diff --git a/manifests/profile/base/database/mysql.pp b/manifests/profile/base/database/mysql.pp
index b3316d4c1..3313129f9 100644
--- a/manifests/profile/base/database/mysql.pp
+++ b/manifests/profile/base/database/mysql.pp
@@ -169,6 +169,12 @@ class tripleo::profile::base::database::mysql (
     }
   }
 
+  $service_names = hiera('enabled_services', undef)
+
+  if $service_names {
+    tripleo::profile::base::database::mysql::users { $service_names: }
+  }
+
   if $step >= 2 and $sync_db {
     Class['::mysql::server'] -> Mysql_database<||>
     if hiera('aodh_api_enabled', false) {
diff --git a/manifests/profile/base/database/mysql/user.pp b/manifests/profile/base/database/mysql/user.pp
new file mode 100644
index 000000000..5ebc156c1
--- /dev/null
+++ b/manifests/profile/base/database/mysql/user.pp
@@ -0,0 +1,62 @@
+# The tripleo::profile::base::database::mysql::user resource implements
+# a generic resource to create databases, users and grants in MySQL
+#
+# == parameters
+#
+# [*password*]
+#   (Required) Password to connect to the database.
+#
+# [*dbname*]
+#   (Required) Name of the database.
+#
+# [*user*]
+#   (Required) User to connect to the database.
+#
+# [*host*]
+#   (Optional) The default source host user is allowed to connect from.
+#   Defaults to '127.0.0.1'
+#
+# [*allowed_hosts*]
+#   (Optional) Other hosts the user is allowed to connect from.
+#   Defaults to 'undef'.
+#
+# [*charset*]
+#   (Optional) The database charset.
+#   Defaults to 'utf8'
+#
+# [*collate*]
+#   (Optional) The database collate.
+#   Only used with mysql modules >= 2.2.
+#   Defaults to 'utf8_general_ci'
+#
+# == Dependencies
+#   Class['mysql::server']
+#
+# == Examples
+#
+# == Authors
+#
+# == Copyright
+#
+define tripleo::profile::base::database::mysql::user (
+  $password,
+  $dbname,
+  $user,
+  $host          = '127.0.0.1',
+  $charset       = 'utf8',
+  $collate       = 'utf8_general_ci',
+  $allowed_hosts = undef
+) {
+
+  validate_string($password)
+
+  ::openstacklib::db::mysql { $title :
+    user          => $user,
+    password_hash => mysql_password($password),
+    dbname        => $dbname,
+    host          => $host,
+    charset       => $charset,
+    collate       => $collate,
+    allowed_hosts => $allowed_hosts,
+  }
+}
diff --git a/manifests/profile/base/database/mysql/users.pp b/manifests/profile/base/database/mysql/users.pp
new file mode 100644
index 000000000..800e0ec40
--- /dev/null
+++ b/manifests/profile/base/database/mysql/users.pp
@@ -0,0 +1,37 @@
+# Copyright 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Define: tripleo::haproxy::service_endpoints
+#
+# Define used to create haproxyendpoints for composable services.
+#
+# === Parameters:
+#
+# [*service_name*]
+#  (optional) The service_name to create the myql resources for.
+#  Defaults to $title
+#
+define tripleo::profile::base::database::mysql::users ($service_name = $title) {
+
+  $underscore_name = regsubst($service_name, '-', '_', 'G')
+
+  # This allows each composable service to load its own custom rules by
+  # creating its own flat hiera key named:
+  #   tripleo::<service name with underscores>::mysql_user
+  $mysql_users = hiera("tripleo::${underscore_name}::mysql_user", undef)
+
+  if $mysql_users {
+    ensure_resource('tripleo::profile::base::database::mysql::user', $service_name, $mysql_users)
+  }
+}
diff --git a/releasenotes/notes/introduce-mysql-user-interface-e16d62f3743128a0.yaml b/releasenotes/notes/introduce-mysql-user-interface-e16d62f3743128a0.yaml
new file mode 100644
index 000000000..671b2e698
--- /dev/null
+++ b/releasenotes/notes/introduce-mysql-user-interface-e16d62f3743128a0.yaml
@@ -0,0 +1,6 @@
+---
+features:
+  - |
+    The interface ``tripleo::<service name>::mysql_user`` was created. It
+    allows service writes to create databases, database users and grants via
+    hieradata instead of having to modify puppet-tripleo.
diff --git a/spec/defines/tripleo_profile_base_database_mysql_user_spec.rb b/spec/defines/tripleo_profile_base_database_mysql_user_spec.rb
new file mode 100644
index 000000000..c215f7ac1
--- /dev/null
+++ b/spec/defines/tripleo_profile_base_database_mysql_user_spec.rb
@@ -0,0 +1,43 @@
+require 'spec_helper'
+
+describe 'tripleo::profile::base::database::mysql::user' do
+  let(:title) { 'barbican' }
+
+  let :pre_condition do
+    'include mysql::server'
+  end
+
+  let :params do {
+    :password      => 'secrete',
+    :dbname        => 'barbican',
+    :user          => 'barbican',
+    :host          => '127.0.0.1',
+    :charset       => 'utf8',
+    :collate       => 'utf8_general_ci'
+  }
+  end
+
+  shared_examples_for 'tripleo  profile  base  database  mysql  user' do
+    context 'with basic parameters to configure barbican database' do
+      it 'should configure mysql' do
+        is_expected.to contain_openstacklib__db__mysql('barbican').with(
+          :dbname         => params[:dbname],
+          :user           => params[:user],
+          :host           => params[:host],
+          :charset        => params[:charset],
+          :collate        => params[:collate],
+        )
+      end
+    end
+  end
+
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge({})
+      end
+
+      it_behaves_like 'tripleo  profile  base  database  mysql  user'
+    end
+  end
+end