Description\n-----------\n\nWhen a user attempts to log in, the authentication plugin controls how MariaDB Server determines whether the connection is from a legitimate user.\n\nWhen creating or altering a user account with the GRANT, CREATE USER or ALTER USER statements, you can specify the authentication plugin you want the user account to use, by providing the IDENTIFIED VIA clause. By default, when you create a user account without specifying an authentication plugin, MariaDB uses the mysql_native_password plugin.\n\nYou can specify multiple authentication plugins for each user account.\n\nThe root@localhost user created by mariadb-install-db has the ability to use two authentication plugins:\n\n1. It is configured to try to use the unix_socket authentication plugin. This allows the root@localhost user to log in without a password via the local Unix socket file defined by the socket system variable, as long as the login is attempted from a process owned by the operating system root user account.\n2. If authentication fails with the unix_socket authentication plugin, it is configured to try to use the mysql_native_password authentication plugin. However, an invalid password is initially set, so in order to authenticate this way, a password must be set with SET PASSWORD.\n\nSupported Authentication Plugins\n\nThe authentication process is a conversation between the server and a client. MariaDB implements both server-side and client-side authentication plugins.\n\nSupported Server Authentication Plugins\n\nMariaDB provides seven server-side authentication plugins:\n\n mysql_native_password\n mysql_old_password\n ed25519\n gssapi\n pam (Unix only)\n unix_socket (Unix only)\n named_pipe (Windows only)\n\nSupported Client Authentication Plugins\n\nMariaDB provides eight client-side authentication plugins:\n\n mysql_native_password\n mysql_old_password\n client_ed25519\n auth_gssapi_client\n dialog\n mysql_clear_password\n sha256_password\n caching_sha256_password\n\nOptions Related to Authentication Plugins\n\nServer Options Related to Authentication Plugins\n\nMariaDB supports the following server options related to authentication plugins:\n\n| Server Option                                                                                                                             | Description                                                                                                                                                                                                                                                                                                              |\n| ----------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |\n| old_passwords={1 \\| 0}  | If set to 1 (0 is default), MariaDB reverts to using the mysql_old_password authentication plugin by default for newly created users and passwords, instead of the mysql_native_password authentication plugin. |\n| plugin_dir=path            | Path to the plugin directory. For security reasons, either make sure this directory can only be read by the server, or set secure_file_priv.                                                |\n| plugin_maturity=level | The lowest acceptable plugin maturity. MariaDB will not load plugins less mature than the specified level.                                                                                                                                                                                                        |\n| secure_auth               | Connections will be blocked if they use the mysql_old_password authentication plugin.                                                                                                                                                                                   |\n\nClient Options Related to Authentication Plugins\n\nMost clients and utilities support command-line arguments related to client authentication plugins:\n\n| Client Option              | Description                                                                                                                                                                                                   |\n| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| --connect-expired-password | Notify the server that this client is prepared to handle expired password sandbox mode even if --batch was specified.                    |\n| --default-auth=name        | Default authentication client-side plugin to use.                                                                                                                                                             |\n| --plugin-dir=path          | Directory for client-side plugins.                                                                                                                                                                            |\n| --secure-auth              | Refuse to connect to the server if the server uses the mysql_old_password authentication plugin. This mode is off by default, which is different from MySQL. |\n\nDevelopers who are using MariaDB Connector/C can implement similar functionality in their application by setting the following options with the mysql_optionsv function:\n\n MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS\n MYSQL_PLUGIN_DIR\n MYSQL_DEFAULT_AUTH\n MYSQL_SECURE_AUTH\n\nFor example:\n\n``ini\nmysql_optionsv(mysql, MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS, 1);\nmysql_optionsv(mysql, MYSQL_DEFAULT_AUTH, "name");\nmysql_optionsv(mysql, MYSQL_PLUGIN_DIR, "path");\nmysql_optionsv(mysql, MYSQL_SECURE_AUTH, 1);\n`\n\nInstallation Options Related to Authentication Plugins\n\nmariadb-install-db supports the following installation options related to authentication plugins:\n\n| Installation Option                                  | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                    |\n| ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| --auth-root-authentication-method={normal \\| socket} | If set to normal (the default), it creates a root@localhost account that authenticates with the mysql_native_password authentication plugin and that has no initial password set, which can be insecure. If set to socket, it creates a root@localhost account that authenticates with the unix_socket authentication plugin. Set to normal by default. |\n| --auth-root-socket-user=USER                         | Used with --auth-root-authentication-method=socket. It specifies the name of the second account to create with SUPER privileges in addition to root, as well as of the system account allowed to access it. Defaults to the value of --user.                                                                                                                          |\n\nExtended SQL Syntax\n\nMariaDB has extended the SQL standard GRANT, CREATE USER, and ALTER USER statements, so that they support specifying different authentication plugins for specific users. An authentication plugin can be specified with these statements by providing the IDENTIFIED VIA clause. Examples:\n\n`sql\nGRANT <privileges> ON <level> TO <user> \n   IDENTIFIED VIA <plugin> [ USING <string> ]\n`\n\n`sql\nCREATE USER <user> \n   IDENTIFIED VIA <plugin> [ USING <string> ]\n`\n\n`sql\nALTER USER <user> \n   IDENTIFIED VIA <plugin> [ USING <string> ]\n`\n\nThe optional USING clause allows users to provide an authentication string to a plugin. The authentication string's format and meaning is completely defined by the plugin.\n\nFor example, for the mysql_native_password authentication plugin, the authentication string should be a password hash:\n\n`sql\nCREATE USER mysqltest_up1 \n   IDENTIFIED VIA mysql_native_password USING 'E8D46CE25265E545D225A8A6F1BAF642FEBEE5CB';\n`\n\nSince mysql_native_password is the default authentication plugin, the above is just another way of saying the following:\n\n`\nCREATE USER mysqltest_up1 \n   IDENTIFIED BY PASSWORD 'E8D46CE25265E545D225A8A6F1BAF642FEBEE5CB';\n`\n\nIn contrast, for the pam authentication plugin, the authentication string should refer to a PAM service name:\n\n`sql\nCREATE USER mysqltest_up1 \n   IDENTIFIED VIA pam USING 'mariadb';\n`\n\nA user account can be associated with multiple authentication plugins.\n\nTo configure the root@localhost user account to try the unix_socket authentication plugin, followed by the mysql_native_password authentication plugin as a backup, execute the following query:\n\n`sql\nCREATE USER root@localhost \n   IDENTIFIED VIA unix_socket \n   OR mysql_native_password USING PASSWORD("verysecret");\n`\n\nSee Authentication for more information.\n\nAuthentication Plugins Installed by Default\n\nServer Authentication Plugins Installed by Default\n\nNot all server-side authentication plugins are installed by default. If a specific server-side authentication plugin is not installed by default, then you can find the installation procedure on the documentation page for the specific authentication plugin.\n\nThe following server-side authentication plugins are installed by default:\n\n The mysql_native_password and mysql_old_password authentication plugins authentication plugins are installed by default in all builds.\n The unix_socket authentication plugin is installed by default in all builds on Unix and Linux.\n The named_pipe authentication plugin is installed by default in all builds on Windows.\n\nThe following server-side authentication plugins are installed by default:\n\n The mysql_native_password and mysql_old_password authentication plugins are installed by default in all builds.\n The unix_socket authentication plugin is installed by default in new installations that use the .deb packages provided by Debian's default repositories and Ubuntu's default repositories in Ubuntu. See Differences in MariaDB in Debian (and Ubuntu) for more information.\n The named_pipe authentication plugin is installed by default in all builds on Windows.\n\nClient Authentication Plugins Installed by Default\n\nClient-side authentication plugins do not need to be _installed_ in the same way that server-side authentication plugins do. If the client uses either the libmysqlclient or MariaDB Connector/C library, then the library automatically loads client-side authentication plugins from the library's plugin directory whenever they are needed.\n\nMost clients and utilities support the --plugin-dir command line argument that can be used to set the path to the library's plugin directory:\n\n| Client Option     | Description                        |\n| ----------------- | ---------------------------------- |\n| --plugin-dir=path | Directory for client-side plugins. |\n\nDevelopers who are using MariaDB Connector/C can implement similar functionality in their application by setting the MYSQL_PLUGIN_DIR option with the mysql_optionsv function. Example:\n\n`c\nmysql_optionsv(mysql, MYSQL_PLUGIN_DIR, "path");\n`\n\nIf your client encounters errors similar to the following error, you may need to set the path to the library's plugin directory:\n\n`\nERROR 2059 (HY000): Authentication plugin 'dialog' cannot be loaded: /usr/lib/mysql/plugin/dialog.so: cannot open shared object file: No such file or directory\n`\n\nIf the client does not use either the libmysqlclient or MariaDB Connector/C library, then you will have to determine which authentication plugins are supported by the specific client library used by the client.\n\nIf the client uses either the libmysqlclient or MariaDB Connector/C library, but the client is not bundled with either library's _optional_ client authentication plugins, then you can only use the conventional authentication plugins (like mysql_native_password and mysql_old_password) and the non-conventional authentication plugins that don't require special client-side authentication plugins (like unix_socket and named_pipe).\n\nDefault Authentication Plugin\n\nDefault Server Authentication Plugin\n\nThe mysql_native_password authentication plugin is currently the default authentication plugin in all versions of MariaDB if the old_passwords system variable is set to 0, which is the default.\n\nOn a system with the old_passwords system variable set to 0, this means that if you create a user account with either the GRANT or CREATE USERstatements, and if you do not specify an authentication plugin with theIDENTIFIED VIAclause, then MariaDB will use the mysql_native_password authentication plugin for the user account.\n\nCreating a user account like this, it uses the mysql_native_password authentication plugin:\n\n`sql\nCREATE USER username@hostname;\n`\n\nThe same is true for this user account:\n\n`sql\nCREATE USER username@hostname IDENTIFIED BY 'notagoodpassword';\n`\n\nThe mysql_old_password authentication plugin becomes the default authentication plugin in all versions of MariaDB, if the old_passwords system variable is explicitly set to 1.\n\nThe mysql_old_password authentication plugin is not considered secure. It is recommended to avoid using this authentication plugin. To help prevent undesired use of the mysql_old_password authentication plugin, the server supports the secure_auth system variable that configures the server to refuse connections trying to use the mysql_old_password authentication plugin.\n\nMost clients and utilities support secure_auth.\n\n| Server Option                                                                                                                            | Description                                                                                                                                                                                                                                                                                                              |\n| -----------------\n\n[Truncated — full content at mariadb.com/docs]