secondary password for each account, while applications can continue to connect to the servers using the same password as previously (which is now the secondary password). 

2. After the password change has propagated to all servers, modify applications that use any affected account to connect using the account primary password. 

3. After all applications have been migrated from the secondary passwords to the primary passwords, the secondary passwords are no longer needed and can be discarded. After this change has propagated to all servers, only the primary password for each account can be used to connect. The credential change is now complete. 

MySQL implements dual-password capability with syntax that saves and discards secondary passwords: 

•The RETAIN CURRENT PASSWORD  clause for the ALTER USER  and SET PASSWORD  statements saves an account current password as its secondary password when you assign a new primary password. 

•The DISCARD OLD PASSWORD  clause for ALTER USER  discards an account secondary password, leaving only the primary password. 

Suppose that, for the previously described credential-change scenario, an account named ’appuser1’@’host1.example.com’  is used by applications to connect to servers, and that the account password is to be changed from ’ password_a ’  to ’ password_b ’ . 

To perform this change of credentials, use ALTER USER  as follows: 

1. On each server that is not a replica, establish ’ password_b ’  as the new appuser1  primary password, retaining the current password as the secondary password: 

ALTER USER ’appuser1’@’host1.example.com’ IDENTIFIED BY ’ password_b ’ RETAIN CURRENT PASSWORD; 

2. Wait for the password change to replicate throughout the system to all replicas. 

3. Modify each application that uses the appuser1  account so that it connects to the servers using a password of ’ password_b ’  rather than ’ password_a ’ . 

4. At this point, the secondary password is no longer needed. On each server that is not a replica, discard the secondary password: 

ALTER USER ’appuser1’@’host1.example.com’ DISCARD OLD PASSWORD; 

5. After the discard-password change has replicated to all replicas, the credential change is complete. 

The RETAIN CURRENT PASSWORD  and DISCARD OLD PASSWORD  clauses have the following effects: 

• RETAIN CURRENT PASSWORD  retains an account current password as its secondary password, replacing any existing secondary password. The new password becomes the primary password, but clients can use the account to connect to the server using either the primary or secondary password. (Exception: If the new password specified by the ALTER USER  or SET PASSWORD  statement is empty, the secondary password becomes empty as well, even if RETAIN CURRENT PASSWORD  is given.) 

•If you specify RETAIN CURRENT PASSWORD  for an account that has an empty primary password, the statement fails. 

•If an account has a secondary password and you change its primary password without specifying RETAIN CURRENT PASSWORD , the secondary password remains unchanged. 

