User with grant permissions cannot grant permissions for new user with and new database

Question

I am using: mysql 5.5.43-0 on ubuntu 14.04.1

I try to create a new admin-user (admin) who is allowed to do the following things:

• a creating new users (dbuser1) with password - (permission "create user" -> works)
• b set password for new created user - (permission "insert/update on table mysql.user" -> works)
• c grant usage to all tables - (GRANT USAGE ON . TO 'dbuser1'@'localhost' IDENTIFIED BY ... -> works)
• d creating new database(db4user1) - (permission "create" -> works)
• e granting all privileges - (GRANT ALL PRIVILEGES ON db4user1.* TO 'dbuser1'@'localhost';) - (permission grant for admin -> does not work)

I had the problem with step e.

Mysql shows the following error: #1044 - Access denied for user 'admin'@'localhost' to database 'db4user1'

Question: Which additional permissions/privileges needs my admin, to do the above mentioned actions and nothing more than that.

I think my admin-user had all permissions to grant a existing user to a new created database...

But it did not work.

Thanks for your help

Stephan

CREATE USER 'dbuser1'@'localhost' IDENTIFIED BY 'password1234'
SET PASSWORD FOR 'dbuser1'@'localhost' = PASSWORD('password5678')
GRANT USAGE ON *.* TO 'dbuser1'@'localhost' IDENTIFIED BY 'password5678' WITH MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0;
CREATE DATABASE IF NOT EXISTS `db4user1`; 
GRANT ALL PRIVILEGES ON `db4user1`.* TO 'dbuser1'@'localhost'; 

-> #1044 - Access denied for user 'admin'@'localhost' to database 'db4user1'

Answer 1

It's look like to me that you want to create just another admin like default root, so you can use simple syntax like that:

GRANT ALL ON *.* TO admin@localhost IDENTIFIED BY 'passwd5678' WITH GRANT OPTION;

Answer 2

The minimal requirement to give sufficient rights to a given user (admin here) to be able to grant all privileges on a given DB (db4user1 here) is :

GRANT DROP ,
REFERENCES ,
INDEX ,
ALTER ,
CREATE TEMPORARY TABLES ,
LOCK TABLES ,
CREATE VIEW ,
EVENT,
TRIGGER,
SHOW VIEW ,
CREATE ROUTINE,
ALTER ROUTINE,
EXECUTE ON  `db4user1` . * TO  'admin'@'localhost' WITH GRANT OPTION ;

---

Almost everyting...except :

• Create (structure scope)
• Select,Insert,Update,Delete (Data scope)

---

From here, using admin user :

mysql> GRANT ALL PRIVILEGES ON db4user1.* TO 'dbuser1'@'localhost';
Query OK, 0 rows affected (0.00 sec)

---

I admit i didn't find any docs for this. I have, in the past, spend lot of time testing all possibilities proceeding by elimination, one by one...