content_image/710137.jpg
## Internal Versus External Credentials Storage 

<img src='content_image/710137.jpg'>

To correct the issue, perform the MySQL upgrade procedure. See Section 2.11, “Upgrading MySQL” . Until this is done, password changes are not possible. 

Some authentication plugins store account credentials internally to MySQL, in the mysql.user  system table: 

• mysql_native_password 

• caching_sha2_password 

• sha256_password 

Most discussion in this section applies to such authentication plugins because most password- management capabilities described here are based on internal credentials storage handled by MySQL itself. Other authentication plugins store account credentials externally to MySQL. For accounts that use plugins that perform authentication against an external credentials system, password management must be handled externally against that system as well. 

The exception is that the options for failed-login tracking and temporary account locking apply to all accounts, not just accounts that use internal credentials storage, because MySQL is able to assess the status of login attempts for any account no matter whether it uses internal or external credentials storage. 

For information about individual authentication plugins, see Section 6.4.1, “Authentication Plugins” . 

## Password Expiration Policy 

MySQL enables database administrators to expire account passwords manually, and to establish a policy for automatic password expiration. Expiration policy can be established globally, and individual accounts can be set to either defer to the global policy or override the global policy with specific per- account behavior. 

To expire an account password manually, use the ALTER USER  statement: 

ALTER USER ’jeffrey’@’localhost’ PASSWORD EXPIRE; 

This operation marks the password expired in the corresponding row in the mysql.user  system table. 

Password expiration according to policy is automatic and is based on password age, which for a given account is assessed from the date and time of its most recent password change. The mysql.user  system table indicates for each account when its password was last changed, and the server automatically treats the password as expired at client connection time if its age is greater than its permitted lifetime. This works with no explicit manual password expiration. 

To establish automatic password-expiration policy globally, use the default_password_lifetime system variable. Its default value is 0, which disables automatic password expiration. If the value of default_password_lifetime  is a positive integer N , it indicates the permitted password lifetime, such that passwords must be changed every N  days. 

Examples: 

•To establish a global policy that passwords have a lifetime of approximately six months, start the server with these lines in a server my.cnf  file: 

[mysqld] default_password_lifetime=180 

