•A new caching_sha2_password  authentication plugin is available. Like the sha256_password plugin, caching_sha2_password  implements SHA-256 password hashing, but uses caching to address latency issues at connect time. It also supports more transport protocols and does not require linking against OpenSSL for RSA key pair-based password-exchange capabilities. See Section 6.4.1.2, “Caching SHA-2 Pluggable Authentication” . 

The caching_sha2_password  and sha256_password  authentication plugins provide more secure password encryption than the mysql_native_password  plugin, and caching_sha2_password provides better performance than sha256_password . Due to these superior security and performance characteristics of caching_sha2_password , it is now the preferred authentication plugin, and is also the default authentication plugin rather than mysql_native_password . For information about the implications of this change of default plugin for server operation and compatibility of the server with clients and connectors, see caching_sha2_password as the Preferred Authentication Plugin. 

•MySQL now supports roles, which are named collections of privileges. Roles can be created and dropped. Roles can have privileges granted to and revoked from them. Roles can be granted to and revoked from user accounts. The active applicable roles for an account can be selected from among those granted to the account, and can be changed during sessions for that account. For more information, see Section 6.2.10, “Using Roles” . 

•MySQL now incorporates the concept of user account categories, with system and regular users distinguished according to whether they have the SYSTEM_USER  privilege. See Section 6.2.11, “Account Categories” . 

•Previously, it was not possible to grant privileges that apply globally except for certain schemas. This is now possible if the partial_revokes  system variable is enabled. See Section 6.2.12, “Privilege Restriction Using Partial Revokes” . 

•The GRANT  statement has an AS user  [WITH ROLE]  clause that specifies additional information about the privilege context to use for statement execution. This syntax is visible at the SQL level, although its primary purpose is to enable uniform replication across all nodes of grantor privilege restrictions imposed by partial revokes, by causing those restrictions to appear in the binary log. See Section 13.7.1.6, “GRANT Statement” . 

•MySQL now maintains information about password history, enabling restrictions on reuse of previous passwords. DBAs can require that new passwords not be selected from previous passwords for some number of password changes or period of time. It is possible to establish password-reuse policy globally as well as on a per-account basis. 

It is now possible to require that attempts to change account passwords be verified by specifying the current password to be replaced. This enables DBAs to prevent users from changing password without proving that they know the current password. It is possible to establish password-verification policy globally as well as on a per-account basis. 

Accounts are now permitted to have dual passwords, which enables phased password changes to be performed seamlessly in complex multiple-server systems, without downtime. 

MySQL now enables administrators to configure user accounts such that too many consecutive login failures due to incorrect passwords cause temporary account locking. The required number of failures and the lock time are configurable per account. 

These new capabilities provide DBAs more complete control over password management. For more information, see Section 6.2.15, “Password Management” . 

