CRUD Admins: Why not use MySQL users for auth/acl instead of User/Group tables?

In several frameworks (symfony/Djan开发者_如何学JAVAgo), you have admin generators that usually control access via a User table (which assigns a user to a specified Group table).

I'm curious, why not simply use MySQL's actual users (with select/read/write access already baked in) instead?

Another good reason that hasn't been listed is the fact that MySQL usernames/passwords are stored in clear text in config files. There maybe a vulnerability in your code that allows a user to read a text file, which then would give immediate access to a hacker without having to breaking a password hash. Having a your database remotely accessible is a serious secuirty hazard and is prohibited by PCI-DSS.

Another good reason is that in order to add new accounts or change your password your web application would need ROOT access, which is among the worst things you could do. In many databases (including mysql) this makes it very easy for a hacker to turn a sql injection vulnerability into full remote code execution (like uploading a .php file).

I would presume one reason would be, that many ISPs provide you with only one user account (without extra cost) to your mysql database, and thus, such an aproach wouldn't work as everyone would have identical priviledges.

The magic here being lowest common denominator and easy deployment as far and wide as possible, with minimum requirement in server administration.

I'd imagine most people are a little leery giving their application's MySQL user the ability to create and grant privileges to new MySQL users, particularly in a shared hosting environment. It's not that difficult to handle, it keeps everything within one database table, and you can have any permission you like.