•Installing SHA-2 Pluggable Authentication 

•Using SHA-2 Pluggable Authentication 

•Cache Operation for SHA-2 Pluggable Authentication 

For general information about pluggable authentication in MySQL, see Section 6.2.17, “Pluggable Authentication” . 

## Installing SHA-2 Pluggable Authentication 

The caching_sha2_password  plugin exists in server and client forms: 

•The server-side plugin is built into the server, need not be loaded explicitly, and cannot be disabled by unloading it. 

•The client-side plugin is built into the libmysqlclient  client library and is available to any program linked against libmysqlclient . 

The server-side plugin uses the sha2_cache_cleaner  audit plugin as a helper to perform password cache management. sha2_cache_cleaner , like caching_sha2_password , is built in and need not be installed. 

## Using SHA-2 Pluggable Authentication 

To set up an account that uses the caching_sha2_password  plugin for SHA-256 password hashing, use the following statement, where password  is the desired account password: 

CREATE USER ’sha2user’@’localhost’ IDENTIFIED WITH caching_sha2_password BY ’ password ’; 

The server assigns the caching_sha2_password  plugin to the account and uses it to encrypt the password using SHA-256, storing those values in the plugin  and authentication_string  columns of the mysql.user  system table. 

The preceding instructions do not assume that caching_sha2_password  is the default authentication plugin. If caching_sha2_password  is the default authentication plugin, a simpler CREATE USER  syntax can be used. 

To start the server with the default authentication plugin set to caching_sha2_password , put these lines in the server option file: 

[mysqld] default_authentication_plugin=caching_sha2_password 

That causes the caching_sha2_password  plugin to be used by default for new accounts. As a result, it is possible to create the account and set its password without naming the plugin explicitly: 

CREATE USER ’sha2user’@’localhost’ IDENTIFIED BY ’ password ’; 

Another consequence of setting default_authentication_plugin  to caching_sha2_password  is that, to use some other plugin for account creation, you must specify that plugin explicitly. For example, to use the mysql_native_password  plugin, use this statement: 

CREATE USER ’nativeuser’@’localhost’ IDENTIFIED WITH mysql_native_password BY ’ password ’; 

caching_sha2_password  supports connections over secure transport. If you follow the RSA configuration procedure given later in this section, it also supports encrypted password exchange using RSA over unencrypted connections. RSA support has these characteristics: 

