Description\n-----------\n\nTo aid migrations MariaDB provides MySQL compatible caching_sha2_password authentication plugin. It allows to move users from MySQL to MariaDB without requiring them to change their passwords. It should be only used for migration, otherwise a more secure and convenient PARSEC plugin is recommended.\n\nInstalling the Plugin\n\nThe caching_sha2_password authentication plugin's shared library is included in MariaDB packages as the auth_mysql_sha2.so or auth_mysql_sha2.dll shared library on systems where it can be built.\n\nAlthough the plugin's shared library is distributed with MariaDB, the plugin is not actually installed into MariaDB by default. There are two methods that can be used to install the plugin into MariaDB.\n\nThe first method can be used to install the plugin without restarting the server. You can install the plugin dynamically by executing INSTALL SONAME or INSTALL PLUGIN:\n\n``sql\nINSTALL SONAME 'auth_mysql_sha2';\n`\n\nThe second method can be used to tell the server to load the plugin when it starts up. The plugin can be installed this way by providing the --plugin-load or the --plugin-load-add options. This can be specified as a command-line argument to mariadbd or it can be specified in a relevant server option group in an option file:\n\n`ini\n[mariadb]\n...\nplugin_load_add = auth_mysql_sha2\n`\n\nUninstalling the Plugin\n\nYou can uninstall the plugin dynamically by executing UNINSTALL SONAME or UNINSTALL PLUGIN:\n\n`sql\nUNINSTALL SONAME 'auth_mysql_sha2';\n`\n\nIf you installed the plugin by providing the --plugin-load or the --plugin-load-add options in a relevant server option group in an option file, then those options must be removed to prevent the plugin from being loaded the next time the server is restarted.\n\nUsing the Plugin\n\nTo create a user in MariaDB that was using caching_sha2_password plugin in MySQL, issue this statement:\n\n`sql\nCREATE USER user@host IDENTIFIED WITH caching_sha2_password USING 'authentication_string';\n`\n\nHere, authentication_string is taken from the mysql.user table for the corresponding user in MySQL installation. Beware that the authentication string for caching_sha2_password in MySQL can contain non-printable characters and copying it from the terminal window will likely not work.\n\nSystem Variables\n\ncaching_sha2_password_private_key_path\n\n Description: A path to the private RSA key used for authentication.\n Command line: --caching-sha2-password-private-key-path\n Scope: Global\n Dynamic: No\n Data Type: string\n Default Value: private_key.pem\n Introduced: MariaDB 11.4.9, MariaDB 11.8.4\n\ncaching_sha2_password_public_key_path\n\n Description: A path to the public RSA key used for authentication.\n Command line: --caching-sha2-password-public-key-path\n Scope: Global\n Dynamic: No\n Data Type: string\n Default Value: public_key.pem\n Introduced: MariaDB 11.4.9, MariaDB 11.8.4\n\ncaching_sha2_password_auto_generate_rsa_keys\n\n Description: Auto generate RSA keys at server startup if key paths are not explicitly set and key files are not present at their default locations.\n Command line: --caching-sha2-password-auto-generate-rsa-keys\n Scope: Global\n Dynamic: No\n Data Type: boolean\n Default Value: ON\n Introduced: MariaDB 11.4.9, MariaDB 11.8.4\n\ncaching_sha2_password_digest_rounds\n\n Description: Number of SHA2 rounds to be performed when computing a password hash.\n Command line: --caching-sha2-password-digest-rounds\n Scope: Global\n Dynamic: No\n Data Type: integer\n Default Value: 5000`\n Introduced: MariaDB 11.4.9, MariaDB 11.8.4\n\nURL: https://mariadb.com/docs/server/reference/plugins/authentication-plugins/authentication-plugin-caching_sha2_password