can always check whether the user exists by running SHOW CREATE USER <username> or SHOW GRANTS FOR <username> or by selecting directly from privilege tables.

I'm keeping the bug report open for a better error message.

Same for DROP USER, RENAME USER, ALTER USER, may be more.
Same with roles.

What is the expectation of more descriptive error message here? Maybe to append at the end [user,role] doesn't exist like:

ERROR 1396 (HY000): Operation <[create user,drop user, rename user, alter user, drop role]> failed for 'mysql'@'localhost' . <[user,role] doesn't exist.>

anel I think that's right. But for `create

` -> ` .. [user, role] already exists`.

Patch: 420f846a1513ab528 danblack for review please.

Ultimately user error messages should appear in sql/share/errmsg-utf8.txt like ER_CANNOT_USER is. So ideally there should be ER_CANNOT_(USER,ROLE)_(MISSING,EXISTS) in order for the translation to come up with a consistent error message across languages.

elenst, serg, what are the rules regarding the changing/addition of user error messages in GA releases? Given 97f7d4a9b4da77cb79699a0ea873e4a0e628e8a3 (MDEV-22726) 031c695b8c865e5eb6c4c09ced404ae08f98430f both added (not changed) a message in a GA release is it actually allowed?

note sql/wsrep_var.cc perversely uses ER_CANNOT_USER in its messages and needs to be taken into account for corrections.

Rules are we cannot change message numbers in GA versions. And any error message added in 10.2 will cause a shift in numbers in 10.3+.

1. Hacking in the message via %s for usernames is wrong, if the user would switch to German error messages it'd produce

ERROR HY000: Operation CREATE USER schlug fehl für 'pstest_xyz'@'localhost',user already exists

2. errors can happen for many different reasons, not all of them are "user already exists"

3. even if the reason is that the user already exists, we very intentionally don't want to say it. CREATE USER is not a way to probe user list to detect what user accounts exist.

Per discussion with danblack, changed to 10.7 in order to introduce the new message in errmsg-utf8.txt.

Point 3 above, this is an information leak prevention. The acl is already checked that the user can do these functions so we're not giving anything way for free. Given CREATE USER IF NOT EXISTS and DROP USER IF EXISTS have specific warnings about a users existence/non-existance it would be odd for CREATE USER not to have a specific error of the same text.

So reusing these

as they already exist for the warnings?

Then we add 4 -

?

Not sure in which direction to go?