--- a/clients/Tests/MAL-signatures-hge.test
+++ b/clients/Tests/MAL-signatures-hge.test
@@ -33309,11 +33309,6 @@ pattern batsql.ntile(X_0:bat[:any], X_1:
 SQLntile;
 return the groups divided as equally as possible
 batsql
-password
-pattern batsql.password(X_0:bat[:str]):bat[:str] 
-db_password_wrap;
-Return password hash of user
-batsql
 percent_rank
 pattern batsql.percent_rank(X_0:bat[:any_1], X_1:any_2, X_2:any_3):bat[:dbl] 
 SQLpercent_rank;
@@ -43789,26 +43784,11 @@ pattern capi.subeval_aggr(X_0:ptr, X_1:b
 CUDFevalAggr;
 grouped aggregates through CUDF
 clients
-addUser
-unsafe pattern clients.addUser(X_0:str, X_1:str):oid 
-CLTaddUser;
-Allow user with password access to the given scenarios
-clients
 backendsum
 command clients.backendsum(X_0:str):str 
 CLTbackendsum;
 Return hex string representation of the currently used hash of the given string
 clients
-changePassword
-unsafe pattern clients.changePassword(X_0:str, X_1:str):void 
-CLTchangePassword;
-Change the password for the current user
-clients
-changeUsername
-unsafe pattern clients.changeUsername(X_0:str, X_1:str):void 
-CLTchangeUsername;
-Change the username of the user into the new string
-clients
 checkPermission
 pattern clients.checkPermission(X_0:str, X_1:str):void 
 CLTcheckPermission;
@@ -43849,11 +43829,6 @@ pattern clients.getUsername():str
 CLTgetUsername;
 Return the username of the currently logged in user
 clients
-getUsers
-pattern clients.getUsers() (X_0:bat[:oid], X_1:bat[:str]) 
-CLTgetUsers;
-return a BAT with user id and one with name available in the system
-clients
 getprofile
 pattern clients.getprofile() (X_0:str, X_1:int, X_2:int, X_3:int, X_4:int) 
 CLTgetProfile;
@@ -43874,11 +43849,6 @@ unsafe pattern clients.quit(X_0:int):voi
 CLTquit;
 Terminate the session for a single client using a soft error.@It is the privilege of the console user.
 clients
-removeUser
-unsafe pattern clients.removeUser(X_0:str):void 
-CLTremoveUser;
-Remove the given user from the system
-clients
 ripemd160sum
 command clients.ripemd160sum(X_0:str):str 
 CLTripemd160sum;
@@ -43889,11 +43859,6 @@ unsafe pattern clients.setListing(X_0:in
 CLTsetListing;
 Turn on/off echo of MAL instructions:@1 - echo input,@2 - show mal instruction,@4 - show details of type resolutoin, @8 - show binding information.
 clients
-setPassword
-unsafe pattern clients.setPassword(X_0:str, X_1:str):void 
-CLTsetPassword;
-Set the password for the given user
-clients
 setQryTimeoutMicro
 unsafe pattern clients.setQryTimeoutMicro(X_0:lng):void 
 CLTqueryTimeoutMicro;
@@ -48434,11 +48399,6 @@ command sql.date_trunc(X_0:str, X_1:time
 date_trunc;
 Truncate a timestamp to (millennium, century,decade,year,quarter,month,week,day,hour,minute,second, milliseconds,microseconds)
 sql
-db_users
-pattern sql.db_users():bat[:str] 
-db_users_wrap;
-return table of users with sql scenario
-sql
 delete
 unsafe pattern sql.delete(X_0:int, X_1:str, X_2:str, X_3:any):int 
 mvc_delete_wrap;
@@ -48751,7 +48711,7 @@ getPipeCatalog;
 sql
 password
 pattern sql.password(X_0:str):str 
-db_password_wrap;
+SQLuser_password;
 Return password hash of user
 sql
 percent_rank
@@ -49425,7 +49385,7 @@ SQLalter_table;
 Catalog operation alter_table
 sqlcatalog
 alter_user
-pattern sqlcatalog.alter_user(X_0:str, X_1:str, X_2:int, X_3:str, X_4:str, X_5:str):void 
+pattern sqlcatalog.alter_user(X_0:str, X_1:str, X_2:int, X_3:str, X_4:str, X_5:str, X_6:str):void 
 SQLalter_user;
 Catalog operation alter_user
 sqlcatalog
@@ -49470,7 +49430,7 @@ SQLcreate_type;
 Catalog operation create_type
 sqlcatalog
 create_user
-pattern sqlcatalog.create_user(X_0:str, X_1:str, X_2:int, X_3:str, X_4:str, X_5:str):void 
+pattern sqlcatalog.create_user(X_0:str, X_1:str, X_2:int, X_3:str, X_4:str, X_5:str, X_6:lng, X_7:int, X_8:str, X_9:str):void 
 SQLcreate_user;
 Catalog operation create_user
 sqlcatalog

--- a/clients/Tests/MAL-signatures.test
+++ b/clients/Tests/MAL-signatures.test
@@ -24449,11 +24449,6 @@ pattern batsql.ntile(X_0:bat[:any], X_1:
 SQLntile;
 return the groups divided as equally as possible
 batsql
-password
-pattern batsql.password(X_0:bat[:str]):bat[:str] 
-db_password_wrap;
-Return password hash of user
-batsql
 percent_rank
 pattern batsql.percent_rank(X_0:bat[:any_1], X_1:any_2, X_2:any_3):bat[:dbl] 
 SQLpercent_rank;
@@ -32284,26 +32279,11 @@ pattern capi.subeval_aggr(X_0:ptr, X_1:b
 CUDFevalAggr;
 grouped aggregates through CUDF
 clients
-addUser
-unsafe pattern clients.addUser(X_0:str, X_1:str):oid 
-CLTaddUser;
-Allow user with password access to the given scenarios
-clients
 backendsum
 command clients.backendsum(X_0:str):str 
 CLTbackendsum;
 Return hex string representation of the currently used hash of the given string
 clients
-changePassword
-unsafe pattern clients.changePassword(X_0:str, X_1:str):void 
-CLTchangePassword;
-Change the password for the current user
-clients
-changeUsername
-unsafe pattern clients.changeUsername(X_0:str, X_1:str):void 
-CLTchangeUsername;
-Change the username of the user into the new string
-clients
 checkPermission
 pattern clients.checkPermission(X_0:str, X_1:str):void 
 CLTcheckPermission;
@@ -32344,11 +32324,6 @@ pattern clients.getUsername():str
 CLTgetUsername;
 Return the username of the currently logged in user
 clients
-getUsers
-pattern clients.getUsers() (X_0:bat[:oid], X_1:bat[:str]) 
-CLTgetUsers;
-return a BAT with user id and one with name available in the system
-clients
 getprofile
 pattern clients.getprofile() (X_0:str, X_1:int, X_2:int, X_3:int, X_4:int) 
 CLTgetProfile;
@@ -32369,11 +32344,6 @@ unsafe pattern clients.quit(X_0:int):voi
 CLTquit;
 Terminate the session for a single client using a soft error.@It is the privilege of the console user.
 clients
-removeUser
-unsafe pattern clients.removeUser(X_0:str):void 
-CLTremoveUser;
-Remove the given user from the system
-clients
 ripemd160sum
 command clients.ripemd160sum(X_0:str):str 
 CLTripemd160sum;
@@ -32384,11 +32354,6 @@ unsafe pattern clients.setListing(X_0:in
 CLTsetListing;
 Turn on/off echo of MAL instructions:@1 - echo input,@2 - show mal instruction,@4 - show details of type resolutoin, @8 - show binding information.
 clients
-setPassword
-unsafe pattern clients.setPassword(X_0:str, X_1:str):void 
-CLTsetPassword;
-Set the password for the given user
-clients
 setQryTimeoutMicro
 unsafe pattern clients.setQryTimeoutMicro(X_0:lng):void 
 CLTqueryTimeoutMicro;
@@ -36834,11 +36799,6 @@ command sql.date_trunc(X_0:str, X_1:time
 date_trunc;
 Truncate a timestamp to (millennium, century,decade,year,quarter,month,week,day,hour,minute,second, milliseconds,microseconds)
 sql
-db_users
-pattern sql.db_users():bat[:str] 
-db_users_wrap;
-return table of users with sql scenario
-sql
 delete
 unsafe pattern sql.delete(X_0:int, X_1:str, X_2:str, X_3:any):int 
 mvc_delete_wrap;
@@ -37151,7 +37111,7 @@ getPipeCatalog;
 sql
 password
 pattern sql.password(X_0:str):str 
-db_password_wrap;
+SQLuser_password;
 Return password hash of user
 sql
 percent_rank
@@ -37745,7 +37705,7 @@ SQLalter_table;
 Catalog operation alter_table
 sqlcatalog
 alter_user
-pattern sqlcatalog.alter_user(X_0:str, X_1:str, X_2:int, X_3:str, X_4:str, X_5:str):void 
+pattern sqlcatalog.alter_user(X_0:str, X_1:str, X_2:int, X_3:str, X_4:str, X_5:str, X_6:str):void 
 SQLalter_user;
 Catalog operation alter_user
 sqlcatalog
@@ -37790,7 +37750,7 @@ SQLcreate_type;
 Catalog operation create_type
 sqlcatalog
 create_user
-pattern sqlcatalog.create_user(X_0:str, X_1:str, X_2:int, X_3:str, X_4:str, X_5:str):void 
+pattern sqlcatalog.create_user(X_0:str, X_1:str, X_2:int, X_3:str, X_4:str, X_5:str, X_6:lng, X_7:int, X_8:str, X_9:str):void 
 SQLcreate_user;
 Catalog operation create_user
 sqlcatalog

--- a/clients/Tests/exports.py
+++ b/clients/Tests/exports.py
@@ -5,3 +5,4 @@ output = MonetDBtesting.listexports.list
 stable = open('exports.stable.out').readlines()
 for line in difflib.unified_diff(stable, output):
     sys.stderr.write(line)
+

--- a/clients/Tests/exports.stable.out
+++ b/clients/Tests/exports.stable.out
@@ -725,21 +725,22 @@ int mo_system_config(opt **Set, int setl
 const char *wsaerror(int);
 
 # monetdb5
+str AUTHGeneratePasswordHash(str *res, const char *value);
+str AUTHRegisterGetPasswordHandler(get_user_password_handler callback);
+str AUTHRegisterGetUserNameHandler(get_user_name_handler callback);
+str AUTHRegisterGetUserOIDHandler(get_user_oid_handler callback);
 str AUTHaddRemoteTableCredentials(const char *local_table, const char *localuser, const char *uri, const char *remoteuser, const char *pass, bool pw_encrypted);
-str AUTHaddUser(oid *ret, Client c, const char *user, const char *pass);
-str AUTHchangePassword(Client c, const char *oldpass, const char *passwd);
-str AUTHchangeUsername(Client c, const char *olduser, const char *newuser);
 str AUTHcheckCredentials(oid *ret, Client c, const char *user, const char *passwd, const char *challenge, const char *algo);
+str AUTHcypherValue(str *ret, const char *value);
+str AUTHdecypherValue(str *ret, const char *value);
 str AUTHdeleteRemoteTableCredentials(const char *local_table);
 str AUTHgetPasswordHash(str *ret, Client c, const char *username);
 str AUTHgetRemoteTableCredentials(const char *local_table, str *uri, str *username, str *password);
 str AUTHgetUsername(str *ret, Client c);
-str AUTHgetUsers(BAT **ret1, BAT **ret2, Client c);
 str AUTHinitTables(const char *passwd);
-str AUTHremoveUser(Client c, const char *username);
-str AUTHresolveUser(str *ret, oid uid);
-str AUTHsetPassword(Client c, const char *username, const char *passwd);
+str AUTHrequireAdmin(Client c);
 str AUTHunlockVault(const char *password);
+str AUTHverifyPassword(const char *passwd);
 str BATinfo(BAT **key, BAT **val, const bat bid);
 str BKCmirror(bat *ret, const bat *bid);
 str BKCnewBAT(bat *res, const int *tt, const BUN *cap, role_t role);

--- a/monetdb5/mal/Tests/All
+++ b/monetdb5/mal/Tests/All
@@ -170,7 +170,6 @@ tst802
 tst804
 tst810
 tst819
-tst830
 tst840
 tst850
 tst866

deleted file mode 100644
--- a/monetdb5/mal/Tests/tst830.maltest
+++ /dev/null
@@ -1,61 +0,0 @@
-statement ok
-function foo();
-	pw := clients.backendsum("Pmonetdb");
-	id := clients.addUser("monetdb", pw);
-catch MALException:str;
-	io.printf("0: %s\n",MALException);
-exit MALException;
-	# should print 1@0 or something
-	id := clients.addUser("test", pw);
-	io.print(id);
-	# this should work also
-	id := clients.addUser("checkpoint", pw);
-	io.print(id);
-	# do a simple listing of users known
-	(u,n) := clients.getUsers();
-	io.print(u,n);
-	# should work, we're the admin here
-	clients.removeUser("checkpoint");
-	# do a simple listing of users known
-	(u,n) := clients.getUsers();
-	io.print(u,n);
-	# forcefully set the password of the user test
-	clients.setPassword("test", pw);
-	# now try to set the password for ourself, should fail
-	clients.setPassword("monetdb", pw);
-catch InvalidCredentialsException:str;
-	io.printf("1: %s\n", InvalidCredentialsException);
-exit InvalidCredentialsException;
-#
-#	# change our own password,
-#	mypw := clients.backendsum("monetdb");
-#	clients.changePassword(mypw, pw);
-#	# try it again, should fail...
-#	clients.changePassword(mypw, pw);
-#catch InvalidCredentialsException:str;
-#	io.printf("2: %s\n",InvalidCredentialsException);
-#	InvalidCredentialsException:= nil:str;
-#exit InvalidCredentialsException;
-	# all should fail
-	clients.checkPermission("monetdb","Pmonetdb");
-catch InvalidCredentialsException:str;
-	io.printf("3: %s\n",InvalidCredentialsException);
-	InvalidCredentialsException:= nil:str;
-exit InvalidCredentialsException;
-	clients.checkPermission("monetdb","x");
-catch InvalidCredentialsException:str;
-	io.printf("4: %s\n",InvalidCredentialsException);
-	InvalidCredentialsException:= nil:str;
-exit InvalidCredentialsException;
-	clients.checkPermission("x","Pmonetdb");
-catch InvalidCredentialsException:str;
-	io.printf("5: %s\n",InvalidCredentialsException);
-	InvalidCredentialsException:= nil:str;
-exit InvalidCredentialsException;
-end;
-
-query T rowsort
-user.foo();
-----
-5: InvalidCredentialsException:checkCredentials:invalid credentials for user 'x'
-

--- a/monetdb5/mal/mal_authorize.c
+++ b/monetdb5/mal/mal_authorize.c
@@ -24,20 +24,15 @@
 #include "mal_private.h"
 #include "mcrypt.h"
 #include "msabaoth.h"
+#include "mal_scenario.h"
+#include "mal_interpreter.h"
 
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif
 
-static str AUTHdecypherValue(str *ret, const char *value);
-static str AUTHcypherValue(str *ret, const char *value);
-static str AUTHverifyPassword(const char *passwd);
 static BUN lookupRemoteTableKey(const char *key);
 
-static BAT *user = NULL;
-static BAT *pass = NULL;
-static BAT *duser = NULL;
-
 /* Remote table bats */
 static BAT *rt_key = NULL;
 static BAT *rt_uri = NULL;
@@ -47,115 +42,50 @@ static BAT *rt_deleted = NULL;
 /* yep, the vault key is just stored in memory */
 static str vaultKey = NULL;
 static str master_password = NULL;
+static AUTHCallbackCntx authCallbackCntx = {
+	.get_user_name = NULL,
+	.get_user_password = NULL,
+	.get_user_oid = NULL
+};
 
 void AUTHreset(void)
 {
-	//if( user) BBPunfix(user->batCacheid);
-	user = NULL;
-	//if( pass) BBPunfix(pass->batCacheid);
-	pass = NULL;
-	//if( duser) BBPunfix(duser->batCacheid);
-	duser = NULL;
 	if (vaultKey != NULL)
 		GDKfree(vaultKey);
 	vaultKey = NULL;
 }
 
-static BUN
-AUTHfindUser(const char *username)
-{
-	BATiter cni = bat_iterator(user);
-	BUN p;
-
-	if (BAThash(user) == GDK_SUCCEED) {
-		MT_rwlock_rdlock(&user->thashlock);
-		HASHloop_str(cni, user->thash, p, username) {
-			oid pos = p;
-			if (BUNfnd(duser, &pos) == BUN_NONE) {
-				MT_rwlock_rdunlock(&user->thashlock);
-				bat_iterator_end(&cni);
-				return p;
-			}
-		}
-		MT_rwlock_rdunlock(&user->thashlock);
-	}
-	bat_iterator_end(&cni);
-	return BUN_NONE;
-}
-
 /**
- * Requires the current client to be the admin user thread.  If not the case,
+ * Requires the current client to be the admin user thread. If not the case,
  * this function returns an InvalidCredentialsException.
  */
-static str
+str
 AUTHrequireAdmin(Client cntxt) {
-	oid id;
-
-	if (cntxt == NULL)
-		return(MAL_SUCCEED);
-	id = cntxt->user;
-
-	if (id != MAL_ADMIN) {
-		str user = NULL;
-		str tmp;
-
-		rethrow("requireAdmin", tmp, AUTHresolveUser(&user, id));
-		tmp = createException(INVCRED, "requireAdmin", INVCRED_ACCESS_DENIED " '%s'", user);
-		GDKfree(user);
-		return tmp;
-	}
-
-	return(MAL_SUCCEED);
-}
+	assert(cntxt);
 
-/**
- * Requires the current client to be the admin user, or the user with
- * the given username.  If not the case, this function returns an
- * InvalidCredentialsException.
- */
-static str
-AUTHrequireAdminOrUser(Client cntxt, const char *username) {
-	oid id = cntxt->user;
-	str user = NULL;
-	str tmp = MAL_SUCCEED;
-
-	/* MAL_ADMIN then all is well */
-	if (id == MAL_ADMIN)
-		return(MAL_SUCCEED);
-
-	rethrow("requireAdminOrUser", tmp, AUTHresolveUser(&user, id));
-	if (username == NULL || strcmp(username, user) != 0)
-		tmp = createException(INVCRED, "requireAdminOrUser",
-							  INVCRED_ACCESS_DENIED " '%s'", user);
-
-	GDKfree(user);
-	return tmp;
+	if (cntxt->user != MAL_ADMIN)
+		throw(MAL, "AUTHrequireAdmin", INVCRED_ACCESS_DENIED);
+	return(MAL_SUCCEED);
 }
 
 static void
 AUTHcommit(void)
 {
-	bat blist[9];
+	bat blist[6];
 
 	blist[0] = 0;
 
-	assert(user);
-	blist[1] = user->batCacheid;
-	assert(pass);
-	blist[2] = pass->batCacheid;
-	assert(duser);
-	blist[3] = duser->batCacheid;
 	assert(rt_key);
-	blist[4] = rt_key->batCacheid;
+	blist[1] = rt_key->batCacheid;
 	assert(rt_uri);
-	blist[5] = rt_uri->batCacheid;
+	blist[2] = rt_uri->batCacheid;
 	assert(rt_remoteuser);
-	blist[6] = rt_remoteuser->batCacheid;
+	blist[3] = rt_remoteuser->batCacheid;
 	assert(rt_hashedpwd);
-	blist[7] = rt_hashedpwd->batCacheid;
+	blist[4] = rt_hashedpwd->batCacheid;
 	assert(rt_deleted);
-	blist[8] = rt_deleted->batCacheid;
-	TMsubcommit_list(blist, NULL, 9, getBBPlogno(), getBBPtransid());
+	blist[5] = rt_deleted->batCacheid;
+	TMsubcommit_list(blist, NULL, 6, getBBPlogno(), getBBPtransid());
 }
 
 /*
@@ -173,79 +103,11 @@ AUTHinitTables(const char *passwd) {
 	int isNew = 1;
 	str msg = MAL_SUCCEED;
 
-	/* skip loading if already loaded */
-	if (user != NULL && pass != NULL)
-		return(MAL_SUCCEED);
-
-	/* if one is not NULL here, something is seriously screwed up */
-	assert (user == NULL);
-	assert (pass == NULL);
-
-	/* load/create users BAT */
-	bid = BBPindex("M5system_auth_user");
-	if (!bid) {
-		user = COLnew(0, TYPE_str, 256, PERSISTENT);
-		if (user == NULL)
-			throw(MAL, "initTables.user", SQLSTATE(HY013) MAL_MALLOC_FAIL " user table");
-
-		if (BATkey(user, true) != GDK_SUCCEED ||
-			BBPrename(user, "M5system_auth_user") != 0 ||
-			BATmode(user, false) != GDK_SUCCEED) {
-			throw(MAL, "initTables.user", GDK_EXCEPTION);
-		}
-	} else {
-		int dbg = GDKdebug;
-		/* don't check this bat since we'll fix it below */
-		GDKdebug &= ~CHECKMASK;
-		user = BATdescriptor(bid);
-		GDKdebug = dbg;
-		if (user == NULL)
-			throw(MAL, "initTables.user", SQLSTATE(HY002) RUNTIME_OBJECT_MISSING);
-		isNew = 0;
-	}
-	assert(user);
+	(void) passwd;
 
-	/* load/create password BAT */
-	bid = BBPindex("M5system_auth_passwd_v2");
-	if (!bid) {
-		pass = COLnew(0, TYPE_str, 256, PERSISTENT);
-		if (pass == NULL)
-			throw(MAL, "initTables.passwd", SQLSTATE(HY013) MAL_MALLOC_FAIL " password table");
-
-		if (BBPrename(pass, "M5system_auth_passwd_v2") != 0 ||
-			BATmode(pass, false) != GDK_SUCCEED) {
-			throw(MAL, "initTables.user", GDK_EXCEPTION);
-		}
-	} else {
-		int dbg = GDKdebug;
-		/* don't check this bat since we'll fix it below */
-		GDKdebug &= ~CHECKMASK;
-		pass = BATdescriptor(bid);
-		GDKdebug = dbg;
-		if (pass == NULL)
-			throw(MAL, "initTables.passwd", SQLSTATE(HY002) RUNTIME_OBJECT_MISSING);
-		isNew = 0;
-	}
-	assert(pass);
-
-	/* load/create password BAT */
-	bid = BBPindex("M5system_auth_deleted");
-	if (!bid) {
-		duser = COLnew(0, TYPE_oid, 256, PERSISTENT);
-		if (duser == NULL)
-			throw(MAL, "initTables.duser", SQLSTATE(HY013) MAL_MALLOC_FAIL " deleted user table");
-
-		if (BBPrename(duser, "M5system_auth_deleted") != 0 ||
-			BATmode(duser, false) != GDK_SUCCEED) {
-			throw(MAL, "initTables.user", GDK_EXCEPTION);
-		}
-	} else {
-		duser = BATdescriptor(bid);
-		if (duser == NULL)
-			throw(MAL, "initTables.duser", SQLSTATE(HY002) RUNTIME_OBJECT_MISSING);
-		isNew = 0;
-	}
-	assert(duser);
+	/* skip loading if already loaded */
+	if (rt_key != NULL && rt_deleted != NULL)
+		return(MAL_SUCCEED);
 
 	/* Remote table authorization table.
 	 *
@@ -374,30 +236,6 @@ AUTHinitTables(const char *passwd) {
 	}
 	assert(rt_deleted);
 
-	if (isNew == 1) {
-		/* insert the monetdb/monetdb administrator account on a
-		 * complete fresh and new auth tables system */
-		char *pw;
-		oid uid;
-
-		if (passwd == NULL)
-			passwd = "monetdb";	/* default password */
-		pw = mcrypt_BackendSum(passwd, strlen(passwd));
-		if(!pw) {
-			if (!GDKembedded())
-				throw(MAL, "initTables", SQLSTATE(42000) "Crypt backend hash not found");
-			else
-				pw = strdup(passwd);
-		}
-		msg = AUTHaddUser(&uid, NULL, "monetdb", pw);
-		free(pw);
-		if (msg)
-			return msg;
-		if (uid != MAL_ADMIN)
-			throw(MAL, "initTables", INTERNAL_AUTHORIZATION " while they were just created!");
-		/* normally, we'd commit here, but it's done already in AUTHaddUser */
-	}
-
 	if (!GDKinmemory(0) && !GDKembedded()) {
 		free(master_password);
 		master_password = NULL;
@@ -428,21 +266,21 @@ AUTHcheckCredentials(
 	str tmp;
 	str pwd = NULL;
 	str hash = NULL;
-	BUN p;
-	BATiter passi;
-
-	if (cntxt)
-		rethrow("checkCredentials", tmp, AUTHrequireAdminOrUser(cntxt, username));
-	assert(user);
-	assert(pass);
+	oid p = oid_nil;
+	str passValue = NULL;
 
 	if (strNil(username))
 		throw(INVCRED, "checkCredentials", "invalid credentials for unknown user");
 
-	p = AUTHfindUser(username);
-	if (p == BUN_NONE) {
-		/* DO NOT reveal that the user doesn't exist here! */
-		throw(INVCRED, "checkCredentials", INVCRED_INVALID_USER " '%s'", username);
+	// is this check needed?
+	//if (cntxt)
+	//	rethrow("checkCredentials", tmp, AUTHrequireAdminOrUser(cntxt, username));
+
+	if (authCallbackCntx.get_user_oid && cntxt) {
+		if ((p = authCallbackCntx.get_user_oid(cntxt, username)) == oid_nil) {
+			/* DO NOT reveal that the user doesn't exist here! */
+			throw(INVCRED, "checkCredentials", INVCRED_INVALID_USER " '%s'", username);
+		}
 	}
 
 	/* a NULL password is impossible (since we should be dealing with
@@ -453,13 +291,18 @@ AUTHcheckCredentials(
 		throw(INVCRED, "checkCredentials", INVCRED_INVALID_USER " '%s'", username);
 	}
 
+	// load password from users tbl
+	if (authCallbackCntx.get_user_password && cntxt)
+		passValue = authCallbackCntx.get_user_password(cntxt, username);
+
+	if (strNil(passValue)) {
+		throw(INVCRED, "checkCredentials", INVCRED_INVALID_USER " '%s'", username);
+	}
+
 	/* find the corresponding password to the user */
-	passi = bat_iterator(pass);
-	tmp = (str)BUNtvar(passi, p);
-	assert (tmp != NULL);
 	/* decypher the password (we lose the original tmp here) */
-	tmp = AUTHdecypherValue(&pwd, tmp);
-	bat_iterator_end(&passi);
+	tmp = AUTHdecypherValue(&pwd, passValue);
+	GDKfree(passValue);
 	if (tmp)
 		return tmp;
 
@@ -500,343 +343,32 @@ AUTHcheckCredentials(
 }
 
 /**
- * Adds the given user with password to the administration.  The
- * return value of this function is the user id of the added user.
- */
-str
-AUTHaddUser(oid *uid, Client cntxt, const char *username, const char *passwd)
-{
-	BUN p;
-	str tmp;
-	str hash = NULL;
-
-	assert(user);
-	assert(pass);
-	if (BATcount(user))
-		rethrow("addUser", tmp, AUTHrequireAdmin(cntxt));
-
-	/* some pre-condition checks */
-	if (strNil(username))
-		throw(ILLARG, "addUser", "username should not be nil");
-	if (strNil(passwd))
-		throw(ILLARG, "addUser", "password should not be nil");
-	rethrow("addUser", tmp, AUTHverifyPassword(passwd));
-
-	/* ensure that the username is not already there */
-	p = AUTHfindUser(username);
-	if (p != BUN_NONE)
-		throw(MAL, "addUser", "user '%s' already exists", username);
-
-	/* we assume the BATs are still aligned */
-	if (!GDKembedded()) {
-		rethrow("addUser", tmp, AUTHcypherValue(&hash, passwd));
-	} else {
-		if (!(hash = GDKstrdup("hash")))
-			throw(MAL, "addUser", SQLSTATE(HY013) MAL_MALLOC_FAIL);
-	}
-	/* needs force, as SQL makes a view over user */
-	if (BUNappend(user, username, true) != GDK_SUCCEED ||
-		BUNappend(pass, hash, true) != GDK_SUCCEED) {
-		GDKfree(hash);
-		throw(MAL, "addUser", SQLSTATE(HY013) MAL_MALLOC_FAIL);
-	}
-	GDKfree(hash);
-	/* retrieve the oid of the just inserted user */
-	p = AUTHfindUser(username);
-
-	/* make the stuff persistent */
-	if (!GDKembedded())
-		AUTHcommit();
-
-	*uid = p;
-	return(MAL_SUCCEED);
-}
-
-/**
- * Removes the given user from the administration.
- */
-str
-AUTHremoveUser(Client cntxt, const char *username)
-{
-	BUN p;
-	oid id;
-	str tmp;
-
-	rethrow("removeUser", tmp, AUTHrequireAdmin(cntxt));
-	assert(user);
-	assert(pass);
-
-	/* pre-condition check */
-	if (strNil(username))
-		throw(ILLARG, "removeUser", "username should not be nil");
-
-	/* ensure that the username exists */
-	p = AUTHfindUser(username);
-	if (p == BUN_NONE)
-		throw(MAL, "removeUser", "no such user: '%s'", username);
-	id = p;
-
-	/* find the name of the administrator and see if it equals username */
-	if (id == cntxt->user)
-		throw(MAL, "removeUser", "cannot remove yourself");
-
-	/* now, we got the oid, start removing the related tuples */
-	if (BUNappend(duser, &id, true) != GDK_SUCCEED)
-		throw(MAL, "removeUser", SQLSTATE(HY013) MAL_MALLOC_FAIL);
-
-	/* make the stuff persistent */
-	AUTHcommit();
-	return(MAL_SUCCEED);
-}
-
-/**
- * Changes the username of the user indicated by olduser into newuser.
- * If the newuser is already in use, an exception is thrown and nothing
- * is modified.
- */
-str
-AUTHchangeUsername(Client cntxt, const char *olduser, const char *newuser)
-{
-	BUN p, q;
-	str tmp;
-
-	rethrow("addUser", tmp, AUTHrequireAdminOrUser(cntxt, olduser));
-
-	/* precondition checks */
-	if (strNil(olduser))
-		throw(ILLARG, "changeUsername", "old username should not be nil");
-	if (strNil(newuser))
-		throw(ILLARG, "changeUsername", "new username should not be nil");
-
-	/* see if the olduser is valid */
-	p = AUTHfindUser(olduser);
-	if (p == BUN_NONE)
-		throw(MAL, "changeUsername", "user '%s' does not exist", olduser);
-	/* ... and if the newuser is not there yet */
-	q = AUTHfindUser(newuser);
-	if (q != BUN_NONE)
-		throw(MAL, "changeUsername", "user '%s' already exists", newuser);
-
-	/* ok, just do it! (with force, because sql makes view over it) */
-	assert(user->hseqbase == 0);
-	if (BUNreplace(user, p, newuser, true) != GDK_SUCCEED)
-		throw(MAL, "changeUsername", GDK_EXCEPTION);
-	AUTHcommit();
-	return(MAL_SUCCEED);
-}
-
-/**
- * Changes the password of the current user to the given password.  The
- * old password must match the one stored before the new password is
- * set.
- */
-str
-AUTHchangePassword(Client cntxt, const char *oldpass, const char *passwd)
-{
-	BUN p;
-	str tmp= NULL;
-	str hash= NULL;
-	oid id;
-	BATiter passi;
-	str msg= MAL_SUCCEED;
-
-	/* precondition checks */
-	if (strNil(oldpass))
-		throw(ILLARG, "changePassword", "old password should not be nil");
-	if (strNil(passwd))
-		throw(ILLARG, "changePassword", "password should not be nil");
-	rethrow("changePassword", tmp, AUTHverifyPassword(passwd));
-
-	/* check the old password */
-	id = cntxt->user;
-	p = id;
-	assert(p != BUN_NONE);
-	passi = bat_iterator(pass);
-	tmp = BUNtvar(passi, p);
-	assert (tmp != NULL);
-	/* decypher the password */
-	msg = AUTHdecypherValue(&hash, tmp);
-	bat_iterator_end(&passi);
-	if (msg)
-		return msg;
-	if (strcmp(hash, oldpass) != 0){
-		GDKfree(hash);
-		throw(INVCRED, "changePassword", "Access denied");
-	}
-
-	GDKfree(hash);
-	/* cypher the password */
-	msg = AUTHcypherValue(&hash, passwd);
-	if (msg)
-		return msg;
-
-	/* ok, just overwrite the password field for this user */
-	assert(id == p);
-	assert(pass->hseqbase == 0);
-	if (BUNreplace(pass, p, hash, true) != GDK_SUCCEED) {
-		GDKfree(hash);
-		throw(INVCRED, "changePassword", GDK_EXCEPTION);
-	}
-	GDKfree(hash);
-	AUTHcommit();
-	return(MAL_SUCCEED);
-}
-
-/**
- * Changes the password of the given user to the given password.  This
- * function can be used by the administrator to reset the password for a
- * user.  Note that for the administrator to change its own password, it
- * cannot use this function for obvious reasons.
- */
-str
-AUTHsetPassword(Client cntxt, const char *username, const char *passwd)
-{
-	BUN p;
-	str tmp;
-	str hash = NULL;
-	oid id;
-	BATiter useri;
-
-	rethrow("setPassword", tmp, AUTHrequireAdmin(cntxt));
-
-	/* precondition checks */
-	if (strNil(username))
-		throw(ILLARG, "setPassword", "username should not be nil");
-	if (strNil(passwd))
-		throw(ILLARG, "setPassword", "password should not be nil");
-	rethrow("setPassword", tmp, AUTHverifyPassword(passwd));
-
-	id = cntxt->user;
-	/* find the name of the administrator and see if it equals username */
-	p = id;
-	assert (p != BUN_NONE);
-	useri = bat_iterator(user);
-	tmp = BUNtvar(useri, p);
-	assert (tmp != NULL);
-	if (strcmp(tmp, username) == 0) {
-		bat_iterator_end(&useri);
-		throw(INVCRED, "setPassword", "The administrator cannot set its own password, use changePassword instead");
-	}
-
-	/* see if the user is valid */
-	p = AUTHfindUser(username);
-	if (p == BUN_NONE) {
-		bat_iterator_end(&useri);
-		throw(MAL, "setPassword", "no such user '%s'", username);
-	}
-	id = p;
-
-	/* cypher the password */
-	tmp = AUTHcypherValue(&hash, passwd);
-	bat_iterator_end(&useri);
-	if (tmp)
-		return tmp;
-	/* ok, just overwrite the password field for this user */
-	assert (p != BUN_NONE);
-	assert(id == p);
-	assert(pass->hseqbase == 0);
-	if (BUNreplace(pass, p, hash, true) != GDK_SUCCEED) {
-		GDKfree(hash);
-		throw(MAL, "setPassword", GDK_EXCEPTION);
-	}
-	GDKfree(hash);
-	AUTHcommit();
-	return(MAL_SUCCEED);
-}
-
-/**
- * Resolves the given user id and returns the associated username.  If
- * the id is invalid, an exception is thrown.  The given pointer to the
- * username char buffer should be NULL if this function is supposed to
- * allocate memory for it.  If the pointer is pointing to an already
- * allocated buffer, it is supposed to be of size BUFSIZ.
- */
-str
-AUTHresolveUser(str *username, oid uid)
-{
-	BUN p;
-	BATiter useri;
-
-	if (is_oid_nil(uid) || (p = (BUN) uid) >= BATcount(user))
-		throw(ILLARG, "resolveUser", "userid should not be nil");
-
-	assert(username != NULL);
-	useri = bat_iterator(user);
-	*username = GDKstrdup((str)(BUNtvar(useri, p)));
-	bat_iterator_end(&useri);
-	if (*username == NULL)
-		throw(MAL, "resolveUser", SQLSTATE(HY013) MAL_MALLOC_FAIL);
-	return(MAL_SUCCEED);
-}
-
-/**
  * Returns the username of the given client.
  */
 str
 AUTHgetUsername(str *username, Client cntxt)
 {
-	BUN p;
-	BATiter useri;
-
-	p = (BUN) cntxt->user;
-
-	/* If you ask for a username using a client struct, and that user
-	 * doesn't exist, you seriously screwed up somehow.  If this
-	 * happens, it may be a security breach/attempt, and hence
-	 * terminating the entire system seems like the right thing to do to
-	 * me. */
-	assert(p < BATcount(user));
-
-	useri = bat_iterator(user);
-	*username = GDKstrdup( BUNtvar(useri, p));
-	bat_iterator_end(&useri);
-	if (*username == NULL)
-		throw(MAL, "getUsername", SQLSTATE(HY013) MAL_MALLOC_FAIL);
+	if (cntxt->username) {
+		*username = GDKstrdup(cntxt->username);
+		return(MAL_SUCCEED);
+	}
+	if (authCallbackCntx.get_user_name && cntxt) {
+		if ((*username = authCallbackCntx.get_user_name(cntxt)) == NULL) {
+			throw(MAL, "getUsername", INVCRED_WRONG_ID);
+		}
+	}
 	return(MAL_SUCCEED);
 }
 
 /**
- * Returns a BAT with user names in the tail, and user ids in the head.
- */
-str
-AUTHgetUsers(BAT **ret1, BAT **ret2, Client cntxt)
-{
-	BAT *bn;
-	str tmp;
-
-	rethrow("getUsers", tmp, AUTHrequireAdmin(cntxt));
-
-	*ret1 = BATdense(user->hseqbase, user->hseqbase, BATcount(user));
-	if (*ret1 == NULL)
-		throw(MAL, "getUsers", SQLSTATE(HY013) MAL_MALLOC_FAIL);
-	if (BATcount(duser)) {
-		bn = BATdiff(*ret1, duser, NULL, NULL, false, false, BUN_NONE);
-		BBPunfix((*ret1)->batCacheid);
-		*ret2 = BATproject(bn, user);
-		*ret1 = bn;
-	} else {
-		*ret2 = COLcopy(user, user->ttype, false, TRANSIENT);
-	}
-	if (*ret1 == NULL || *ret2 == NULL) {
-		if (*ret1)
-			BBPunfix((*ret1)->batCacheid);
-		if (*ret2)
-			BBPunfix((*ret2)->batCacheid);
-		throw(MAL, "getUsers", SQLSTATE(HY013) MAL_MALLOC_FAIL);
-	}
-	return(NULL);
-}
-
-/**
  * Returns the password hash as used by the backend for the given
- * username.  Throws an exception if called by a non-superuser.
+ * username. Throws an exception if called by a non-superuser.
  */
 str
 AUTHgetPasswordHash(str *ret, Client cntxt, const char *username)
 {
-	BUN p;
-	BATiter i;
 	str tmp;
+	str msg;
 	str passwd = NULL;
 
 	rethrow("getPasswordHash", tmp, AUTHrequireAdmin(cntxt));
@@ -844,20 +376,24 @@ AUTHgetPasswordHash(str *ret, Client cnt
 	if (strNil(username))
 		throw(ILLARG, "getPasswordHash", "username should not be nil");
 
-	p = AUTHfindUser(username);
-	if (p == BUN_NONE)
+	// load password from users tbl
+	if (authCallbackCntx.get_user_password && cntxt)
+		tmp = authCallbackCntx.get_user_password(cntxt, username);
+
+	if (strNil(tmp)) {
 		throw(MAL, "getPasswordHash", "user '%s' does not exist", username);
-	i = bat_iterator(pass);
-	tmp = BUNtvar(i, p);
-	assert (tmp != NULL);
+	}
 	/* decypher the password */
-	tmp = AUTHdecypherValue(&passwd, tmp);
-	bat_iterator_end(&i);
-	if (tmp)
-		return tmp;
+	if ((msg = AUTHdecypherValue(&passwd, tmp)) != MAL_SUCCEED) {
+		GDKfree(tmp);
+		return msg;
+	}
+
+	if(tmp)
+		GDKfree(tmp);
 
 	*ret = passwd;
-	return(NULL);
+	return(MAL_SUCCEED);
 }
 
 
@@ -895,7 +431,7 @@ AUTHunlockVault(const char *password)
  * an exception.  The ret string is GDKmalloced, and should be GDKfreed
  * by the caller.
  */
-static str
+str
 AUTHdecypherValue(str *ret, const char *value)
 {
 	/* Cyphering and decyphering can be done using many algorithms.
@@ -949,7 +485,7 @@ AUTHdecypherValue(str *ret, const char *
  * fails or detects an invalid password, it might throw an exception.
  * The ret string is GDKmalloced, and should be GDKfreed by the caller.
  */
-static str
+str
 AUTHcypherValue(str *ret, const char *value)
 {
 	/* this is the XOR cypher implementation */
@@ -993,7 +529,7 @@ AUTHcypherValue(str *ret, const char *va
  */
 #define concat(x,y)	x##y
 #define digestlength(h)	concat(h, _DIGEST_LENGTH)
-static str
+str
 AUTHverifyPassword(const char *passwd)
 {
 	const char *p = passwd;
@@ -1172,8 +708,9 @@ AUTHaddRemoteTableCredentials(const char
 	}
 
 	if (pass == NULL) {
-		/* NOTE: Is having the client == NULL safe? */
-		if((output = AUTHgetPasswordHash(&pwhash, NULL, local_user)) != MAL_SUCCEED)
+		// init client to have SQL callback hooks
+		Client c = getClientContext();
+		if((output = AUTHgetPasswordHash(&pwhash, c, local_user)) != MAL_SUCCEED)
 			return output;
 	}
 	else {
@@ -1261,3 +798,33 @@ AUTHdeleteRemoteTableCredentials(const c
 	AUTHcommit();
 	return(MAL_SUCCEED);
 }
+
+
+str
+AUTHRegisterGetUserNameHandler(get_user_name_handler callback)
+{
+	authCallbackCntx.get_user_name = callback;
+	return MAL_SUCCEED;
+}
+
+
+str
+AUTHRegisterGetPasswordHandler(get_user_password_handler callback)
+{
+	authCallbackCntx.get_user_password = callback;
+	return MAL_SUCCEED;
+}
+
+
+str
+AUTHRegisterGetUserOIDHandler(get_user_oid_handler callback)
+{
+	authCallbackCntx.get_user_oid = callback;
+	return MAL_SUCCEED;
+}
+
+str
+AUTHGeneratePasswordHash(str *res, const char *value)
+{
+	return AUTHcypherValue(res, value);
+}

--- a/monetdb5/mal/mal_authorize.h
+++ b/monetdb5/mal/mal_authorize.h
@@ -17,14 +17,7 @@
 #define MAL_ADMIN (oid) 0
 
 mal_export str AUTHcheckCredentials(oid *ret, Client c, const char *user, const char *passwd, const char *challenge, const char *algo);
-mal_export str AUTHaddUser(oid *ret, Client c, const char *user, const char *pass);
-mal_export str AUTHremoveUser(Client c, const char *username);
-mal_export str AUTHchangeUsername(Client c, const char *olduser, const char *newuser);
-mal_export str AUTHchangePassword(Client c, const char *oldpass, const char *passwd);
-mal_export str AUTHsetPassword(Client c, const char *username, const char *passwd);
-mal_export str AUTHresolveUser(str *ret, oid uid);
 mal_export str AUTHgetUsername(str *ret, Client c);
-mal_export str AUTHgetUsers(BAT **ret1, BAT **ret2, Client c);
 mal_export str AUTHgetPasswordHash(str *ret, Client c, const char *username);
 
 mal_export str AUTHinitTables(const char *passwd);
@@ -41,9 +34,28 @@ mal_export str AUTHdeleteRemoteTableCred
  * (the vault) by supplying the master password which is the key for the
  * cypher algorithm used to store the data.  The BAT will never
  * contain the plain hashes, as they will be decyphered on the fly when
- * needed.  A locked vault means noone can log into the system, hence, the
+ * needed.  A locked vault means no one can log into the system, hence, the
  * vault needs to be unlocked as part of the server startup ritual.
  */
 mal_export str AUTHunlockVault(const char *password);
+mal_export str AUTHverifyPassword(const char *passwd);
+mal_export str AUTHdecypherValue(str *ret, const char *value);
+mal_export str AUTHcypherValue(str *ret, const char *value);
+mal_export str AUTHrequireAdmin(Client c);
+
+typedef str (*get_user_name_handler)(Client c);
+typedef str (*get_user_password_handler)(Client c, const char *user);
+typedef oid (*get_user_oid_handler)(Client c, const char *user);
+
+typedef struct AUTHCallbackCntx {
+	get_user_name_handler get_user_name;
+	get_user_password_handler get_user_password;
+	get_user_oid_handler get_user_oid;
+} AUTHCallbackCntx;
+
+mal_export str AUTHRegisterGetUserNameHandler(get_user_name_handler callback);
+mal_export str AUTHRegisterGetPasswordHandler(get_user_password_handler callback);
+mal_export str AUTHRegisterGetUserOIDHandler(get_user_oid_handler callback);
+mal_export str AUTHGeneratePasswordHash(str *res, const char *value);
 
 #endif /* _MAL_AUTHORIZE_H */

--- a/monetdb5/mal/mal_client.c
+++ b/monetdb5/mal/mal_client.c
@@ -272,12 +272,6 @@ MCinitClientRecord(Client c, oid user, b
 	c->sqlprofiler = 0;
 	c->wlc_kind = 0;
 	c->wlc = NULL;
-	/* no authentication in embedded mode */
-	if (!GDKembedded()) {
-		str msg = AUTHgetUsername(&c->username, c);
-		if (msg)				/* shouldn't happen */
-			freeException(msg);
-	}
 	c->blocksize = BLOCK;
 	c->protocol = PROTOCOL_9;
 

--- a/monetdb5/mal/mal_runtime.c
+++ b/monetdb5/mal/mal_runtime.c
@@ -74,6 +74,10 @@ static
 void
 updateUserStats(Client cntxt, MalBlkPtr mb, lng ticks, time_t started, time_t finished, str query)
 {
+	// don't keep stats for context without username
+ 	if (cntxt->username == NULL)
+ 		return;
+
 	size_t idx = getUSRstatsIdx(mb, cntxt->user);
 
 	if (idx == (size_t) -1) {
@@ -81,7 +85,12 @@ updateUserStats(Client cntxt, MalBlkPtr 
 		return;
 	}
 
-	if (USRstats[idx].username == NULL) {
+	if (USRstats[idx].username == NULL || USRstats[idx].user != cntxt->user || strcmp(USRstats[idx].username, cntxt->username) != 0) {
+		if (USRstats[idx].username)
+			GDKfree(USRstats[idx].username);
+		if (USRstats[idx].maxquery)
+			GDKfree(USRstats[idx].maxquery);
+		clearUSRstats(idx);
 		USRstats[idx].user = cntxt->user;
 		USRstats[idx].username = GDKstrdup(cntxt->username);
 	}
@@ -91,8 +100,9 @@ updateUserStats(Client cntxt, MalBlkPtr 
 		USRstats[idx].started = started;
 		USRstats[idx].finished = finished;
 		USRstats[idx].maxticks = ticks;
-		GDKfree(USRstats[idx].maxquery);
-		USRstats[idx].maxquery= GDKstrdup(query);
+		if (USRstats[idx].maxquery)
+			GDKfree(USRstats[idx].maxquery);
+		USRstats[idx].maxquery = GDKstrdup(query);
 	}
 }
 

--- a/monetdb5/mal/mal_session.c
+++ b/monetdb5/mal/mal_session.c
@@ -50,6 +50,7 @@ malBootstrap(char *modules[], bool embed
 		MCfreeClient(c);
 		return msg;
 	}
+
 	if( MCinitClientThread(c) < 0){
 		MCfreeClient(c);
 		throw(MAL, "malBootstrap", "Failed to create client thread");
@@ -171,6 +172,32 @@ is_exiting(void *data)
 
 static str MSserveClient(Client cntxt);
 
+
+static inline void
+cleanUpScheduleClient(Client c, Scenario s, bstream *fin, stream *fout, str *command, str *err)
+{
+	if(c) {
+		if (s) {
+			str msg = NULL;
+			if((msg = s->exitClientCmd(c)) != MAL_SUCCEED) {
+				mnstr_printf(fout, "!%s\n", msg);
+				freeException(msg);
+			}
+		}
+		MCfreeClient(c);
+	}
+	exit_streams(fin, fout);
+	if (command) {
+		GDKfree(*command);
+		*command = NULL;
+	}
+	if (err) {
+		freeException(*err);
+		*err = NULL;
+	}
+}
+
+
 void
 MSscheduleClient(str command, str challenge, bstream *fin, stream *fout, protocol_version protocol, size_t blocksize)
 {
@@ -279,17 +306,30 @@ MSscheduleClient(str command, str challe
 		sabdb *stats = NULL;
 
 		if (!GDKembedded()) {
+			if ((c = MCinitClient(MAL_ADMIN, NULL, NULL)) == NULL) {
+				if ( MCshutdowninprogress())
+					mnstr_printf(fout, "!system shutdown in progress, please try again later\n");
+				else
+					mnstr_printf(fout, "!maximum concurrent client limit reached "
+									   "(%d), please try again later\n", MAL_MAXCLIENTS);
+				cleanUpScheduleClient(NULL, NULL, fin, fout, &command, NULL);
+				return;
+			}
+			Scenario scenario = findScenario("sql");
+			if ((msg = scenario->initClientCmd(c)) != MAL_SUCCEED) {
+				mnstr_printf(fout, "!%s\n", msg);
+				cleanUpScheduleClient(c, scenario, fin, fout, &command, &msg);
+				return;
+			}
 			/* access control: verify the credentials supplied by the user,
 			 * no need to check for database stuff, because that is done per
 			 * database itself (one gets a redirect) */
-			err = AUTHcheckCredentials(&uid, NULL, user, passwd, challenge, algo);
-			if (err != MAL_SUCCEED) {
-				mnstr_printf(fout, "!%s\n", err);
-				exit_streams(fin, fout);
-				freeException(err);
-				GDKfree(command);
+			if ((msg = AUTHcheckCredentials(&uid, c, user, passwd, challenge, algo)) != MAL_SUCCEED) {
+				mnstr_printf(fout, "!%s\n", msg);
+				cleanUpScheduleClient(c, scenario, fin, fout, &command, &msg);
 				return;
 			}
+			cleanUpScheduleClient(c, scenario, NULL, NULL, NULL, NULL);
 		}
 
 
@@ -370,6 +410,9 @@ MSscheduleClient(str command, str challe
 		return;
 	}
 
+	// at this point username should have being verified
+	c->username = GDKstrdup(user);
+
 	GDKfree(command);
 
 	/* NOTE ABOUT STARTING NEW THREADS

--- a/monetdb5/modules/mal/Tests/All
+++ b/monetdb5/modules/mal/Tests/All
@@ -51,9 +51,6 @@ manifoldstr
 # might show different output if openssl is compiled without full sha2
 # support
 clients-hashes
-# shows different output if the password backend is different (or
-# monetdb password has been changed)
-clients-getpasswd
 
 #cpustat too system dependent to always run.
 

deleted file mode 100644
--- a/monetdb5/modules/mal/Tests/clients-getpasswd.maltest
+++ /dev/null
@@ -1,8 +0,0 @@
-statement ok
-p := clients.getPasswordHash("monetdb")
-
-query T rowsort
-io.print(p)
-----
-"a73f1d86383446438ac64f56e15ada38b41fbb18f029d2181723aeb2acac6a831f60e5fdbd64ac2c8c70e035dd44cbbe3b45565ef2d58feb2821a2078c7fad35"
-

--- a/monetdb5/modules/mal/clients.c
+++ b/monetdb5/modules/mal/clients.c
@@ -709,25 +709,6 @@ static str CLTbackendsum(str *ret, str *
 	return MAL_SUCCEED;
 }
 
-static str CLTaddUser(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci) {
-	oid *ret = getArgReference_oid(stk, pci, 0);
-	str *usr = getArgReference_str(stk, pci, 1);
-	str *pw = getArgReference_str(stk, pci, 2);
-
-	(void)mb;
-
-	return AUTHaddUser(ret, cntxt, *usr, *pw);
-}
-
-static str CLTremoveUser(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci) {
-	str *usr;
-	(void)mb;
-
-	usr = getArgReference_str(stk, pci, 1);
-
-	return AUTHremoveUser(cntxt, *usr);
-}
-
 static str CLTgetUsername(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci) {
 	str *ret = getArgReference_str(stk, pci, 0);
 	(void)mb;
@@ -744,33 +725,6 @@ static str CLTgetPasswordHash(Client cnt
 	return AUTHgetPasswordHash(ret, cntxt, *user);
 }
 
-static str CLTchangeUsername(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci) {
-	str *old = getArgReference_str(stk, pci, 1);
-	str *new = getArgReference_str(stk, pci, 2);
-
-	(void)mb;
-
-	return AUTHchangeUsername(cntxt, *old, *new);
-}
-
-static str CLTchangePassword(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci) {
-	str *old = getArgReference_str(stk, pci, 1);
-	str *new = getArgReference_str(stk, pci, 2);
-
-	(void)mb;
-
-	return AUTHchangePassword(cntxt, *old, *new);
-}
-
-static str CLTsetPassword(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci) {
-	str *usr = getArgReference_str(stk, pci, 1);
-	str *new = getArgReference_str(stk, pci, 2);
-
-	(void)mb;
-
-	return AUTHsetPassword(cntxt, *usr, *new);
-}
-
 static str CLTcheckPermission(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci) {
 	str *usr = getArgReference_str(stk, pci, 1);
 	str *pw = getArgReference_str(stk, pci, 2);
@@ -788,24 +742,6 @@ static str CLTcheckPermission(Client cnt
 	return msg;
 }
 
-static str CLTgetUsers(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci) {
-	bat *ret1 = getArgReference_bat(stk, pci, 0);
-	bat *ret2 = getArgReference_bat(stk, pci, 1);
-	BAT *uid, *nme;
-	str tmp;
-
-	(void)mb;
-
-	tmp = AUTHgetUsers(&uid, &nme, cntxt);
-	if (tmp)
-		return tmp;
-	*ret1 = uid->batCacheid;
-	BBPkeepref(uid);
-	*ret2 = nme->batCacheid;
-	BBPkeepref(nme);
-	return(MAL_SUCCEED);
-}
-
 str
 CLTshutdown(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci) {
 	str *ret  = getArgReference_str(stk,pci,0);
@@ -1033,15 +969,9 @@ mel_func clients_init_funcs[] = {
  command("clients", "sha2sum", CLTsha2sum, false, "Return hex string representation of the SHA-2 hash with bits of the given string", args(1,3, arg("",str),arg("pw",str),arg("bits",int))),
  command("clients", "ripemd160sum", CLTripemd160sum, false, "Return hex string representation of the RIPEMD160 hash of the given string", args(1,2, arg("",str),arg("pw",str))),
  command("clients", "backendsum", CLTbackendsum, false, "Return hex string representation of the currently used hash of the given string", args(1,2, arg("",str),arg("pw",str))),
- pattern("clients", "addUser", CLTaddUser, true, "Allow user with password access to the given scenarios", args(1,3, arg("",oid),arg("nme",str),arg("pw",str))),
- pattern("clients", "removeUser", CLTremoveUser, true, "Remove the given user from the system", args(1,2, arg("",void),arg("nme",str))),
  pattern("clients", "getUsername", CLTgetUsername, false, "Return the username of the currently logged in user", args(1,1, arg("",str))),
  pattern("clients", "getPasswordHash", CLTgetPasswordHash, false, "Return the password hash of the given user", args(1,2, arg("",str),arg("user",str))),
- pattern("clients", "changeUsername", CLTchangeUsername, true, "Change the username of the user into the new string", args(1,3, arg("",void),arg("old",str),arg("new",str))),
- pattern("clients", "changePassword", CLTchangePassword, true, "Change the password for the current user", args(1,3, arg("",void),arg("old",str),arg("new",str))),
- pattern("clients", "setPassword", CLTsetPassword, true, "Set the password for the given user", args(1,3, arg("",void),arg("user",str),arg("pass",str))),
  pattern("clients", "checkPermission", CLTcheckPermission, false, "Check permission for a user, requires hashed password (backendsum)", args(1,3, arg("",void),arg("usr",str),arg("pw",str))),
- pattern("clients", "getUsers", CLTgetUsers, false, "return a BAT with user id and one with name available in the system", args(2,2, batarg("",oid),batarg("",str))),
  pattern("clients", "current_sessionid", CLTgetSessionID, false, "return current session ID", args(1,1, arg("",int))),
  { .imp=NULL }
 };

--- a/sql/backends/monet5/sql.c
+++ b/sql/backends/monet5/sql.c
@@ -5075,6 +5075,31 @@ SQLstr_column_stop_vacuum(Client cntxt, 
 #include "for.h"
 #include "dict.h"
 #include "mel.h"
+
+
+str
+SQLuser_password(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci)
+{
+	mvc *m = NULL;
+	str msg = NULL;
+	str *password = getArgReference_str(stk, pci, 0);
+	const char *username = *getArgReference_str(stk, pci, 1);
+
+	(void) password;
+
+	if ((msg = getSQLContext(cntxt, mb, &m, NULL)) != NULL)
+		return msg;
+	if ((msg = checkSQLContext(cntxt)) != NULL)
+		return msg;
+	if (cntxt->username != username) {
+		// only MAL_ADMIN and user himself can access password
+		if ((msg = AUTHrequireAdmin(cntxt)) != MAL_SUCCEED)
+			return msg;
+	}
+	*password = monet5_password_hash(m, username);
+	return MAL_SUCCEED;
+}
+
 static mel_func sql_init_funcs[] = {
  pattern("sql", "shutdown", SQLshutdown_wrap, true, "", args(1,3, arg("",str),arg("delay",bte),arg("force",bit))),
  pattern("sql", "shutdown", SQLshutdown_wrap, true, "", args(1,3, arg("",str),arg("delay",sht),arg("force",bit))),
@@ -5164,9 +5189,7 @@ static mel_func sql_init_funcs[] = {
  pattern("sql", "argRecord", SQLargRecord, false, "Glue together the calling sequence", args(1,2, arg("",str),varargany("a",0))),
  pattern("sql", "sql_variables", sql_variables, false, "return the table with session variables", args(4,4, batarg("sname",str),batarg("name",str),batarg("type",str),batarg("value",str))),
  pattern("sql", "sessions", sql_sessions_wrap, false, "SQL export table of active sessions, their timeouts and idle status", args(9,9, batarg("id",int),batarg("user",str),batarg("start",timestamp),batarg("idle",timestamp),batarg("optmizer",str),batarg("stimeout",int),batarg("qtimeout",int),batarg("wlimit",int),batarg("mlimit",int))),
- pattern("sql", "db_users", db_users_wrap, false, "return table of users with sql scenario", args(1,1, batarg("",str))),
- pattern("sql", "password", db_password_wrap, false, "Return password hash of user", args(1,2, arg("",str),arg("user",str))),
- pattern("batsql", "password", db_password_wrap, false, "Return password hash of user", args(1,2, batarg("",str),batarg("user",str))),
+pattern("sql", "password", SQLuser_password, false, "Return password hash of user", args(1,2, arg("",str),arg("user",str))),
  pattern("sql", "rt_credentials", sql_rt_credentials_wrap, false, "Return the remote table credentials for the given table", args(3,4, batarg("uri",str),batarg("username",str),batarg("hash",str),arg("tablename",str))),
  pattern("sql", "dump_cache", dump_cache, false, "dump the content of the query cache", args(2,2, batarg("query",str),batarg("count",int))),
  pattern("sql", "dump_opt_stats", dump_opt_stats, false, "dump the optimizer rewrite statistics", args(2,2, batarg("rewrite",str),batarg("count",int))),
@@ -5965,10 +5988,10 @@ static mel_func sql_init_funcs[] = {
  pattern("sqlcatalog", "revoke", SQLrevoke, false, "Catalog operation revoke", args(0,7, arg("sname",str),arg("tbl",str),arg("grantee",str),arg("privs",int),arg("cname",str),arg("grant",int),arg("grantor",int))),
  pattern("sqlcatalog", "grant_function", SQLgrant_function, false, "Catalog operation grant_function", args(0,6, arg("sname",str),arg("fcnid",int),arg("grantee",str),arg("privs",int),arg("grant",int),arg("grantor",int))),
  pattern("sqlcatalog", "revoke_function", SQLrevoke_function, false, "Catalog operation revoke_function", args(0,6, arg("sname",str),arg("fcnid",int),arg("grantee",str),arg("privs",int),arg("grant",int),arg("grantor",int))),
- pattern("sqlcatalog", "create_user", SQLcreate_user, false, "Catalog operation create_user", args(0,6, arg("sname",str),arg("passwrd",str),arg("enc",int),arg("schema",str),arg("schemapath",str),arg("fullname",str))),
+ pattern("sqlcatalog", "create_user", SQLcreate_user, false, "Catalog operation create_user", args(0,10, arg("sname",str),arg("passwrd",str),arg("enc",int),arg("schema",str),arg("schemapath",str),arg("fullname",str), arg("max_memory", lng), arg("max_workers", int), arg("optimizer", str), arg("default_role", str))),
  pattern("sqlcatalog", "drop_user", SQLdrop_user, false, "Catalog operation drop_user", args(0,2, arg("sname",str),arg("action",int))),
  pattern("sqlcatalog", "drop_user", SQLdrop_user, false, "Catalog operation drop_user", args(0,3, arg("sname",str),arg("auth",str),arg("action",int))),
- pattern("sqlcatalog", "alter_user", SQLalter_user, false, "Catalog operation alter_user", args(0,6, arg("sname",str),arg("passwrd",str),arg("enc",int),arg("schema",str),arg("schemapath",str),arg("oldpasswrd",str))),
+ pattern("sqlcatalog", "alter_user", SQLalter_user, false, "Catalog operation alter_user", args(0,7, arg("sname",str),arg("passwrd",str),arg("enc",int),arg("schema",str),arg("schemapath",str),arg("oldpasswrd",str),arg("role",str))),
  pattern("sqlcatalog", "rename_user", SQLrename_user, false, "Catalog operation rename_user", args(0,3, arg("sname",str),arg("newnme",str),arg("action",int))),
  pattern("sqlcatalog", "create_role", SQLcreate_role, false, "Catalog operation create_role", args(0,3, arg("sname",str),arg("role",str),arg("grator",int))),
  pattern("sqlcatalog", "drop_role", SQLdrop_role, false, "Catalog operation drop_role", args(0,3, arg("auth",str),arg("role",str),arg("action",int))),

--- a/sql/backends/monet5/sql.h
+++ b/sql/backends/monet5/sql.h
@@ -289,7 +289,12 @@ extern str SQLunionfunc(Client cntxt, Ma
 extern str SQLstr_column_vacuum(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci);
 extern str SQLstr_column_auto_vacuum(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci);
 extern str SQLstr_column_stop_vacuum(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci);
+extern str SQLuser_password(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci);
 
 sql5_export str getBackendContext(Client cntxt, backend **be);
 
+#define USER_TABLE_NAME "db_user_info"
+#define SCHEMA_TABLE_NAME "schemas"
+#define USER_PASSWORD_COLUMN "password"
+
 #endif /* _SQL_H */

--- a/sql/backends/monet5/sql_cat.c
+++ b/sql/backends/monet5/sql_cat.c
@@ -1746,9 +1746,13 @@ SQLcreate_user(Client cntxt, MalBlkPtr m
 	char *schema = SaveArgReference(stk, pci, 4);
 	char *schema_path = SaveArgReference(stk, pci, 5);
 	char *fullname = SaveArgReference(stk, pci, 6);
+	lng max_memory = *getArgReference_lng(stk, pci, 7);
+	int max_workers = *getArgReference_int(stk, pci, 8);
+	char *optimizer = SaveArgReference(stk, pci, 9);
+	char *default_role = SaveArgReference(stk, pci, 10);
 
 	initcontext();
-	msg = sql_create_user(sql, sname, passwd, enc, fullname, schema, schema_path);
+	msg = sql_create_user(sql, sname, passwd, enc, fullname, schema, schema_path, max_memory, max_workers, optimizer, default_role);
 	return msg;
 }
 
@@ -1773,9 +1777,10 @@ SQLalter_user(Client cntxt, MalBlkPtr mb
 	char *schema = SaveArgReference(stk, pci, 4);
 	char *schema_path = SaveArgReference(stk, pci, 5);
 	char *oldpasswd = SaveArgReference(stk, pci, 6);
+	char *role = SaveArgReference(stk, pci, 7);
 
 	initcontext();
-	msg = sql_alter_user(sql, sname, passwd, enc, schema, schema_path, oldpasswd);
+	msg = sql_alter_user(sql, sname, passwd, enc, schema, schema_path, oldpasswd, role);
 
 	return msg;
 }

--- a/sql/backends/monet5/sql_scenario.c
+++ b/sql/backends/monet5/sql_scenario.c
@@ -273,6 +273,9 @@ SQLprepareClient(Client c, int login)
 			case -3:
 				msg = createException(SQL,"sql.initClient", SQLSTATE(42000) "The user's default schema was not found, this session is going to terminate");
 				goto bailout1;
+			case -4:
+				msg = createException(SQL,"sql.initClient", SQLSTATE(42000) "The user's default role was not found, this session is going to terminate");
+				goto bailout1;
 			default:
 				break;
 		}

--- a/sql/backends/monet5/sql_upgrades.c
+++ b/sql/backends/monet5/sql_upgrades.c
@@ -4599,11 +4599,158 @@ sql_update_default(Client c, mvc *sql)
 	if (buf == NULL)
 		throw(SQL, __func__, SQLSTATE(HY013) MAL_MALLOC_FAIL);
 
+	/* if sys.db_user_info does not have a column password, we need to
+	 * add a bunch of columns */
+	pos = snprintf(buf, bufsize,
+				   "select id from sys._columns where table_id = (select id from sys._tables where name = 'db_user_info') and name = 'password';\n");
+	if ((err = SQLstatementIntern(c, buf, "update", true, false, &output))) {
+		GDKfree(buf);
+		return err;
+	}
+	if ((b = BBPquickdesc(output->cols[0].b)) && BATcount(b) == 0) {
+		pos = 0;
+		pos += snprintf(buf + pos, bufsize - pos,
+						"alter table sys.db_user_info add column max_memory bigint;\n"
+						"alter table sys.db_user_info add column max_workers int;\n"
+						"alter table sys.db_user_info add column optimizer varchar(1024);\n"
+						"alter table sys.db_user_info add column default_role int;\n"
+						"alter table sys.db_user_info add column password varchar(256);\n");
+		pos += snprintf(buf + pos, bufsize - pos,
+						"update sys.db_user_info u set max_memory = 0, max_workers = 0, optimizer = 'default_pipe', default_role = (select id from sys.auths a where a.name = u.name);\n");
+		int endprint = (int) pos;
+		bat bid;
+		BAT *u = NULL, *p = NULL, *d = NULL;
+		if ((bid = BBPindex("M5system_auth_user")) == 0 ||
+			(u = BATdescriptor(bid)) == NULL ||
+			(bid = BBPindex("M5system_auth_passwd_v2")) == 0 ||
+			(p = BATdescriptor(bid)) == NULL ||
+			(bid = BBPindex("M5system_auth_deleted")) == 0 ||
+			(d = BATdescriptor(bid)) == NULL) {
+			if (u)
+				BBPunfix(u->batCacheid);
+			if (p)
+				BBPunfix(p->batCacheid);
+			if (d)
+				BBPunfix(d->batCacheid);
+			throw(SQL, __func__, INTERNAL_BAT_ACCESS);
+		}
+		BATiter ui = bat_iterator(u);
+		BATiter pi = bat_iterator(p);
+		for (oid i = 0; i < ui.count; i++) {
+			if (BUNfnd(d, &i) == BUN_NONE) {
+				const char *user = BUNtvar(ui, i);
+				const char *pass = BUNtvar(pi, i);
+				char *user_esc = NULL;
+				char *pass_esc = NULL;
+				if (strchr(user, '\'') != NULL) {
+					char *user_esc = GDKmalloc(strlen(user) * 2 + 1);
+					if (user_esc == NULL) {
+						bat_iterator_end(&ui);
+						bat_iterator_end(&pi);
+						BBPunfix(u->batCacheid);
+						BBPunfix(p->batCacheid);
+						BBPunfix(d->batCacheid);
+						throw(SQL, __func__, SQLSTATE(HY013) MAL_MALLOC_FAIL);
+					}
+					size_t k = 0;
+					for (size_t j = 0; user[j]; j++) {
+						if (user[j] == '\'')
+							user_esc[k++] = '\'';
+						user_esc[k++] = user[j];
+					}
+					user_esc[k] = '\0';
+				}
+				if (strchr(pass, '\'') != NULL) {
+					char *pass_esc = GDKmalloc(strlen(pass) * 2 + 1);
+					if (pass_esc == NULL) {
+						bat_iterator_end(&ui);
+						bat_iterator_end(&pi);
+						BBPunfix(u->batCacheid);
+						BBPunfix(p->batCacheid);
+						BBPunfix(d->batCacheid);
+						GDKfree(user_esc);
+						throw(SQL, __func__, SQLSTATE(HY013) MAL_MALLOC_FAIL);
+					}
+					size_t k = 0;
+					for (size_t j = 0; pass[j]; j++) {
+						if (pass[j] == '\'')
+							pass_esc[k++] = '\'';
+						pass_esc[k++] = pass[j];
+					}
+					pass_esc[k] = '\0';
+				}
+				pos += snprintf(buf + pos, bufsize - pos,
+								"update sys.db_user_info set password = r'%s' where name = r'%s';\n", pass_esc ? pass_esc : pass, user_esc ? user_esc : user);
+				GDKfree(user_esc);
+				GDKfree(pass_esc);
+			}
+		}
+		assert(pos < bufsize);
+		printf("Running database upgrade commands:\n%.*s-- and copying passwords\n\n", endprint, buf);
+		err = SQLstatementIntern(c, buf, "update", true, false, NULL);
+		bat_iterator_end(&ui);
+		bat_iterator_end(&pi);
+		bat authbats[4];
+		authbats[0] = 0;
+		authbats[1] = u->batCacheid;
+		authbats[2] = p->batCacheid;
+		authbats[3] = d->batCacheid;
+		if (err == MAL_SUCCEED &&
+			(BATmode(u, true) != GDK_SUCCEED ||
+			 BATmode(p, true) != GDK_SUCCEED ||
+			 BATmode(d, true) != GDK_SUCCEED ||
+			 BBPrename(u, NULL) != 0 ||
+			 BBPrename(p, NULL) != 0 ||
+			 BBPrename(d, NULL) != 0 ||
+			 TMsubcommit_list(authbats, NULL, 4, getBBPlogno(), getBBPtransid()) != GDK_SUCCEED)) {
+				fprintf(stderr, "Committing removal of old user/password BATs failed\n");
+		}
+		BBPunfix(u->batCacheid);
+		BBPunfix(p->batCacheid);
+		BBPunfix(d->batCacheid);
+
+		if (err == MAL_SUCCEED) {
+			sql_schema *s = mvc_bind_schema(sql, "sys");
+			sql_table *t = mvc_bind_table(sql, s, "roles");
+			t->system = 0;
+			t = mvc_bind_table(sql, s, "users");
+			t->system = 0;
+			t = mvc_bind_table(sql, s, "dependency_schemas_on_users");
+			t->system = 0;
+			pos = 0;
+			pos += snprintf(buf + pos, bufsize - pos,
+							"drop view sys.dependency_schemas_on_users;\n"
+							"drop view sys.roles;\n"
+							"drop view sys.users;\n"
+							"drop function sys.db_users();\n"
+							"CREATE VIEW sys.roles AS SELECT id, name, grantor FROM sys.auths a WHERE a.name NOT IN (SELECT u.name FROM sys.db_user_info u);\n"
+							"GRANT SELECT ON sys.roles TO PUBLIC;\n"
+							"CREATE VIEW sys.users AS SELECT name, fullname, default_schema, schema_path, max_memory, max_workers, optimizer, default_role FROM sys.db_user_info;\n"
+							"GRANT SELECT ON sys.users TO PUBLIC;\n"
+							"CREATE FUNCTION sys.db_users() RETURNS TABLE(name varchar(2048)) RETURN SELECT name FROM sys.db_user_info;\n"
+							"CREATE VIEW sys.dependency_schemas_on_users AS\n"
+							"SELECT s.id AS schema_id, s.name AS schema_name, u.name AS user_name, CAST(6 AS smallint) AS depend_type\n"
+							" FROM sys.db_user_info AS u, sys.schemas AS s\n"
+							" WHERE u.default_schema = s.id\n"
+							" ORDER BY s.name, u.name;\n"
+							"GRANT SELECT ON sys.dependency_schemas_on_users TO PUBLIC;\n"
+							"update sys._tables set system = true where name in ('users', 'roles', 'dependency_schemas_on_users') AND schema_id = 2000;\n"
+							"update sys.functions set system = true where system <> true and name in ('db_users') and schema_id = 2000 and type = %d;\n", F_UNION);
+			assert(pos < bufsize);
+			printf("Running database upgrade commands:\n%s\n", buf);
+			err = SQLstatementIntern(c, buf, "update", true, false, NULL);
+		}
+	}
+	res_table_destroy(output);
+	output = NULL;
+	if (err != MAL_SUCCEED)
+		return err;
+
 	/* if 'describe_partition_tables' system view doesn't use 'vals'
 	 * CTE, re-create it; while we're at it, also update the sequence
 	 * dumping code */
-	pos += snprintf(buf + pos, bufsize - pos,
-			"select 1 from tables where schema_id = (select \"id\" from sys.schemas where \"name\" = 'sys') and \"name\" = 'describe_partition_tables' and \"query\" not like '%%vals%%';\n");
+	pos = snprintf(buf, bufsize,
+			"select 1 from sys.tables where schema_id = (select \"id\" from sys.schemas where \"name\" = 'sys') and \"name\" = 'describe_partition_tables' and \"query\" not like '%%vals%%';\n");
 	if ((err = SQLstatementIntern(c, buf, "update", true, false, &output))) {
 		GDKfree(buf);
 		return err;
@@ -4624,6 +4771,8 @@ sql_update_default(Client c, mvc *sql)
 		t->system = 0;
 		t = mvc_bind_table(sql, s, "dump_tables");
 		t->system = 0;
+		t = mvc_bind_table(sql, s, "dump_create_users");
+		t->system = 0;
 
 		pos = 0;
 		pos += snprintf(buf + pos, bufsize - pos,
@@ -4636,7 +4785,8 @@ sql_update_default(Client c, mvc *sql)
 			"drop view sys.dump_sequences;\n"
 			"drop view sys.dump_start_sequences;\n"
 			"drop view sys.dump_tables;\n"
-			"drop view sys.describe_tables;\n");
+			"drop view sys.describe_tables;\n"
+			"drop view sys.dump_create_users;\n");
 
 		pos += snprintf(buf + pos, bufsize - pos,
 			"CREATE VIEW sys.describe_partition_tables AS\n"
@@ -4782,7 +4932,17 @@ sql_update_default(Client c, mvc *sql)
 			" SET i = (SELECT MIN(t.id) FROM sys.tables t, sys.table_types ts WHERE t.type = ts.table_type_id AND ts.table_type_name = 'TABLE' AND NOT t.system AND t.id > i);\n"
 			" END WHILE;\n"
 			" END IF;\n"
-			"END;\n");
+			"END;\n"
+			"CREATE VIEW sys.dump_create_users AS\n"
+			" SELECT\n"
+			" 'CREATE USER ' || sys.dq(ui.name) || ' WITH ENCRYPTED PASSWORD ' ||\n"
+			" sys.sq(sys.password_hash(ui.name)) ||\n"
+			" ' NAME ' || sys.sq(ui.fullname) || ' SCHEMA sys' || ifthenelse(ui.schema_path = '\"sys\"', '', ' SCHEMA PATH ' || sys.sq(ui.schema_path)) || ';' stmt,\n"
+			" ui.name user_name\n"
+			" FROM sys.db_user_info ui, sys.schemas s\n"
+			" WHERE ui.default_schema = s.id\n"
+			" AND ui.name <> 'monetdb'\n"
+			" AND ui.name <> '.snapshot';\n");
 
 		pos += snprintf(buf + pos, bufsize - pos,
 			"CREATE VIEW sys.describe_tables AS\n"
@@ -4871,7 +5031,7 @@ sql_update_default(Client c, mvc *sql)
 			" RETURN sys.dump_statements;\n"
 			"END;\n");
 		pos += snprintf(buf + pos, bufsize - pos,
-			"update sys._tables set system = true where name in ('describe_partition_tables', 'dump_partition_tables', 'dump_sequences', 'dump_start_sequences', 'describe_tables', 'dump_tables') AND schema_id = 2000;\n");
+			"update sys._tables set system = true where name in ('describe_partition_tables', 'dump_partition_tables', 'dump_sequences', 'dump_start_sequences', 'describe_tables', 'dump_tables', 'dump_create_users') AND schema_id = 2000;\n");
 		pos += snprintf(buf + pos, bufsize - pos,
 			"update sys.functions set system = true where system <> true and name in ('dump_table_data') and schema_id = 2000 and type = %d;\n", F_PROC);
 		pos += snprintf(buf + pos, bufsize - pos,
@@ -4890,6 +5050,8 @@ sql_update_default(Client c, mvc *sql)
 	}
 	res_table_destroy(output);
 	output = NULL;
+	if (err != MAL_SUCCEED)
+		return err;
 
 	/* 10_sys_schema_extensions */
 	/* if the keyword LOCKED is in the list of keywords, upgrade */
@@ -4913,6 +5075,8 @@ sql_update_default(Client c, mvc *sql)
 	}
 	res_table_destroy(output);
 	output = NULL;
+	if (err != MAL_SUCCEED)
+		return err;
 
 	/* if the table type UNLOGGED TABLE is not in the list of table
 	 * types, upgrade */

--- a/sql/backends/monet5/sql_user.c
+++ b/sql/backends/monet5/sql_user.c
@@ -23,16 +23,238 @@
 #include "mal_authorize.h"
 #include "mcrypt.h"
 
+
+static inline sql_table*
+getUsersTbl(mvc *m)
+{
+	sql_trans *tr = m->session->tr;
+	sql_schema *sys = find_sql_schema(tr, "sys");
+	return find_sql_table(tr, sys, USER_TABLE_NAME);
+}
+
+
+static oid
+getUserOIDByName(mvc *m, const char *user)
+{
+	sql_trans *tr = m->session->tr;
+	sqlstore *store = m->session->tr->store;
+	sql_table *users = getUsersTbl(m);
+	sql_column *users_name = find_sql_column(users, "name");
+	return store->table_api.column_find_row(tr, users_name, user, NULL);
+}
+
+
+static str
+getUserName(mvc *m, oid rid)
+{
+	if (is_oid_nil(rid))
+		return NULL;
+	sql_trans *tr = m->session->tr;
+	sqlstore *store = m->session->tr->store;
+	sql_table *users = getUsersTbl(m);
+	return store->table_api.column_find_value(tr, find_sql_column(users, "name"), rid);
+}
+
+
+#if 0
+static inline sql_table*
+getSchemasTbl(mvc *m)
+{
+	sql_trans *tr = m->session->tr;
+	sql_schema *sys = find_sql_schema(tr, "sys");
+	return find_sql_table(tr, sys, SCHEMA_TABLE_NAME);
+}
+
+static str
+getSchemaName(mvc *m, sqlid schema_id)
+{
+	if (schema_id > 0) {
+		oid rid;
+		sql_trans *tr = m->session->tr;
+		sqlstore *store = m->session->tr->store;
+		sql_table *tbl = getSchemasTbl(m);
+		if (is_oid_nil(rid = store->table_api.column_find_row(tr, find_sql_column(tbl, "id"), &schema_id, NULL)))
+			return NULL;
+		return store->table_api.column_find_value(tr, find_sql_column(tbl, "name"), rid);
+	}
+	return NULL;
+}
+#endif
+
+static str
+getUserPassword(mvc *m, oid rid)
+{
+	if (is_oid_nil(rid)) {
+		return NULL;
+	}
+	sql_trans *tr = m->session->tr;
+	sqlstore *store = m->session->tr->store;
+	sql_table *users = getUsersTbl(m);
+	return store->table_api.column_find_value(tr, find_sql_column(users, USER_PASSWORD_COLUMN), rid);
+}
+
+
+static str
+getUserNameCallback(Client c)
+{
+	str res = NULL;
+	backend *be = (backend *) c->sqlcontext;
+	if (be) {
+		mvc *m = be->mvc;
+		int active = m->session->tr->active;
+		if (active || mvc_trans(m) == 0) {
+			res = getUserName(m, c->user);
+			if (!active)
+				sql_trans_end(m->session, SQL_OK);
+		}
+	}
+	return res;
+}
+
+
+static str
+getUserPasswordCallback(Client c, const char *user)
+{
+	str res = NULL;
+	backend *be = (backend *) c->sqlcontext;
+	if (be) {
+		mvc *m = be->mvc;
+		int active = m->session->tr->active;
+		// this starts new transaction
+		if (active || mvc_trans(m) == 0) {
+			oid rid = getUserOIDByName(m, user);
+			res = getUserPassword(m, rid);
+			if (!active)
+				sql_trans_end(m->session, SQL_OK);
+		}
+	}
+	return res;
+}
+
+
+static int
+setUserPassword(mvc *m, oid rid, str value)
+{
+	str err = NULL;
+	str hash = NULL;
+	int res;
+	if (is_oid_nil(rid)) {
+		(void) sql_error(m, 02, SQLSTATE(42000) "setUserPassword: invalid user");
+		return LOG_ERR;
+	}
+	if (strNil(value)) {
+		(void) sql_error(m, 02, SQLSTATE(42000) "setUserPassword: password cannot be nil");
+		return LOG_ERR;
+	}
+	if ((err = AUTHverifyPassword(value)) != MAL_SUCCEED) {
+		(void) sql_error(m, 02, SQLSTATE(42000) "setUserPassword: %s", getExceptionMessage(err));
+		freeException(err);
+		return LOG_ERR;
+	}
+	if ((err = AUTHcypherValue(&hash, value)) != MAL_SUCCEED) {
+		(void) sql_error(m, 02, SQLSTATE(42000) "setUserPassword: %s", getExceptionMessage(err));
+		freeException(err);
+		GDKfree(hash);
+		return LOG_ERR;
+	}
+
+	sql_trans *tr = m->session->tr;
+	sqlstore *store = m->session->tr->store;
+	sql_table *users = getUsersTbl(m);
+	res = store->table_api.column_update_value(tr, find_sql_column(users, USER_PASSWORD_COLUMN), rid, hash);
+	GDKfree(hash);
+	return res;
+}
+
+
+static int
+changeUserPassword(mvc *m, oid rid, str oldpass, str newpass)
+{
+	str err = NULL;
+	str hash = NULL;
+	str passValue = NULL;
+	if (is_oid_nil(rid)) {
+		(void) sql_error(m, 02, SQLSTATE(42000) "changeUserPassword: invalid user");
+		return LOG_ERR;
+	}
+	if (strNil(newpass)) {
+		(void) sql_error(m, 02, SQLSTATE(42000) "changeUserPassword: password cannot be nil");
+		return LOG_ERR;
+	}
+	if (oldpass) {
+		// validate old password match
+		if ((err = AUTHdecypherValue(&hash, passValue=getUserPassword(m, rid))) != MAL_SUCCEED) {
+			(void) sql_error(m, 02, SQLSTATE(42000) "changeUserPassword: %s", getExceptionMessage(err));
+			freeException(err);
+			GDKfree(passValue);
+			return LOG_ERR;
+		}
+		GDKfree(passValue);
+		if (strcmp(oldpass, hash) != 0) {
+			(void) sql_error(m, 02, SQLSTATE(42000) "changeUserPassword: password mismatch");
+			GDKfree(hash);
+			return LOG_ERR;
+		}
+		GDKfree(hash);
+	}
+	return setUserPassword(m, rid, newpass);
+}
+
+
+static oid
+getUserOIDCallback(Client c, const char *user)
+{
+	oid res;
+	backend *be = (backend *) c->sqlcontext;
+	if (be) {
+		mvc *m = be->mvc;
+		int active = m->session->tr->active;
+		if (active || mvc_trans(m) == 0) {
+			res = getUserOIDByName(m, user);
+			if (!active)
+				sql_trans_end(m->session, SQL_OK);
+			return res;
+		}
+	}
+	return oid_nil;
+}
+
+
+static void
+monet5_set_user_api_hooks(ptr mvc)
+{
+	(void) mvc;
+	AUTHRegisterGetPasswordHandler(&getUserPasswordCallback);
+	AUTHRegisterGetUserNameHandler(&getUserNameCallback);
+	AUTHRegisterGetUserOIDHandler(&getUserOIDCallback);
+}
+
+
+static int
+monet5_find_role(ptr _mvc, str role, sqlid *role_id)
+{
+	mvc *m = (mvc *) _mvc;
+	sql_trans *tr = m->session->tr;
+	sqlstore *store = m->session->tr->store;
+	sql_schema *sys = find_sql_schema(tr, "sys");
+	sql_table *auths = find_sql_table(tr, sys, "auths");
+	sql_column *auth_name = find_sql_column(auths, "name");
+	oid rid = store->table_api.column_find_row(tr, auth_name, role, NULL);
+	if (is_oid_nil(rid))
+		return -1;
+	*role_id = store->table_api.column_find_sqlid(m->session->tr, find_sql_column(auths, "id"), rid);
+	return 1;
+}
+
+
 static int
 monet5_drop_user(ptr _mvc, str user)
 {
 	mvc *m = (mvc *) _mvc;
-	oid rid, grant_user;
+	oid rid;
 	sql_schema *sys = find_sql_schema(m->session->tr, "sys");
 	sql_table *users = find_sql_table(m->session->tr, sys, "db_user_info");
 	sql_column *users_name = find_sql_column(users, "name");
-	str err;
-	Client c = MCgetClient(m->clientid);
 	sqlstore *store = m->session->tr->store;
 	int log_res = LOG_OK;
 
@@ -42,33 +264,21 @@ monet5_drop_user(ptr _mvc, str user)
 		return FALSE;
 	}
 
-	grant_user = c->user;
-	c->user = MAL_ADMIN;
-	err = AUTHremoveUser(c, user);
-	c->user = grant_user;
-	if (err !=MAL_SUCCEED) {
-		(void) sql_error(m, 02, "DROP USER: %s", getExceptionMessage(err));
-		freeException(err);
-		return FALSE;
-	}
-	/* FIXME: We have to ignore this inconsistency here, because the
-	 * user was already removed from the system authorisation. Once
-	 * we have warnings, we could issue a warning about this
-	 * (seemingly) inconsistency between system and sql shadow
-	 * administration. */
-
 	return TRUE;
 }
 
 #define outside_str 1
 #define inside_str 2
 #define default_schema_path "\"sys\"" /* "sys" will be the default schema path */
+#define default_optimizer "default_pipe"
+#define MAX_SCHEMA_SIZE 1024
+
 
 static str
 parse_schema_path_str(mvc *m, str schema_path, bool build) /* this function for both building and validating the schema path */
 {
 	list *l = m->schema_path;
-	char next_schema[1024]; /* needs one extra character for null terminator */
+	char next_schema[MAX_SCHEMA_SIZE]; /* needs one extra character for null terminator */
 	int status = outside_str;
 	size_t bp = 0;
 
@@ -142,145 +352,159 @@ parse_schema_path_str(mvc *m, str schema
 }
 
 static str
-monet5_create_user(ptr _mvc, str user, str passwd, char enc, str fullname, sqlid schema_id, str schema_path, sqlid grantorid)
+monet5_create_user(ptr _mvc, str user, str passwd, char enc, str fullname, sqlid schema_id, str schema_path, sqlid grantorid, lng max_memory, int max_workers, str optimizer, sqlid role_id)
 {
 	mvc *m = (mvc *) _mvc;
-	oid uid = 0;
-	str ret, pwd;
+	oid rid;
+	str ret, err, pwd, hash, schema_buf = NULL;
 	sqlid user_id;
 	sql_schema *s = find_sql_schema(m->session->tr, "sys");
-	sql_table *db_user_info = find_sql_table(m->session->tr, s, "db_user_info"), *auths = find_sql_table(m->session->tr, s, "auths");
-	Client c = MCgetClient(m->clientid);
+	sql_table *db_user_info = find_sql_table(m->session->tr, s, "db_user_info"),
+			  *auths = find_sql_table(m->session->tr, s, "auths"),
+			  *schemas_tbl = find_sql_table(m->session->tr, s, "schemas");
+	// Client c = MCgetClient(m->clientid);
 	sqlstore *store = m->session->tr->store;
 	int log_res = 0;
+	bool new_schema = false;
 
-	if (!schema_path)
+	if (schema_id == 0) {
+		// create default schema matching $user
+		switch (sql_trans_create_schema(m->session->tr, user, m->role_id, m->user_id, &schema_id)) {
+			case -1:
+				throw(SQL,"sql.create_user",SQLSTATE(HY013) MAL_MALLOC_FAIL);
+			case -2:
+			case -3:
+				throw(SQL,"sql.create_user",SQLSTATE(42000) "Create user schema failed due to transaction conflict");
+			default:
+				break;
+		}
+		new_schema = true;
+	}
+	assert(schema_id);
+
+	if (is_oid_nil(rid = store->table_api.column_find_row(m->session->tr, find_sql_column(schemas_tbl, "id"), &schema_id, NULL)))
+		throw(SQL,"sql.create_user",SQLSTATE(42000) "User schema not found");
+
+	if (!schema_path) {
+		// schema_name = store->table_api.column_find_value(m->session->tr, find_sql_column(schemas_tbl, "name"), rid);
+		// if (schema_name) {
+		// 	// "\"$schema_name\"\0"
+		// 	if ((strlen(schema_name) + 4) > MAX_SCHEMA_SIZE) {
+		// 		if (schema_name)
+		// 			GDKfree(schema_name);
+		// 		throw(SQL, "sql.schema_path", SQLSTATE(42000) "A schema has up to 1023 characters");
+		// 	}
+		// 	schema_buf = GDKmalloc(MAX_SCHEMA_SIZE);
+		// 	snprintf(schema_buf, MAX_SCHEMA_SIZE, "\"%s\"", schema_name);
+		// 	schema_path = schema_buf;
+		// 	GDKfree(schema_name);
+		// } else {
+		// 	schema_path = default_schema_path;
+		// }
 		schema_path = default_schema_path;
-	if ((ret = parse_schema_path_str(m, schema_path, false)) != MAL_SUCCEED)
+	}
+
+	if ((ret = parse_schema_path_str(m, schema_path, false)) != MAL_SUCCEED) {
+		if (schema_buf)
+			GDKfree(schema_buf);
 		return ret;
+	}
+
+	if (!optimizer)
+		optimizer = default_optimizer;
 
 	if (!enc) {
-		if (!(pwd = mcrypt_BackendSum(passwd, strlen(passwd))))
+		if (!(pwd = mcrypt_BackendSum(passwd, strlen(passwd)))) {
+			if (schema_buf)
+				GDKfree(schema_buf);
 			throw(MAL, "sql.create_user", SQLSTATE(42000) "Crypt backend hash not found");
+		}
 	} else {
 		pwd = passwd;
 	}
 
-	user_id = store_next_oid(m->session->tr->store);
-	if ((log_res = store->table_api.table_insert(m->session->tr, db_user_info, &user, &fullname, &schema_id, &schema_path))) {
+	if ((err = AUTHGeneratePasswordHash(&hash, pwd)) != MAL_SUCCEED) {
+		if (schema_buf)
+			GDKfree(schema_buf);
 		if (!enc)
 			free(pwd);
+		throw(MAL, "sql.create_user", SQLSTATE(42000) "create backend hash failure");
+	}
+
+	user_id = store_next_oid(m->session->tr->store);
+	sqlid default_role_id = role_id > 0 ? role_id : user_id;
+	if ((log_res = store->table_api.table_insert(m->session->tr, db_user_info, &user, &fullname, &schema_id, &schema_path, &max_memory, &max_workers, &optimizer, &default_role_id, &hash))) {
+		if (!enc)
+			free(pwd);
+		GDKfree(schema_buf);
+		GDKfree(hash);
 		throw(SQL, "sql.create_user", SQLSTATE(42000) "Create user failed%s", log_res == LOG_CONFLICT ? " due to conflict with another transaction" : "");
 	}
+	// clean up
+	GDKfree(schema_buf);
+	GDKfree(hash);
+
 	if ((log_res = store->table_api.table_insert(m->session->tr, auths, &user_id, &user, &grantorid))) {
 		if (!enc)
 			free(pwd);
 		throw(SQL, "sql.create_user", SQLSTATE(42000) "Create user failed%s", log_res == LOG_CONFLICT ? " due to conflict with another transaction" : "");
 	}
 
-	/* add the user to the M5 authorisation administration */
-	oid grant_user = c->user;
-	c->user = MAL_ADMIN;
-	ret = AUTHaddUser(&uid, c, user, pwd);
-	c->user = grant_user;
+	if (new_schema) {
+		// update schema authorization to be default_role_id
+		switch (sql_trans_change_schema_authorization(m->session->tr, schema_id, default_role_id)) {
+			case -1:
+				if (!enc)
+					free(pwd);
+				throw(SQL,"sql.create_user",SQLSTATE(HY013) MAL_MALLOC_FAIL);
+			case -2:
+			case -3:
+				if (!enc)
+					free(pwd);
+				throw(SQL,"sql.create_user",SQLSTATE(42000) "Update schema authorization failed due to transaction conflict");
+			default:
+				break;
+		}
+
+	}
 	if (!enc)
 		free(pwd);
 	return ret;
 }
 
-static int
+static oid
 monet5_find_user(ptr mp, str user)
 {
-	BAT *uid, *nme;
-	BUN p;
-	mvc *m = (mvc *) mp;
-	Client c = MCgetClient(m->clientid);
-	str err;
-
-	if ((err = AUTHgetUsers(&uid, &nme, c)) != MAL_SUCCEED) {
-		freeException(err);
-		return -1;
-	}
-	p = BUNfnd(nme, user);
-	BBPunfix(uid->batCacheid);
-	BBPunfix(nme->batCacheid);
-
-	/* yeah, I would prefer to return something different too */
-	return (p == BUN_NONE ? -1 : 1);
-}
-
-str
-db_users_wrap(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci)
-{
-	bat *r = getArgReference_bat(stk, pci, 0);
-	BAT *uid, *nme;
-	str err;
-
-	(void) mb;
-	if ((err = AUTHgetUsers(&uid, &nme, cntxt)) != MAL_SUCCEED)
-		return err;
-	BBPunfix(uid->batCacheid);
-	*r = nme->batCacheid;
-	BBPkeepref(nme);
-	return MAL_SUCCEED;
+	return getUserOIDByName((mvc *) mp, user);
 }
 
 str
-db_password_wrap(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci)
+monet5_password_hash(mvc *m, const char *username)
 {
-	(void) mb;
-
-	if (stk->stk[pci->argv[0]].vtype == TYPE_bat) {
-		BAT *b = BATdescriptor(*getArgReference_bat(stk, pci, 1));
-		if (b == NULL)
-			throw(SQL, "sql.password", SQLSTATE(HY002) RUNTIME_OBJECT_MISSING);
-		BAT *bn = COLnew(b->hseqbase, TYPE_str, BATcount(b), TRANSIENT);
-		if (bn == NULL) {
-			BBPunfix(b->batCacheid);
-			throw(SQL, "sql.password", SQLSTATE(HY013) MAL_MALLOC_FAIL);
+	str msg, hash = NULL;
+	oid rid = getUserOIDByName(m, username);
+	str password = getUserPassword(m, rid);
+	if (password) {
+		if ((msg = AUTHdecypherValue(&hash, password)) != MAL_SUCCEED) {
+			(void) sql_error(m, 02, SQLSTATE(42000) "monet5_password_hash: %s", getExceptionMessage(msg));
+			freeException(msg);
+			GDKfree(password);
 		}
-		BATiter bi = bat_iterator(b);
-		BUN p, q;
-		BATloop(b, p, q) {
-			char *hash, *msg;
-			msg = AUTHgetPasswordHash(&hash, cntxt, BUNtvar(bi, p));
-			if (msg != MAL_SUCCEED) {
-				bat_iterator_end(&bi);
-				BBPunfix(b->batCacheid);
-				BBPreclaim(bn);
-				return msg;
-			}
-			if (BUNappend(bn, hash, false) != GDK_SUCCEED) {
-				bat_iterator_end(&bi);
-				BBPunfix(b->batCacheid);
-				BBPreclaim(bn);
-				GDKfree(hash);
-				throw(SQL, "sql.password", SQLSTATE(HY013) MAL_MALLOC_FAIL);
-			}
-			GDKfree(hash);
-		}
-		bat_iterator_end(&bi);
-		BBPunfix(b->batCacheid);
-		BBPkeepref(bn);
-		*getArgReference_bat(stk, pci, 0) = bn->batCacheid;
-		return MAL_SUCCEED;
 	}
-	str *hash = getArgReference_str(stk, pci, 0);
-	str *user = getArgReference_str(stk, pci, 1);
-
-	return AUTHgetPasswordHash(hash, cntxt, *user);
+	GDKfree(password);
+	return hash;
 }
 
 static void
 monet5_create_privileges(ptr _mvc, sql_schema *s)
 {
 	sql_schema *sys;
-	sql_table *t = NULL, *uinfo = NULL;
+	sql_table *t = NULL;
+	sql_table *uinfo = NULL;
 	sql_column *col = NULL;
 	mvc *m = (mvc *) _mvc;
 	sqlid schema_id = 0;
-	list *res, *ops;
-	sql_func *f = NULL;
+	str err;
 
 	/* create the authorisation related tables */
 	mvc_create_table(&t, m, s, "db_user_info", tt_table, 1, SQL_PERSIST, 0, -1, 0);
@@ -288,43 +512,40 @@ monet5_create_privileges(ptr _mvc, sql_s
 	mvc_create_column_(&col, m, t, "fullname", "varchar", 2048);
 	mvc_create_column_(&col, m, t, "default_schema", "int", 9);
 	mvc_create_column_(&col, m, t, "schema_path", "clob", 0);
+	mvc_create_column_(&col, m, t, "max_memory", "bigint", 64);
+	mvc_create_column_(&col, m, t, "max_workers", "int", 32);
+	mvc_create_column_(&col, m, t, "optimizer", "varchar", 1024);
+	mvc_create_column_(&col, m, t, "default_role", "int", 32);
+	mvc_create_column_(&col, m, t, "password", "varchar", 256);
 	uinfo = t;
 
-	res = sa_list(m->sa);
-	list_append(res, sql_create_arg(m->sa, "name", sql_bind_subtype(m->sa, "varchar", 2048, 0), ARG_OUT));
-
-	/* add function */
-	ops = sa_list(m->sa);
-	/* following funcion returns a table (single column) of user names
-	   with the approriate scenario (sql) */
-	mvc_create_func(&f, m, NULL, s, "db_users", ops, res, F_UNION, FUNC_LANG_MAL, "sql", "db_users", "CREATE FUNCTION db_users () RETURNS TABLE( name varchar(2048)) EXTERNAL NAME sql.db_users;", FALSE, FALSE, TRUE, FALSE);
-	if (f)
-		f->instantiated = TRUE;
-	t = mvc_init_create_view(m, s, "users",
-			    "create view sys.users as select u.\"name\" as \"name\", "
-			    "ui.\"fullname\", ui.\"default_schema\", "
-				"ui.\"schema_path\" from sys.db_users() as u "
-				"left join \"sys\".\"db_user_info\" as ui "
-			    "on u.\"name\" = ui.\"name\";");
-	if (!t) {
-		TRC_CRITICAL(SQL_TRANS, "Failed to create 'users' view\n");
-		return ;
-	}
-
-	mvc_create_column_(&col, m, t, "name", "varchar", 2048);
-	mvc_create_column_(&col, m, t, "fullname", "varchar", 2048);
-	mvc_create_column_(&col, m, t, "default_schema", "int", 9);
-	mvc_create_column_(&col, m, t, "schema_path", "clob", 0);
-
 	sys = find_sql_schema(m->session->tr, "sys");
 	schema_id = sys->base.id;
-	assert(schema_id >= 0);
+	assert(schema_id == 2000);
 
 	sqlstore *store = m->session->tr->store;
 	char *username = "monetdb";
+	char *password = mcrypt_BackendSum("monetdb", strlen("monetdb"));
+	char *hash = NULL;
+	if ((err = AUTHGeneratePasswordHash(&hash, password)) != MAL_SUCCEED) {
+		TRC_CRITICAL(SQL_TRANS, "generate password hash failure");
+		freeException(err);
+		free(password);
+		return ;
+	}
+	free(password);
+
 	char *fullname = "MonetDB Admin";
 	char *schema_path = default_schema_path;
-	store->table_api.table_insert(m->session->tr, uinfo, &username, &fullname, &schema_id, &schema_path);
+	// default values
+	char *optimizer = default_optimizer;
+	lng max_memory = 0;
+	int max_workers = 0;
+	sqlid default_role_id = USER_MONETDB;
+
+	store->table_api.table_insert(m->session->tr, uinfo, &username, &fullname, &schema_id, &schema_path, &max_memory,
+		&max_workers, &optimizer, &default_role_id, &hash);
+	GDKfree(hash);
 }
 
 static int
@@ -345,12 +566,30 @@ monet5_schema_has_user(ptr _mvc, sql_sch
 }
 
 static int
-monet5_alter_user(ptr _mvc, str user, str passwd, char enc, sqlid schema_id, str schema_path, str oldpasswd)
+monet5_alter_user(ptr _mvc, str user, str passwd, char enc, sqlid schema_id, str schema_path, str oldpasswd, sqlid
+		role_id)
 {
 	mvc *m = (mvc *) _mvc;
 	Client c = MCgetClient(m->clientid);
 	str err;
 	int res = LOG_OK;
+	oid rid = oid_nil;
+
+	sqlstore *store = m->session->tr->store;
+	sql_schema *sys = find_sql_schema(m->session->tr, "sys");
+	sql_table *info = find_sql_table(m->session->tr, sys, "db_user_info");
+	sql_column *users_name = find_sql_column(info, "name");
+
+	if (schema_id || schema_path || role_id) {
+		rid = store->table_api.column_find_row(m->session->tr, users_name, user, NULL);
+		// user should be checked here since the way `ALTER USER ident ...` stmt is
+		if (is_oid_nil(rid)) {
+			(void) sql_error(m, 02, "ALTER USER: local inconsistency, "
+				 "your database is damaged, auth not found in SQL catalog");
+			return FALSE;
+		}
+	}
+
 
 	if (passwd != NULL) {
 		str pwd = NULL;
@@ -373,30 +612,19 @@ monet5_alter_user(ptr _mvc, str user, st
 			pwd = passwd;
 			opwd = oldpasswd;
 		}
-		if (user == NULL) {
-			err = AUTHchangePassword(c, opwd, pwd);
-			if (!enc) {
-				free(pwd);
-				free(opwd);
-			}
-			if (err !=MAL_SUCCEED) {
-				(void) sql_error(m, 02, "ALTER USER: %s", getExceptionMessage(err));
-				freeException(err);
-				return (FALSE);
-			}
-		} else {
+
+		if (user) {
+			// verify query user value is not the session user
 			str username = NULL;
-			if ((err = AUTHresolveUser(&username, c->user)) !=MAL_SUCCEED) {
+			if ((username = getUserName(m, c->user)) == NULL) {
 				if (!enc) {
 					free(pwd);
 					free(opwd);
 				}
-				(void) sql_error(m, 02, "ALTER USER: %s", getExceptionMessage(err));
-				freeException(err);
+				(void) sql_error(m, 02, "ALTER USER: invalid user");
 				return (FALSE);
 			}
 			if (strcmp(username, user) == 0) {
-				/* avoid message about changePassword (from MAL level) */
 				GDKfree(username);
 				if (!enc) {
 					free(pwd);
@@ -409,32 +637,42 @@ monet5_alter_user(ptr _mvc, str user, st
 				return (FALSE);
 			}
 			GDKfree(username);
-			err = AUTHsetPassword(c, user, pwd);
-			if (!enc) {
-				free(pwd);
-				free(opwd);
-			}
-			if (err !=MAL_SUCCEED) {
+			// verify current user is MAL_ADMIN ?
+			if ((err = AUTHrequireAdmin(c)) != MAL_SUCCEED) {
 				(void) sql_error(m, 02, "ALTER USER: %s", getExceptionMessage(err));
 				freeException(err);
+				if (!enc) {
+					free(pwd);
+					free(opwd);
+				}
+				return (FALSE);
+			}
+			if (setUserPassword(m, getUserOIDByName(m, user), pwd) != LOG_OK) {
+				if (!enc) {
+					free(pwd);
+					free(opwd);
+				}
 				return (FALSE);
 			}
+
+		} else {
+			if (changeUserPassword(m, c->user, opwd, pwd) != LOG_OK) {
+				if (!enc) {
+					free(pwd);
+					free(opwd);
+				}
+				return (FALSE);
+			}
+		}
+		if (!enc) {
+			free(pwd);
+			free(opwd);
 		}
 	}
 
-	sqlstore *store = m->session->tr->store;
 	if (schema_id) {
-		sql_schema *sys = find_sql_schema(m->session->tr, "sys");
-		sql_table *info = find_sql_table(m->session->tr, sys, "db_user_info");
-		sql_column *users_name = find_sql_column(info, "name");
 		sql_column *users_schema = find_sql_column(info, "default_schema");
 
-		oid rid = store->table_api.column_find_row(m->session->tr, users_name, user, NULL);
-		if (is_oid_nil(rid)) {
-			(void) sql_error(m, 02, "ALTER USER: local inconsistency, "
-				 "your database is damaged, auth not found in SQL catalog");
-			return FALSE;
-		}
 		if ((res = store->table_api.column_update_value(m->session->tr, users_schema, rid, &schema_id))) {
 			(void) sql_error(m, 02, SQLSTATE(42000) "ALTER USER: failed%s",
 							res == LOG_CONFLICT ? " due to conflict with another transaction" : "");
@@ -443,9 +681,6 @@ monet5_alter_user(ptr _mvc, str user, st
 	}
 
 	if (schema_path) {
-		sql_schema *sys = find_sql_schema(m->session->tr, "sys");
-		sql_table *info = find_sql_table(m->session->tr, sys, "db_user_info");
-		sql_column *users_name = find_sql_column(info, "name");
 		sql_column *sp = find_sql_column(info, "schema_path");
 
 		if ((err = parse_schema_path_str(m, schema_path, false)) != MAL_SUCCEED) {
@@ -454,12 +689,6 @@ monet5_alter_user(ptr _mvc, str user, st
 			return (FALSE);
 		}
 
-		oid rid = store->table_api.column_find_row(m->session->tr, users_name, user, NULL);
-		if (is_oid_nil(rid)) {
-			(void) sql_error(m, 02, "ALTER USER: local inconsistency, "
-				 "your database is damaged, auth not found in SQL catalog");
-			return FALSE;
-		}
 		if ((res = store->table_api.column_update_value(m->session->tr, sp, rid, schema_path))) {
 			(void) sql_error(m, 02, SQLSTATE(42000) "ALTER USER: failed%s",
 							res == LOG_CONFLICT ? " due to conflict with another transaction" : "");
@@ -467,6 +696,17 @@ monet5_alter_user(ptr _mvc, str user, st
 		}
 	}
 
+	if (role_id) {
+		sql_column *users_role = find_sql_column(info, "default_role");
+
+		if ((res = store->table_api.column_update_value(m->session->tr, users_role, rid, &role_id))) {
+			(void) sql_error(m, 02, SQLSTATE(42000) "ALTER USER: failed%s",
+							res == LOG_CONFLICT ? " due to conflict with another transaction" : "");
+			return (FALSE);
+		}
+
+	}
+
 	return TRUE;
 }
 
@@ -474,8 +714,6 @@ static int
 monet5_rename_user(ptr _mvc, str olduser, str newuser)
 {
 	mvc *m = (mvc *) _mvc;
-	Client c = MCgetClient(m->clientid);
-	str err;
 	oid rid;
 	sql_schema *sys = find_sql_schema(m->session->tr, "sys");
 	sql_table *info = find_sql_table(m->session->tr, sys, "db_user_info");
@@ -484,12 +722,6 @@ monet5_rename_user(ptr _mvc, str olduser
 	sql_column *auths_name = find_sql_column(auths, "name");
 	int res = LOG_OK;
 
-	if ((err = AUTHchangeUsername(c, olduser, newuser)) !=MAL_SUCCEED) {
-		(void) sql_error(m, 02, "ALTER USER: %s", getExceptionMessage(err));
-		freeException(err);
-		return (FALSE);
-	}
-
 	sqlstore *store = m->session->tr->store;
 	rid = store->table_api.column_find_row(m->session->tr, users_name, olduser, NULL);
 	if (is_oid_nil(rid)) {
@@ -548,11 +780,13 @@ monet5_user_init(backend_functions *be_f
 	be_funcs->fcuser = &monet5_create_user;
 	be_funcs->fduser = &monet5_drop_user;
 	be_funcs->ffuser = &monet5_find_user;
+	be_funcs->ffrole = &monet5_find_role;
 	be_funcs->fcrpriv = &monet5_create_privileges;
 	be_funcs->fshuser = &monet5_schema_has_user;
 	be_funcs->fauser = &monet5_alter_user;
 	be_funcs->fruser = &monet5_rename_user;
 	be_funcs->fschuserdep = &monet5_schema_user_dependencies;
+	be_funcs->fset_user_api_hooks = &monet5_set_user_api_hooks;
 }
 
 int
@@ -599,31 +833,31 @@ int
 monet5_user_set_def_schema(mvc *m, oid user)
 {
 	oid rid;
-	sqlid schema_id;
+	sqlid schema_id, default_role_id;
 	sql_schema *sys = NULL;
 	sql_table *user_info = NULL;
 	sql_column *users_name = NULL;
 	sql_column *users_schema = NULL;
 	sql_column *users_schema_path = NULL;
+	sql_column *users_default_role = NULL;
 	sql_table *schemas = NULL;
 	sql_column *schemas_name = NULL;
 	sql_column *schemas_id = NULL;
 	sql_table *auths = NULL;
 	sql_column *auths_id = NULL;
 	sql_column *auths_name = NULL;
-	str path_err = NULL, other = NULL, schema = NULL, schema_cpy, schema_path = NULL, username = NULL, err = NULL;
+	str path_err = NULL, other = NULL, schema = NULL, schema_cpy, schema_path = NULL, username = NULL, userrole = NULL;
 	int ok = 1, res = 0;
 
 	TRC_DEBUG(SQL_TRANS, OIDFMT "\n", user);
 
-	if ((err = AUTHresolveUser(&username, user)) != MAL_SUCCEED) {
-		freeException(err);
-		return -1;
+	if ((res = mvc_trans(m)) < 0) {
+		// we have -1 here
+		return res;
 	}
 
-	if ((res = mvc_trans(m)) < 0) {
-		GDKfree(username);
-		return res;
+	if ((username = getUserName(m, user)) == NULL) {
+		return -1;
 	}
 
 	sys = find_sql_schema(m->session->tr, "sys");
@@ -631,6 +865,7 @@ monet5_user_set_def_schema(mvc *m, oid u
 	users_name = find_sql_column(user_info, "name");
 	users_schema = find_sql_column(user_info, "default_schema");
 	users_schema_path = find_sql_column(user_info, "schema_path");
+	users_default_role = find_sql_column(user_info, "default_role");
 
 	sqlstore *store = m->session->tr->store;
 	rid = store->table_api.column_find_row(m->session->tr, users_name, username, NULL);
@@ -648,6 +883,8 @@ monet5_user_set_def_schema(mvc *m, oid u
 		return -1;
 	}
 
+	default_role_id = store->table_api.column_find_sqlid(m->session->tr, users_default_role, rid);
+
 	schemas = find_sql_table(m->session->tr, sys, "schemas");
 	schemas_name = find_sql_column(schemas, "name");
 	schemas_id = find_sql_column(schemas, "id");
@@ -683,7 +920,26 @@ monet5_user_set_def_schema(mvc *m, oid u
 		_DELETE(schema_path);
 		return -2;
 	}
-	m->user_id = m->role_id = store->table_api.column_find_sqlid(m->session->tr, auths_id, rid);
+
+	m->user_id = store->table_api.column_find_sqlid(m->session->tr, auths_id, rid);
+
+	/* check if role exists */
+	rid = store->table_api.column_find_row(m->session->tr, auths_id, &default_role_id, NULL);
+	if (is_oid_nil(rid)) {
+		if (m->session->tr->active && (other = mvc_rollback(m, 0, NULL, false)) != MAL_SUCCEED)
+			freeException(other);
+		GDKfree(username);
+		_DELETE(schema_path);
+		return -4;
+	}
+	m->role_id = default_role_id;
+	if (!(userrole = store->table_api.column_find_value(m->session->tr, auths_name, rid))) {
+		if (m->session->tr->active && (other = mvc_rollback(m, 0, NULL, false)) != MAL_SUCCEED)
+			freeException(other);
+		GDKfree(username);
+		_DELETE(schema_path);
+		return -1;
+	}
 
 	/* while getting the session's schema, set the search path as well */
 	if (!(ok = mvc_set_schema(m, schema)) || (path_err = parse_schema_path_str(m, schema_path, true)) != MAL_SUCCEED) {
@@ -691,18 +947,21 @@ monet5_user_set_def_schema(mvc *m, oid u
 			freeException(other);
 		GDKfree(username);
 		_DELETE(schema_path);
+		_DELETE(userrole);
 		freeException(path_err);
 		return ok == 0 ? -3 : -1;
 	}
 
+
 	/* reset the user and schema names */
 	if (!sqlvar_set_string(find_global_var(m, sys, "current_schema"), schema) ||
 		!sqlvar_set_string(find_global_var(m, sys, "current_user"), username) ||
-		!sqlvar_set_string(find_global_var(m, sys, "current_role"), username)) {
+		!sqlvar_set_string(find_global_var(m, sys, "current_role"), userrole)) {
 		res = -1;
 	}
 	GDKfree(username);
 	_DELETE(schema_path);
+	_DELETE(userrole);
 	if ((other = mvc_rollback(m, 0, NULL, false)) != MAL_SUCCEED) {
 		freeException(other);
 		return -1;

--- a/sql/backends/monet5/sql_user.h
+++ b/sql/backends/monet5/sql_user.h
@@ -14,7 +14,6 @@ extern void monet5_user_init(backend_fun
 extern int monet5_user_set_def_schema(mvc *m, oid user /* mal user id */);
 extern int monet5_user_get_def_schema(mvc *m, int user /* sql user id */, str *schema);
 
-extern str db_users_wrap(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci);
-extern str db_password_wrap(Client cntxt, MalBlkPtr mb, MalStkPtr stk, InstrPtr pci);
+extern str monet5_password_hash(mvc *m, const char *username);
 
 #endif /* _SQL_USER_H_ */

--- a/sql/common/sql_backend.c
+++ b/sql/common/sql_backend.c
@@ -35,10 +35,11 @@ backend_freecode(const char *mod, int cl
 }
 
 char *
-backend_create_user(ptr mvc, char *user, char *passwd, char enc, char *fullname, sqlid defschemid, char *schema_path, sqlid grantor)
+backend_create_user(ptr mvc, char *user, char *passwd, char enc, char *fullname, sqlid defschemid, char *schema_path, sqlid grantor, lng max_memory, int max_workers, char *optimizer, sqlid role_id)
 {
 	if (be_funcs.fcuser != NULL)
-		return(be_funcs.fcuser(mvc, user, passwd, enc, fullname, defschemid, schema_path, grantor));
+		return(be_funcs.fcuser(mvc, user, passwd, enc, fullname, defschemid, schema_path, grantor, max_memory,
+					max_workers, optimizer, role_id));
 	return(NULL);
 }
 
@@ -50,7 +51,7 @@ backend_drop_user(ptr mvc, char *user)
 	return FALSE;
 }
 
-int
+oid
 backend_find_user(ptr m, char *user)
 {
 	if (be_funcs.ffuser != NULL)
@@ -75,10 +76,10 @@ backend_schema_has_user(ptr mvc, sql_sch
 
 int
 backend_alter_user(ptr mvc, str user, str passwd, char enc,
-				   sqlid schema_id, char *schema_path, str oldpasswd)
+				   sqlid schema_id, char *schema_path, str oldpasswd, sqlid role_id)
 {
 	if (be_funcs.fauser != NULL)
-		return(be_funcs.fauser(mvc, user, passwd, enc, schema_id, schema_path, oldpasswd));
+		return(be_funcs.fauser(mvc, user, passwd, enc, schema_id, schema_path, oldpasswd, role_id));
 	return(FALSE);
 }
 
@@ -113,3 +114,19 @@ backend_has_module(ptr M, char *name)
 		return be_funcs.fhas_module_function(M, name);
 	return 0;
 }
+
+int
+backend_find_role(ptr mvc, char *name, sqlid *role_id)
+{
+	if (be_funcs.ffrole != NULL)
+		return be_funcs.ffrole(mvc, name, role_id);
+	return 0;
+}
+
+
+void
+backend_set_user_api_hooks(ptr mvc)
+{
+	if (be_funcs.fset_user_api_hooks != NULL)
+		be_funcs.fset_user_api_hooks(mvc);
+}

--- a/sql/common/sql_backend.h
+++ b/sql/common/sql_backend.h
@@ -15,18 +15,20 @@
 
 typedef void (*freecode_fptr) (const char *mod, int clientid, const char *name);
 
-typedef char *(*create_user_fptr) (ptr mvc, char *user, char *passwd, char enc, char *fullname, sqlid schema_id, char *schema_path, sqlid grantor_id);
+typedef char *(*create_user_fptr) (ptr mvc, char *user, char *passwd, char enc, char *fullname, sqlid schema_id, char *schema_path, sqlid grantor_id, lng max_memory, int max_workers, str optimizer, sqlid role_id);
 typedef int  (*drop_user_fptr) (ptr mvc, char *user);
-typedef int  (*find_user_fptr) (ptr mvc, char *user);
+typedef oid  (*find_user_fptr) (ptr mvc, char *user);
 typedef void (*create_privileges_fptr) (ptr mvc, sql_schema *s);
 typedef int  (*schema_has_user_fptr) (ptr mvc, sql_schema *s);
-typedef int  (*alter_user_fptr) (ptr mvc, str user, str passwd, char enc, sqlid schema_id, char *schema_path, str oldpasswd);
+typedef int  (*alter_user_fptr) (ptr mvc, str user, str passwd, char enc, sqlid schema_id, char *schema_path, str oldpasswd, sqlid role_id);
 typedef int  (*rename_user_fptr) (ptr mvc, str olduser, str newuser);
 typedef void*  (*schema_user_dependencies) (ptr mvc, int schema_id);
 typedef void  (*create_function) (ptr mvc, str name, sql_rel *rel, sql_table *t);
 typedef int  (*resolve_function) (ptr mvc, sql_func *f, const char *fimp, bool *side_effect);
 typedef int  (*has_module_function) (ptr mvc, char *name);
 typedef void *(*create_sub_backend) (void *mvc, void *client);
+typedef int  (*find_role_fptr) (ptr mvc, char *role, sqlid *role_id);
+typedef void (*set_user_api_hooks_fptr)(ptr mvc);
 
 /* backing struct for this interface */
 typedef struct _backend_functions {
@@ -34,6 +36,7 @@ typedef struct _backend_functions {
 	create_user_fptr fcuser;
 	drop_user_fptr fduser;
 	find_user_fptr ffuser;
+	find_role_fptr ffrole;
 	create_privileges_fptr fcrpriv;
 	schema_has_user_fptr fshuser;
 	alter_user_fptr fauser;
@@ -42,20 +45,23 @@ typedef struct _backend_functions {
 	resolve_function fresolve_function;
 	has_module_function fhas_module_function;
 	create_sub_backend sub_backend;
+	set_user_api_hooks_fptr fset_user_api_hooks;
 } backend_functions;
 
 extern void backend_freecode(const char *mod, int clientid, const char *name);
 
-extern char *backend_create_user(ptr mvc, char *user, char *passwd, char enc, char *fullname, sqlid defschemid, char *schema_path, sqlid grantor);
+extern char *backend_create_user(ptr mvc, char *user, char *passwd, char enc, char *fullname, sqlid defschemid, char *schema_path, sqlid grantor, lng max_memory, int max_workers, char *optimizer, sqlid role_id);
 extern int  backend_drop_user(ptr mvc, char *user);
-extern int  backend_find_user(ptr mp, char *user);
+extern oid  backend_find_user(ptr mp, char *user);
 extern void backend_create_privileges(ptr mvc, sql_schema *s);
 extern int  backend_schema_has_user(ptr mvc, sql_schema *s);
-extern int	backend_alter_user(ptr mvc, str user, str passwd, char enc, sqlid schema_id, char *schema_path, str oldpasswd);
+extern int	backend_alter_user(ptr mvc, str user, str passwd, char enc, sqlid schema_id, char *schema_path, str oldpasswd, sqlid role_id);
 extern int	backend_rename_user(ptr mvc, str olduser, str newuser);
 extern void*	backend_schema_user_dependencies(ptr trans, sqlid schema_id);
 extern int	backend_resolve_function(ptr trans, sql_func *f, const char *fimp, bool *side_effect);
 extern int	backend_has_module(ptr M, char *name);
+extern int  backend_find_role(ptr mp, char *role, sqlid *role_id);
+extern void backend_set_user_api_hooks(ptr mvc);
 
 extern backend_functions be_funcs;
 

--- a/sql/scripts/10_sys_schema_extension.sql
+++ b/sql/scripts/10_sys_schema_extension.sql
@@ -504,11 +504,13 @@ ALTER TABLE sys.privilege_codes SET READ
 GRANT SELECT ON sys.privilege_codes TO PUBLIC;
 
 
--- Utility view to list the defined roles.
+-- Utility views to list the defined roles and users.
 -- Note: sys.auths contains both users and roles as the names must be distinct.
-CREATE VIEW sys.roles AS SELECT id, name, grantor FROM sys.auths a WHERE a.name NOT IN (SELECT u.name FROM sys.db_users() u);
+CREATE VIEW sys.roles AS SELECT id, name, grantor FROM sys.auths a WHERE a.name NOT IN (SELECT u.name FROM sys.db_user_info u);
 GRANT SELECT ON sys.roles TO PUBLIC;
-
+CREATE VIEW sys.users AS SELECT name, fullname, default_schema, schema_path, max_memory, max_workers, optimizer, default_role FROM sys.db_user_info;
+GRANT SELECT ON sys.users TO PUBLIC;
+CREATE FUNCTION sys.db_users() RETURNS TABLE(name VARCHAR(2048)) RETURN SELECT name FROM sys.db_user_info;
 
 -- Utility view to list the standard variables (as defined in sys.var()) and their run-time value
 CREATE VIEW sys.var_values (var_name, value) AS

--- a/sql/scripts/21_dependency_views.sql
+++ b/sql/scripts/21_dependency_views.sql
@@ -157,7 +157,7 @@ GRANT SELECT ON sys.dependency_functions
 -- Schema s has a dependency on user u.
 CREATE VIEW sys.dependency_schemas_on_users AS
 SELECT s.id AS schema_id, s.name AS schema_name, u.name AS user_name, CAST(6 AS smallint) AS depend_type
-  FROM sys.users AS u, sys.schemas AS s
+  FROM sys.db_user_info AS u, sys.schemas AS s
  WHERE u.default_schema = s.id
  ORDER BY s.name, u.name;
 

--- a/sql/scripts/22_clients.sql
+++ b/sql/scripts/22_clients.sql
@@ -6,7 +6,8 @@
 
 create function sys.password_hash (username string)
 	returns string
-	external name sql.password;
+    external name sql.password;
+	-- return select password from users where name = username;
 
 create function sys.remote_table_credentials (tablename string)
 returns table ("uri" string, "username" string, "hash" string)

--- a/sql/server/rel_schema.c
+++ b/sql/server/rel_schema.c
@@ -2262,7 +2262,7 @@ rel_create_index(mvc *sql, char *iname, 
 }
 
 static sql_rel *
-rel_create_user(sql_allocator *sa, char *user, char *passwd, int enc, char *fullname, char *schema, char *schema_path)
+rel_create_user(sql_allocator *sa, char *user, char *passwd, int enc, char *fullname, char *schema, char *schema_path, lng max_memory, int max_workers, char *optimizer, char *default_role)
 {
 	sql_rel *rel = rel_create(sa);
 	list *exps = new_exp_list(sa);
@@ -2275,6 +2275,10 @@ rel_create_user(sql_allocator *sa, char 
 	append(exps, exp_atom_clob(sa, schema));
 	append(exps, exp_atom_clob(sa, schema_path));
 	append(exps, exp_atom_clob(sa, fullname));
+	append(exps, exp_atom_lng(sa, max_memory));
+	append(exps, exp_atom_int(sa, max_workers));
+	append(exps, exp_atom_clob(sa, optimizer));
+	append(exps, exp_atom_clob(sa, default_role));
 	rel->l = NULL;
 	rel->r = NULL;
 	rel->op = op_ddl;
@@ -2286,7 +2290,7 @@ rel_create_user(sql_allocator *sa, char 
 }
 
 static sql_rel *
-rel_alter_user(sql_allocator *sa, char *user, char *passwd, int enc, char *schema, char *schema_path, char *oldpasswd)
+rel_alter_user(sql_allocator *sa, char *user, char *passwd, int enc, char *schema, char *schema_path, char *oldpasswd, char *role)
 {
 	sql_rel *rel = rel_create(sa);
 	list *exps = new_exp_list(sa);
@@ -2299,6 +2303,7 @@ rel_alter_user(sql_allocator *sa, char *
 	append(exps, exp_atom_clob(sa, schema));
 	append(exps, exp_atom_clob(sa, schema_path));
 	append(exps, exp_atom_clob(sa, oldpasswd));
+	append(exps, exp_atom_clob(sa, role));
 	rel->l = NULL;
 	rel->r = NULL;
 	rel->op = op_ddl;
@@ -2913,13 +2918,18 @@ rel_schemas(sql_query *query, symbol *s)
 	} 	break;
 	case SQL_CREATE_USER: {
 		dlist *l = s->data.lval;
+		dlist *schema_details = l->h->next->next->next->data.lval;
 
 		ret = rel_create_user(sql->sa, l->h->data.sval,	/* user name */
 				  l->h->next->data.sval,	/* password */
-				  l->h->next->next->next->next->next->data.i_val == SQL_PW_ENCRYPTED, /* encrypted */
+				  l->h->next->next->next->next->data.i_val == SQL_PW_ENCRYPTED, /* encrypted */
 				  l->h->next->next->data.sval,	/* fullname */
-				  l->h->next->next->next->data.sval,	/* dschema */
-				  l->h->next->next->next->next->data.sval);	/* schema path */
+				  schema_details->h->data.sval,	/* schema ident*/
+				  schema_details->h->next->data.sval,	/* schema path */
+				  l->h->next->next->next->next->next->data.l_val,	/* max memory */
+				  l->h->next->next->next->next->next->next->data.i_val, /* max workers */
+				  l->h->next->next->next->next->next->next->next->data.sval, /* optimizer */
+				  l->h->next->next->next->next->next->next->next->next->data.sval); /* default role */
 	} 	break;
 	case SQL_DROP_USER:
 		ret = rel_schema2(sql->sa, ddl_drop_user, s->data.sval, NULL, 0);
@@ -2933,7 +2943,8 @@ rel_schemas(sql_query *query, symbol *s)
 			     a->next->next->next->data.i_val == SQL_PW_ENCRYPTED, /* encrypted */
 			     a->next->data.sval,	/* schema */
 				 a->next->next->data.sval, /* schema path */
-			     a->next->next->next->next->data.sval /* old passwd */
+			     a->next->next->next->next->data.sval, /* old passwd */
+			     l->h->next->next->data.sval /* default role */
 		    );
 	} 	break;
 	case SQL_RENAME_USER: {

--- a/sql/server/sql_mvc.c
+++ b/sql/server/sql_mvc.c
@@ -404,6 +404,8 @@ mvc_init(int debug, store_type store_tpe
 		return NULL;
 	}
 
+	// set SQL user callbacks in MAL authorization
+	sql_set_user_api_hooks(m);
 	mvc_destroy(m);
 	return store;
 }
@@ -1117,7 +1119,7 @@ int
 mvc_create_schema(mvc *m, const char *name, sqlid auth_id, sqlid owner)
 {
 	TRC_DEBUG(SQL_TRANS, "Create schema: %s %d %d\n", name, auth_id, owner);
-	return sql_trans_create_schema(m->session->tr, name, auth_id, owner);
+	return sql_trans_create_schema(m->session->tr, name, auth_id, owner, NULL);
 }
 
 int

--- a/sql/server/sql_parser.y
+++ b/sql/server/sql_parser.y
@@ -413,7 +413,7 @@ int yydebug=1;
 	string
 	type_alias
 	user_schema
-	user_schema_path
+	opt_schema_path
 	ustring
 	varchar
 	window_ident_clause
@@ -421,6 +421,9 @@ int yydebug=1;
 	XML_element_name
 	XML_namespace_prefix
 	XML_PI_target
+    opt_optimizer
+    opt_default_role
+    
 
 %type <l>
 	argument_list
@@ -522,6 +525,7 @@ int yydebug=1;
 	XML_element_content_and_option
 	XML_element_content_list
 	XML_value_expression_list
+    opt_schema_details_list
 
 %type <i_val>
 	_transaction_mode_list
@@ -578,11 +582,14 @@ int yydebug=1;
 	with_or_without_data
 	XML_content_option
 	XML_whitespace_option
+    opt_max_workers
+
 
 %type <l_val>
 	lngval
 	poslng
 	nonzerolng
+    opt_max_memory
 
 %type <bval>
 	create
@@ -711,6 +718,7 @@ SQLCODE SQLERROR UNDER WHENEVER
 %token OVER PARTITION CURRENT EXCLUDE FOLLOWING PRECEDING OTHERS TIES RANGE UNBOUNDED GROUPS WINDOW
 
 %token X_BODY 
+%token MAX_MEMORY MAX_WORKERS OPTIMIZER
 %%
 
 sqlstmt:
@@ -1038,7 +1046,7 @@ opt_with_grant:
  ;
 
 opt_with_admin:
-	/* emtpy */		{ $$ = 0; }
+	/* emtpy */		    { $$ = 0; }
  |	WITH ADMIN OPTION	{ $$ = 1; }
  ;
 
@@ -1224,10 +1232,10 @@ alter_statement:
 	  append_string(l, $7);
 	  append_int(l, $3);
 	  $$ = _symbol_create_list( SQL_SET_TABLE_SCHEMA, l ); }
- | ALTER USER ident opt_with_encrypted_password user_schema user_schema_path
+ | ALTER USER ident opt_with_encrypted_password user_schema opt_schema_path opt_default_role
 	{ dlist *l = L(), *p = L();
-	  if (!$4 && !$5 && !$6) {
-		yyerror(m, "ALTER USER: At least one property should be updatd");
+	  if (!$4 && !$5 && !$6 && !$7) {
+		yyerror(m, "ALTER USER: At least one property should be updated");
 		YYABORT;
 	  }
 	  append_string(l, $3);
@@ -1237,6 +1245,7 @@ alter_statement:
 	  append_int(p, $4 ? $4->h->next->data.i_val : 0);
 	  append_string(p, NULL);
 	  append_list(l, p);
+	  append_string(l, $7);
 	  $$ = _symbol_create_list( SQL_ALTER_USER, l ); }
  | ALTER USER ident RENAME TO ident
 	{ dlist *l = L();
@@ -1253,6 +1262,7 @@ alter_statement:
 	  append_int(p, $4);
 	  append_string(p, $10);
 	  append_list(l, p);
+	  append_string(l, NULL);
 	  $$ = _symbol_create_list( SQL_ALTER_USER, l ); }
  | ALTER SCHEMA if_exists ident RENAME TO ident
 	{ dlist *l = L();
@@ -1272,11 +1282,12 @@ user_schema:
  |  /* empty */			{ $$ = NULL; }
  ;
 
-user_schema_path:
+opt_schema_path:
 	SCHEMA PATH string	{ $$ = $3; }
  |  /* empty */			{ $$ = NULL; }
  ;
 
+
 alter_table_element:
 	opt_column ident SET DEFAULT default_value
 	{ dlist *l = L();
@@ -1474,17 +1485,52 @@ role_def:
 	  append_string(l, $2);
 	  append_int(l, $3);
 	  $$ = _symbol_create_list( SQL_CREATE_ROLE, l ); }
- |  USER ident WITH opt_encrypted PASSWORD string sqlNAME string SCHEMA ident user_schema_path
-	{ dlist *l = L();
+ |  USER ident WITH opt_encrypted PASSWORD string sqlNAME string opt_schema_details_list opt_max_memory opt_max_workers opt_optimizer opt_default_role
+    { dlist *l = L();
 	  append_string(l, $2);
 	  append_string(l, $6);
 	  append_string(l, $8);
-	  append_string(l, $10);
-	  append_string(l, $11);
+	  append_list(l, $9);
 	  append_int(l, $4);
+      append_lng(l, $10);
+      append_int(l, $11);
+	  append_string(l, $12);
+      append_string(l, $13);
 	  $$ = _symbol_create_list( SQL_CREATE_USER, l ); }
  ;
 
+opt_max_memory:
+    /* empty */         { $$ = 0; }
+ |  MAX_MEMORY poslng   { $$ = $2; }
+ ;
+
+opt_max_workers:
+    /* empty */         { $$ = 0; }
+ |  MAX_WORKERS posint  { $$ = $2; }
+ ;
+    
+opt_optimizer:
+    /* empty */         { $$ = NULL; }
+ |  OPTIMIZER string    { $$ = $2; }
+ ;
+
+opt_default_role:
+    /* empty */           { $$ = NULL; }
+ |  DEFAULT ROLE ident    { $$ = $3; }
+ ;
+
+opt_schema_details_list:
+    opt_schema_path     
+    { dlist *l = L();
+      append_string(l, NULL);
+      $$ = append_string(l, $1);}
+ |  SCHEMA ident opt_schema_path
+    { dlist *l = L();
+      append_string(l, $2);
+      $$ = append_string(l, $3);}
+ ;
+
+
 opt_encrypted:
     /* empty */		{ $$ = SQL_PW_UNENCRYPTED; }
  |  UNENCRYPTED		{ $$ = SQL_PW_UNENCRYPTED; }

--- a/sql/server/sql_privileges.c
+++ b/sql/server/sql_privileges.c
@@ -579,7 +579,7 @@ sql_grant_role(mvc *m, str grantee, str 
 	if (is_oid_nil(rid))
 		throw(SQL, "sql.grant_role", SQLSTATE(M1M05) "GRANT: no such role '%s' or grantee '%s'", role, grantee);
 	role_id = store->table_api.column_find_sqlid(m->session->tr, auths_id, rid);
-	if (backend_find_user(m, role) >= 0)
+	if (!is_oid_nil(backend_find_user(m, role)))
 		throw(SQL,"sql.grant_role", SQLSTATE(M1M05) "GRANT: '%s' is a USER not a ROLE", role);
 	if (!admin_privs(grantor) && !role_granting_privs(m, rid, role_id, grantor))
 		throw(SQL,"sql.grant_role", SQLSTATE(0P000) "GRANT: Insufficient privileges to grant ROLE '%s'", role);
@@ -775,27 +775,45 @@ mvc_set_schema(mvc *m, char *schema)
 }
 
 char *
-sql_create_user(mvc *sql, char *user, char *passwd, char enc, char *fullname, char *schema, char *schema_path)
+sql_create_user(mvc *sql, char *user, char *passwd, char enc, char *fullname, char *schema, char *schema_path, lng max_memory, int max_workers, char *optimizer, char *role)
 {
 	char *err;
 	sql_schema *s = NULL;
 	sqlid schema_id = 0;
+	sqlid role_id = 0;
+
+	if (role)
+		if (backend_find_role(sql, role, &role_id) < 0)
+			throw(SQL,"sql.create_user", SQLSTATE(42M31) "CREATE USER: no such role '%s'", role);
 
 	if (!admin_privs(sql->user_id) && !admin_privs(sql->role_id))
 		throw(SQL,"sql.create_user", SQLSTATE(42M31) "Insufficient privileges to create user '%s'", user);
 
-	if (backend_find_user(sql, user) >= 0)
-		throw(SQL,"sql.create_user", SQLSTATE(42M31) "CREATE USER: user '%s' already exists", user);	
+	if (!is_oid_nil(backend_find_user(sql, user)))
+		throw(SQL,"sql.create_user", SQLSTATE(42M31) "CREATE USER: user '%s' already exists", user);
+
+	if (schema) {
+		if (!(s = find_sql_schema(sql->session->tr, schema)))
+			throw(SQL,"sql.create_user", SQLSTATE(3F000) "CREATE USER: no such schema '%s'", schema);
+		schema_id = s->base.id;
+		if (!isNew(s) && sql_trans_add_dependency(sql->session->tr, schema_id, ddl) != LOG_OK)
+			throw(SQL, "sql.create_user", SQLSTATE(HY013) MAL_MALLOC_FAIL);
 
-	if (!(s = find_sql_schema(sql->session->tr, schema)))
-		throw(SQL,"sql.create_user", SQLSTATE(3F000) "CREATE USER: no such schema '%s'", schema);
-	schema_id = s->base.id;
-	if (!isNew(s) && sql_trans_add_dependency(sql->session->tr, schema_id, ddl) != LOG_OK)
-		throw(SQL, "sql.create_user", SQLSTATE(HY013) MAL_MALLOC_FAIL);
+	} else {
+		// look for an existing schema matching user
+		if ((s = find_sql_schema(sql->session->tr, user))) {
+			schema_id = s->base.id;
+			if (!isNew(s) && sql_trans_add_dependency(sql->session->tr, schema_id, ddl) != LOG_OK)
+				throw(SQL, "sql.create_user", SQLSTATE(HY013) MAL_MALLOC_FAIL);
+		}
+	}
+
+
 	if (sql_trans_add_dependency(sql->session->tr, sql->user_id, ddl) != LOG_OK)
 		throw(SQL, "sql.create_user", SQLSTATE(HY013) MAL_MALLOC_FAIL);
 
-	if ((err = backend_create_user(sql, user, passwd, enc, fullname, schema_id, schema_path, sql->user_id)) != NULL)
+	if ((err = backend_create_user(sql, user, passwd, enc, fullname, schema_id, schema_path, sql->user_id, max_memory,
+					max_workers, optimizer, role_id)) != NULL)
 	{
 		/* strip off MAL exception decorations */
 		char *r;
@@ -811,6 +829,7 @@ sql_create_user(mvc *sql, char *user, ch
 		_DELETE(err);
 		return r;
 	}
+
 	return NULL;
 }
 
@@ -915,10 +934,15 @@ sql_drop_user(mvc *sql, char *user)
 }
 
 char *
-sql_alter_user(mvc *sql, char *user, char *passwd, char enc, char *schema, char *schema_path, char *oldpasswd)
+sql_alter_user(mvc *sql, char *user, char *passwd, char enc, char *schema, char *schema_path, char *oldpasswd, char *role)
 {
 	sql_schema *s = NULL;
 	sqlid schema_id = 0;
+	sqlid role_id = 0;
+
+	if (role)
+		if (backend_find_role(sql, role, &role_id) < 0)
+			throw(SQL,"sql.create_user", SQLSTATE(42M31) "ALTER USER: no such role '%s'", role);
 
 	/* we may be called from MAL (nil) */
 	if (strNil(user))
@@ -928,7 +952,7 @@ sql_alter_user(mvc *sql, char *user, cha
 	if (!admin_privs(sql->user_id) && !admin_privs(sql->role_id) && user != NULL && strcmp(user, get_string_global_var(sql, "current_user")) != 0)
 		throw(SQL,"sql.alter_user", SQLSTATE(M1M05) "Insufficient privileges to change user '%s'", user);
 
-	if (user != NULL && backend_find_user(sql, user) < 0)
+	if (user != NULL && is_oid_nil(backend_find_user(sql, user)))
 		throw(SQL,"sql.alter_user", SQLSTATE(42M32) "ALTER USER: no such user '%s'", user);
 	if (schema) {
 		if (!(s = find_sql_schema(sql->session->tr, schema)))
@@ -937,7 +961,7 @@ sql_alter_user(mvc *sql, char *user, cha
 		if (!isNew(s) && sql_trans_add_dependency(sql->session->tr, s->base.id, ddl) != LOG_OK)
 			throw(SQL, "sql.alter_user", SQLSTATE(HY013) MAL_MALLOC_FAIL);
 	}
-	if (backend_alter_user(sql, user, passwd, enc, schema_id, schema_path, oldpasswd) == FALSE)
+	if (backend_alter_user(sql, user, passwd, enc, schema_id, schema_path, oldpasswd, role_id) == FALSE)
 		throw(SQL,"sql.alter_user", SQLSTATE(M0M27) "%s", sql->errstr);
 	return NULL;
 }
@@ -948,9 +972,9 @@ sql_rename_user(mvc *sql, char *olduser,
 	if (!admin_privs(sql->user_id) && !admin_privs(sql->role_id))
 		throw(SQL,"sql.rename_user", SQLSTATE(M1M05) "ALTER USER: insufficient privileges to rename user '%s'", olduser);
 
-	if (backend_find_user(sql, olduser) < 0)
+	if (is_oid_nil(backend_find_user(sql, olduser)))
 		throw(SQL,"sql.rename_user", SQLSTATE(42M32) "ALTER USER: no such user '%s'", olduser);
-	if (backend_find_user(sql, newuser) >= 0)
+	if (!is_oid_nil(backend_find_user(sql, newuser)))
 		throw(SQL,"sql.rename_user", SQLSTATE(42M31) "ALTER USER: user '%s' already exists", newuser);
 	if (backend_rename_user(sql, olduser, newuser) == FALSE)
 		throw(SQL,"sql.rename_user", SQLSTATE(M1M05) "%s", sql->errstr);
@@ -960,12 +984,13 @@ sql_rename_user(mvc *sql, char *olduser,
 int
 sql_create_privileges(mvc *m, sql_schema *s)
 {
-	int pub, p, zero = 0;
+	int pub, su, p, zero = 0;
 	sql_table *t = NULL, *privs = NULL;
 	sql_column *col = NULL;
 	sql_subfunc *f = NULL;
 	sql_trans *tr = m->session->tr;
 
+	// create db_user_info tbl
 	backend_create_privileges(m, s);
 
 	mvc_create_table(&t, m, s, "user_role", tt_table, 1, SQL_PERSIST, 0, -1, 0);
@@ -991,6 +1016,7 @@ sql_create_privileges(mvc *m, sql_schema
 	sql_create_auth_id(m, USER_MONETDB, "monetdb");
 
 	pub = ROLE_PUBLIC;
+	su = USER_MONETDB;
 	p = PRIV_SELECT;
 	privs = find_sql_table(tr, s, "privileges");
 
@@ -1037,6 +1063,10 @@ sql_create_privileges(mvc *m, sql_schema
 	store->table_api.table_insert(m->session->tr, privs, &t->base.id, &pub, &p, &zero, &zero);
 	t = find_sql_table(tr, s, "value_partitions");
 	store->table_api.table_insert(m->session->tr, privs, &t->base.id, &pub, &p, &zero, &zero);
+	// restrict access to db_user_info to monetdb role
+	t = find_sql_table(tr, s, "db_user_info");
+	store->table_api.table_insert(m->session->tr, privs, &t->base.id, &su, &p, &zero, &zero);
+
 
 	p = PRIV_EXECUTE;
 	f = sql_bind_func_(m, s->base.name, "env", NULL, F_UNION, true);
@@ -1064,3 +1094,9 @@ sql_create_privileges(mvc *m, sql_schema
 
 	return 0;
 }
+
+void
+sql_set_user_api_hooks(mvc *m)
+{
+	backend_set_user_api_hooks(m);
+}

--- a/sql/server/sql_privileges.h
+++ b/sql/server/sql_privileges.h
@@ -40,9 +40,10 @@ extern char *sql_revoke_role(mvc *m, str
 extern int sql_create_privileges(mvc *m, sql_schema *s);
 extern int sql_schema_has_user(mvc *m, sql_schema *s);
 
-extern char * sql_create_user(mvc *sql, char *user, char *passwd, char enc, char *fullname, char *schema, char *schema_path);
+extern char * sql_create_user(mvc *sql, char *user, char *passwd, char enc, char *fullname, char *schema, char *schema_path, lng max_memory, int max_workers, char *optimizer, char *default_role);
 extern char * sql_drop_user(mvc *sql, char *user);
-extern char * sql_alter_user(mvc *sql, char *user, char *passwd, char enc, char *schema, char *schema_path, char *oldpasswd);
+extern char * sql_alter_user(mvc *sql, char *user, char *passwd, char enc, char *schema, char *schema_path, char *oldpasswd, char *role);
 extern char * sql_rename_user(mvc *sql, char *olduser, char *newuser);
+extern void sql_set_user_api_hooks(mvc *m);
 
 #endif /*_SQL_PRIV_H_ */

--- a/sql/storage/bat/bat_logger.c
+++ b/sql/storage/bat/bat_logger.c
@@ -129,7 +129,7 @@ replace_bat(old_logger *old_lg, logger *
 }
 #endif
 
-#if defined CATALOG_JUN2020 || defined CATALOG_OCT2020
+#if defined CATALOG_JUN2020 || defined CATALOG_OCT2020 || defined CATALOG_JAN2022
 static gdk_return
 tabins(logger *lg, old_logger *old_lg, bool first, int tt, int nid, ...)
 {
@@ -1892,6 +1892,7 @@ bl_postversion(void *Store, void *Lg)
 	sqlstore *store = Store;
 	old_logger *old_lg;
 	logger *lg;
+	gdk_return rc;
 
 	if (store->catalog_version < 52300) { /* the watershed */
 		/* called from gdk_logger_old.c; Lg is the old logger */
@@ -2058,7 +2059,6 @@ bl_postversion(void *Store, void *Lg)
 			bat_destroy(funcs);
 			bat_destroy(cands);
 			funcs = NULL;
-			gdk_return rc;
 			rc = GDK_FAIL;
 			if (b != NULL &&
 				(funcs = BATconstant(0, TYPE_msk, &(msk){true}, BATcount(b), TRANSIENT)) != NULL)
@@ -2150,7 +2150,7 @@ bl_postversion(void *Store, void *Lg)
 			bat_destroy(aggrs);
 			bat_destroy(sqlaggr_func);
 			aggrs = NULL;
-			gdk_return rc = GDK_FAIL;
+			rc = GDK_FAIL;
 			if (b != NULL &&
 				(aggrs = BATconstant(0, TYPE_str, "aggr", BATcount(b), TRANSIENT)) != NULL)
 				rc = BATreplace(func_mod, b, aggrs, false);
@@ -2240,7 +2240,7 @@ bl_postversion(void *Store, void *Lg)
 				bat_destroy(cands);
 				return GDK_FAIL;
 			}
-			gdk_return rc = BATreplace(objs_sub, cands, b, false);
+			rc = BATreplace(objs_sub, cands, b, false);
 			bat_destroy(b);
 			if (rc != GDK_SUCCEED) {
 				bat_destroy(objs_id);
@@ -2436,7 +2436,7 @@ bl_postversion(void *Store, void *Lg)
 					bat_destroy(b3);
 					return GDK_FAIL;
 				}
-				gdk_return rc = BATreplace(b3, b1, b2, false);
+				rc = BATreplace(b3, b1, b2, false);
 				bat_destroy(b2);
 				bat_destroy(b3);
 				if (rc != GDK_SUCCEED) {
@@ -2730,7 +2730,7 @@ bl_postversion(void *Store, void *Lg)
 			bat_destroy(func_tid);
 			return GDK_FAIL;
 		}
-		gdk_return rc = GDK_FAIL;
+		rc = GDK_FAIL;
 		BAT *b2 = COLcopy(func_lang, func_lang->ttype, true, PERSISTENT);
 		bat bid = func_lang->batCacheid;
 		if (b2 == NULL ||
@@ -2893,7 +2893,6 @@ bl_postversion(void *Store, void *Lg)
 			bat_destroy(b);
 			return GDK_FAIL;
 		}
-		gdk_return rc;
 		rc = BATreplace(func_se, b, vals, false);
 		bat_destroy(b);
 		bat_destroy(vals);
@@ -2989,7 +2988,7 @@ bl_postversion(void *Store, void *Lg)
 				return GDK_FAIL;
 			}
 			BAT *b2 = COLcopy(seq_inc, seq_inc->ttype, true, PERSISTENT);
-			gdk_return rc = GDK_FAIL;
+			rc = GDK_FAIL;
 			if (b2 == NULL)
 				rc = BATreplace(b2, inczero, b, false);
 			bat_destroy(b);
@@ -3036,7 +3035,7 @@ bl_postversion(void *Store, void *Lg)
 		if (BATcount(cands) > 0) {
 			BAT *b = BATconstant(0, TYPE_lng, &(lng){GDK_lng_max}, BATcount(cands), TRANSIENT);
 			BAT *b2 = COLcopy(seq_max, seq_max->ttype, true, PERSISTENT);
-			gdk_return rc = GDK_FAIL;
+			rc = GDK_FAIL;
 			if (b != NULL && b2 != NULL)
 				rc = BATreplace(b2, cands, b, false);
 			bat_destroy(b);
@@ -3066,7 +3065,7 @@ bl_postversion(void *Store, void *Lg)
 		if (BATcount(cands) > 0) {
 			BAT *b = BATconstant(0, TYPE_lng, &(lng){GDK_lng_min}, BATcount(cands), TRANSIENT);
 			BAT *b2 = COLcopy(seq_min, seq_min->ttype, true, PERSISTENT);
-			gdk_return rc = GDK_FAIL;
+			rc = GDK_FAIL;
 			if (b != NULL && b2 != NULL)
 				rc = BATreplace(b2, cands, b, false);
 			bat_destroy(b);
@@ -3084,6 +3083,111 @@ bl_postversion(void *Store, void *Lg)
 	}
 #endif
 
+#ifdef CATALOG_JAN2022
+	if (store->catalog_version <= CATALOG_JAN2022) {
+		/* GRANT SELECT ON sys.db_user_info TO monetdb;
+		 * except the grantor is 0 instead of user monetdb
+		 *
+		 * we need to find the IDs of the sys.db_user_info table and of
+		 * the sys.privileges table and its columns since none of these
+		 * have fixed IDs */
+		BAT *b = temp_descriptor(log_find_bat(lg, 2067)); /* sys._tables */
+		if (b == NULL)
+			return GDK_FAIL;
+		BAT *del_tabs = BATmaskedcands(0, BATcount(b), b, false);
+		bat_destroy(b);
+		if (del_tabs == NULL)
+			return GDK_FAIL;
+		b = temp_descriptor(log_find_bat(lg, 2076)); /* sys._columns */
+		if (b == NULL) {
+			bat_destroy(del_tabs);
+			return GDK_FAIL;
+		}
+		BAT *del_cols = BATmaskedcands(0, BATcount(b), b, false);
+		bat_destroy(b);
+		b = temp_descriptor(log_find_bat(lg, 2070)); /* sys._tables.schema_id */
+		if (del_cols == NULL || b == NULL) {
+			bat_destroy(del_cols);
+			bat_destroy(b);
+			bat_destroy(del_tabs);
+			return GDK_FAIL;
+		}
+		BAT *cands = BATselect(b, del_tabs, &(int) {2000}, NULL, true, true, false);
+		bat_destroy(b);
+		bat_destroy(del_tabs);
+		/* cands contains undeleted rows from sys._tables for tables in
+		 * sys schema */
+		BAT *tabnme = temp_descriptor(log_find_bat(lg, 2069)); /* sys._tables.name */
+		if (cands == NULL || tabnme == NULL) {
+			bat_destroy(cands);
+			bat_destroy(tabnme);
+			bat_destroy(del_cols);
+			return GDK_FAIL;
+		}
+		b = BATselect(tabnme, cands, "db_user_info", NULL, true, true, false);
+		if (b == NULL) {
+			bat_destroy(cands);
+			bat_destroy(tabnme);
+			bat_destroy(del_cols);
+			return GDK_FAIL;
+		}
+		oid dbpos = BUNtoid(b, 0);
+		bat_destroy(b);
+		b = BATselect(tabnme, cands, "privileges", NULL, true, true, false);
+		bat_destroy(tabnme);
+		bat_destroy(cands);
+		BAT *tabid = temp_descriptor(log_find_bat(lg, 2068)); /* sys._tables.id */
+		if (b == NULL || tabid == NULL) {
+			bat_destroy(b);
+			bat_destroy(tabid);
+			bat_destroy(del_cols);
+			return GDK_FAIL;
+		}
+		int dbid = ((int *) tabid->theap->base)[dbpos];
+		int prid = ((int *) tabid->theap->base)[BUNtoid(b, 0)];
+		BAT *coltid = temp_descriptor(log_find_bat(lg, 2082)); /* sys._columns.table_id */
+		if (coltid == NULL) {
+			bat_destroy(b);
+			bat_destroy(del_cols);
+			bat_destroy(tabid);
+			return GDK_FAIL;
+		}
+		BAT *b1;
+		rc = BATjoin(&b1, NULL, coltid, tabid, del_cols, b, false, 5);
+		bat_destroy(coltid);
+		bat_destroy(tabid);
+		bat_destroy(del_cols);
+		bat_destroy(b);
+		BAT *colnr = temp_descriptor(log_find_bat(lg, 2085)); /* sys._columns.number */
+		BAT *colid = temp_descriptor(log_find_bat(lg, 2077)); /* sys._columns.id */
+		if (rc != GDK_SUCCEED || colnr == NULL || colid == NULL) {
+			if (rc == GDK_SUCCEED)
+				bat_destroy(b1);
+			bat_destroy(colnr);
+			bat_destroy(colid);
+			return GDK_FAIL;
+		}
+		int privids[5];
+		for (int i = 0; i < 5; i++) {
+			oid p = BUNtoid(b1, i);
+			privids[((int *) colnr->theap->base)[p]] = ((int *) colid->theap->base)[p];
+		}
+		bat_destroy(b1);
+		bat_destroy(colnr);
+		bat_destroy(colid);
+		rc = tabins(lg, old_lg, true, -1, 0,
+					prid, &(msk) {false}, /* sys.privileges */
+					privids[0], &dbid, /* sys.privileges.obj_id */
+					privids[1], &(int) {USER_MONETDB}, /* sys.privileges.auth_id */
+					privids[2], &(int) {PRIV_SELECT}, /* sys.privileges.privileges */
+					privids[3], &(int) {0}, /* sys.privileges.grantor */
+					privids[4], &(int) {0}, /* sys.privileges.grantee */
+					0);
+		if (rc != GDK_SUCCEED)
+			return rc;
+	}
+#endif
+
 	return GDK_SUCCEED;
 }
 

--- a/sql/storage/sql_storage.h
+++ b/sql/storage/sql_storage.h
@@ -368,8 +368,9 @@ extern int sql_trans_drop_all_func(sql_t
 extern void sql_trans_update_tables(sql_trans *tr, sql_schema *s);
 extern void sql_trans_update_schemas(sql_trans *tr);
 
-extern int sql_trans_create_schema(sql_trans *tr, const char *name, sqlid auth_id, sqlid owner);
+extern int sql_trans_create_schema(sql_trans *tr, const char *name, sqlid auth_id, sqlid owner, sqlid *schema_id_ptr);
 extern int sql_trans_rename_schema(sql_trans *tr, sqlid id, const char *new_name);
+extern int sql_trans_change_schema_authorization(sql_trans *tr, sqlid id, sqlid auth_id);
 extern int sql_trans_drop_schema(sql_trans *tr, sqlid id, int drop_action);
 
 sql_export int sql_trans_create_table(sql_table **tres, sql_trans *tr, sql_schema *s, const char *name, const char *sql, int tt, bit system, int persistence, int commit_action, int sz, bte properties);

--- a/sql/storage/store.c
+++ b/sql/storage/store.c
@@ -5040,7 +5040,7 @@ sql_trans_drop_all_func(sql_trans *tr, s
 }
 
 int
-sql_trans_create_schema(sql_trans *tr, const char *name, sqlid auth_id, sqlid owner)
+sql_trans_create_schema(sql_trans *tr, const char *name, sqlid auth_id, sqlid owner, sqlid *schema_id_ptr)
 {
 	sqlstore *store = tr->store;
 	sql_schema *s = SA_ZNEW(tr->sa, sql_schema);
@@ -5071,6 +5071,8 @@ sql_trans_create_schema(sql_trans *tr, c
 		return res;
 	if ((res = sql_trans_add_dependency(tr, s->owner, ddl)))
 		return res;
+	if (schema_id_ptr)
+		*schema_id_ptr = s->base.id;
 	return res;
 }
 
@@ -5102,6 +5104,34 @@ sql_trans_rename_schema(sql_trans *tr, s
 }
 
 int
+sql_trans_change_schema_authorization(sql_trans *tr, sqlid id, sqlid auth_id)
+{
+	sqlstore *store = tr->store;
+	sql_table *sysschema = find_sql_table(tr, find_sql_schema(tr, "sys"), "schemas");
+	sql_schema *s = find_sql_schema_id(tr, id), *ns = NULL;
+	oid rid;
+	int res = LOG_OK;
+
+	assert(auth_id);
+	s->auth_id = auth_id;
+
+	rid = store->table_api.column_find_row(tr, find_sql_column(sysschema, "id"), &id, NULL);
+	assert(!is_oid_nil(rid));
+	if ((res = store->table_api.column_update_value(tr, find_sql_column(sysschema, "authorization"), rid, &auth_id)))
+		return res;
+
+	if (!isNew(s) && (res = sql_trans_add_dependency_change(tr, id, ddl)))
+		return res;
+	/* delete schema, add schema */
+	if ((res = os_del(tr->cat->schemas, tr, s->base.name, dup_base(&s->base))))
+		return res;
+	if ((res = schema_dup(tr, s, s->base.name, &ns)) || (res = os_add(tr->cat->schemas, tr, ns->base.name, &ns->base))) {
+		return res;
+	}
+	return res;
+}
+
+int
 sql_trans_drop_schema(sql_trans *tr, sqlid id, int drop_action)
 {
 	sqlstore *store = tr->store;

--- a/sql/test/BugTracker-2018/Tests/All
+++ b/sql/test/BugTracker-2018/Tests/All
@@ -24,7 +24,7 @@ USER=testuser&PASSWD=testpassword&HAVE_N
 USER=testuser&PASSWD=testpassword&HAVE_GEOM?truncate_geom_tables.Bug-6543
 USER=testuser&PASSWD=testpassword?truncate_sys_tables.Bug-6543
 USER=testuser&PASSWD=testpassword?truncate_tmp_tables.Bug-6543
-truncate_remove_user
+# truncate_remove_user
 truncate_empty_table.Bug-6544
 sqlitelogictest-in-query.Bug-6545
 sqlitelogictest-in-with-division.Bug-6546