<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="multifactor-authentication">
      </a>
      8.2.18 Multifactor Authentication
     </h3>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045248036864">
  </a>
  <a class="indexterm" name="idm46045248035376">
  </a>
  <a class="indexterm" name="idm46045248034288">
  </a>
  <a class="indexterm" name="idm46045248032816">
  </a>
  <a class="indexterm" name="idm46045248031296">
  </a>
  <a class="indexterm" name="idm46045248029776">
  </a>
  <a class="indexterm" name="idm46045248028256">
  </a>
  <a class="indexterm" name="idm46045248026736">
  </a>
  <a class="indexterm" name="idm46045248025216">
  </a>
  <a class="indexterm" name="idm46045248023696">
  </a>
  <a class="indexterm" name="idm46045248022176">
  </a>
  <a class="indexterm" name="idm46045248020656">
  </a>
  <a class="indexterm" name="idm46045248019568">
  </a>
  <p>
   Authentication involves one party establishing its identity to the
      satisfaction of a second party. Multifactor authentication (MFA)
      is the use of multiple authentication values (or
   <span class="quote">
    “
    <span class="quote">
     factors
    </span>
    ”
   </span>
   ) during the authentication process. MFA
      provides greater security than one-factor/single-factor
      authentication (1FA/SFA), which uses only one authentication
      method such as a password. MFA enables additional authentication
      methods, such as authentication using multiple passwords, or
      authentication using devices like smart cards, security keys, and
      biometric readers.
  </p>
  <p>
   MySQL includes support for multifactor authentication. This
      capability includes forms of MFA that require up to three
      authentication values. That is, MySQL account management supports
      accounts that use 2FA or 3FA, in addition to the existing 1FA
      support.
  </p>
  <p>
   When a client attempts a connection to the MySQL server using a
      single-factor account, the server invokes the authentication
      plugin indicated by the account definition and accepts or rejects
      the connection depending on whether the plugin reports success or
      failure.
  </p>
  <p>
   For an account that has multiple authentication factors, the
      process is similar. The server invokes authentication plugins in
      the order listed in the account definition. If a plugin reports
      success, the server either accepts the connection if the plugin is
      the last one, or proceeds to invoke the next plugin if any remain.
      If any plugin reports failure, the server rejects the connection.
  </p>
  <p>
   The following sections cover multifactor authentication in MySQL
      in more detail.
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="multifactor-authentication.html#multifactor-authentication-elements" title="Elements of Multifactor Authentication Support">
       Elements of Multifactor Authentication Support
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="multifactor-authentication.html#multifactor-authentication-policy" title="Configuring the Multifactor Authentication Policy">
       Configuring the Multifactor Authentication Policy
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="multifactor-authentication.html#multifactor-authentication-getting-started" title="Getting Started with Multifactor Authentication">
       Getting Started with Multifactor Authentication
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="multifactor-authentication-elements">
       </a>
       Elements of Multifactor Authentication Support
      </h4>
     </div>
    </div>
   </div>
   <p>
    Authentication factors commonly include these types of
        information:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Something you know, such as a secret password or passphrase.
      </p>
     </li>
     <li class="listitem">
      <p>
       Something you have, such as a security key or smart card.
      </p>
     </li>
     <li class="listitem">
      <p>
       Something you are; that is, a biometric characteristic such
            as a fingerprint or facial scan.
      </p>
     </li>
    </ul>
   </div>
   <p>
    The
    <span class="quote">
     “
     <span class="quote">
      something you know
     </span>
     ”
    </span>
    factor type relies on
        information that is kept secret on both sides of the
        authentication process. Unfortunately, secrets may be subject to
        compromise: Someone might see you enter your password or fool
        you with a phishing attack, a password stored on the server side
        might be exposed by a security breach, and so forth. Security
        can be improved by using multiple passwords, but each may still
        be subject to compromise. Use of the other factor types enables
        improved security with less risk of compromise.
   </p>
   <p>
    Implementation of multifactor authentication in MySQL comprises
        these elements:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The
       <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
        <code class="literal">
         authentication_policy
        </code>
       </a>
       system variable controls how many authentication factors can
            be used and the types of authentication permitted for each
            factor. That is, it places constraints on
       <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
        <code class="literal">
         CREATE USER
        </code>
       </a>
       and
       <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
        <code class="literal">
         ALTER USER
        </code>
       </a>
       statements with
            respect to multifactor authentication.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
        <code class="literal">
         CREATE USER
        </code>
       </a>
       and
       <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
        <code class="literal">
         ALTER USER
        </code>
       </a>
       have syntax
            enabling multiple authentication methods to be specified for
            new accounts, and for adding, modifying, or dropping
            authentication methods for existing accounts. If an account
            uses 2FA or 3FA, the
       <code class="literal">
        mysql.user
       </code>
       system
            table stores information about the additional authentication
            factors in the
       <code class="literal">
        User_attributes
       </code>
       column.
      </p>
     </li>
     <li class="listitem">
      <p>
       To enable authentication to the MySQL server using accounts
            that require multiple passwords, client programs have
       <a class="link" href="connection-options.html#option_general_password1">
        <code class="option">
         --password1
        </code>
       </a>
       ,
       <a class="link" href="connection-options.html#option_general_password2">
        <code class="option">
         --password2
        </code>
       </a>
       , and
       <a class="link" href="connection-options.html#option_general_password3">
        <code class="option">
         --password3
        </code>
       </a>
       options that
            permit up to three passwords to be specified. For
            applications that use the C API, the
       <code class="literal">
        MYSQL_OPT_USER_PASSWORD
       </code>
       option for the
       <a class="ulink" href="/doc/c-api/8.4/en/mysql-options4.html" target="_top">
        <code class="literal">
         mysql_options4()
        </code>
       </a>
       C API
            function enables the same capability.
      </p>
     </li>
     <li class="listitem">
      <p>
       The server-side
       <code class="literal">
        authentication_webauthn
       </code>
       plugin enables authentication using devices. This
            server-side, device-based authentication plugin is included
            only in MySQL Enterprise Edition distributions. It is not included in MySQL
            community distributions. However, the client-side
       <code class="literal">
        authentication_webauthn_client
       </code>
       plugin is
            included in all distributions, including community
            distributions. This enables clients from any distribution to
            connect to accounts that use
       <code class="literal">
        authentication_webauthn
       </code>
       to authenticate
            on a server that has that plugin loaded. See
       <a class="xref" href="webauthn-pluggable-authentication.html" title="8.4.1.11 WebAuthn Pluggable Authentication">
        Section 8.4.1.11, “WebAuthn Pluggable Authentication”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        authentication_webauthn
       </code>
       also enables
            passwordless authentication, if it is the only
            authentication plugin used by an account. See
       <a class="xref" href="webauthn-pluggable-authentication.html#webauthn-pluggable-authentication-passwordless" title="WebAuthn Passwordless Authentication">
        WebAuthn Passwordless Authentication
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       Multifactor authentication can use non-WebAuthn MySQL
            authentication methods, the WebAuthn authentication method,
            or a combination of both.
      </p>
     </li>
     <li class="listitem">
      <p>
       These privileges enable users to perform certain restricted
            multifactor authentication-related operations:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          A user who has the
          <a class="link" href="privileges-provided.html#priv_authentication-policy-admin">
           <code class="literal">
            AUTHENTICATION_POLICY_ADMIN
           </code>
          </a>
          privilege is not subject to the constraints imposed by
                the
          <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
           <code class="literal">
            authentication_policy
           </code>
          </a>
          system variable. (A warning does occur for statements
                that otherwise would not be permitted.)
         </p>
        </li>
        <li class="listitem">
         <p>
          The
          <a class="link" href="privileges-provided.html#priv_passwordless-user-admin">
           <code class="literal">
            PASSWORDLESS_USER_ADMIN
           </code>
          </a>
          privilege enables creation of
                passwordless-authentication accounts and replication of
                operations on them.
         </p>
        </li>
       </ul>
      </div>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="multifactor-authentication-policy">
       </a>
       Configuring the Multifactor Authentication Policy
      </h4>
     </div>
    </div>
   </div>
   <p>
    The
    <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
     <code class="literal">
      authentication_policy
     </code>
    </a>
    system variable defines the multifactor authentication policy.
        Specifically, it defines how many authentication factors
        accounts may have (or are required to have) and the
        authentication methods that can be used for each factor.
   </p>
   <p>
    The value of
    <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
     <code class="literal">
      authentication_policy
     </code>
    </a>
    is a list
        of 1, 2, or 3 comma-separated elements. Each element in the list
        corresponds to an authentication factor and can be an
        authentication plugin name, an asterisk (
    <code class="literal">
     *
    </code>
    ),
        empty, or missing. (Exception: Element 1 cannot be empty or
        missing.) The entire list is enclosed in single quotes. For
        example, the following
    <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
     <code class="literal">
      authentication_policy
     </code>
    </a>
    value
        includes an asterisk, an authentication plugin name, and an
        empty element:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-simple"><div class="docs-select-all right" id="sa11708080"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-simple">authentication_policy <span class="token operator">=</span> '<span class="token operator">*</span><span class="token punctuation">,</span>authentication_webauthn<span class="token punctuation">,</span>'</code></pre>
   </div>
   <p>
    An asterisk (
    <code class="literal">
     *
    </code>
    ) indicates that an
        authentication method is required but any method is permitted.
        An empty element indicates that an authentication method is
        optional and any method is permitted. A missing element (no
        asterisk, empty element, or authentication plugin name)
        indicates that an authentication method is not permitted. When a
        plugin name is specified, that authentication method is required
        for the respective factor when creating or modifying an account.
   </p>
   <p>
    The default
    <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
     <code class="literal">
      authentication_policy
     </code>
    </a>
    value is
    <code class="literal">
     '*,,'
    </code>
    (an asterisk and two empty elements),
        which requires a first factor, and optionally permits second and
        third factors. The default
    <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
     <code class="literal">
      authentication_policy
     </code>
    </a>
    value is
        thus backward compatible with existing 1FA accounts, but also
        permits creation or modification of accounts to use 2FA or 3FA.
   </p>
   <p>
    A user who has the
    <a class="link" href="privileges-provided.html#priv_authentication-policy-admin">
     <code class="literal">
      AUTHENTICATION_POLICY_ADMIN
     </code>
    </a>
    privilege is not subject to the constraints imposed by the
    <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
     <code class="literal">
      authentication_policy
     </code>
    </a>
    setting.
        (A warning occurs for statements that otherwise would not be
        permitted.)
   </p>
   <p>
    <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
     <code class="literal">
      authentication_policy
     </code>
    </a>
    values
        can be defined in an option file or specified using a
    <a class="link" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
     <code class="literal">
      SET
        GLOBAL
     </code>
    </a>
    statement:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa28759971"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SET</span> <span class="token keyword">GLOBAL</span> authentication_policy<span class="token operator">=</span><span class="token string">'*,*,'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    There are several rules that govern how the
    <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
     <code class="literal">
      authentication_policy
     </code>
    </a>
    value can
        be defined. Refer to the
    <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
     <code class="literal">
      authentication_policy
     </code>
    </a>
    system
        variable description for a compete account of those rules. The
        following table provides several
    <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
     <code class="literal">
      authentication_policy
     </code>
    </a>
    example
        values and the policy established by each.
   </p>
   <div class="table">
    <a name="idm46045247947552">
    </a>
    <p class="title">
     <b>
      Table 8.11 Example authentication_policy Values
     </b>
    </p>
    <div class="table-contents">
     <table summary="Example authentication_policy values and their meanings.">
      <colgroup>
       <col style="width: 50%"/>
       <col style="width: 50"/>
      </colgroup>
      <thead>
       <tr>
        <th>
         authentication_policy Value
        </th>
        <th>
         Effective Policy
        </th>
       </tr>
      </thead>
      <tbody>
       <tr>
        <td>
         <code class="literal">
          '*'
         </code>
        </td>
        <td>
         Permit only creating or altering accounts with one factor.
        </td>
       </tr>
       <tr>
        <td>
         <code class="literal">
          '*,*'
         </code>
        </td>
        <td>
         Permit only creating or altering accounts with two factors.
        </td>
       </tr>
       <tr>
        <td>
         <code class="literal">
          '*,*,*'
         </code>
        </td>
        <td>
         Permit only creating or altering accounts with three factors.
        </td>
       </tr>
       <tr>
        <td>
         <code class="literal">
          '*,'
         </code>
        </td>
        <td>
         Permit creating or altering accounts with one or two factors.
        </td>
       </tr>
       <tr>
        <td>
         <code class="literal">
          '*,,'
         </code>
        </td>
        <td>
         Permit creating or altering accounts with one, two, or three factors.
        </td>
       </tr>
       <tr>
        <td>
         <code class="literal">
          '*,*,'
         </code>
        </td>
        <td>
         Permit creating or altering accounts with two or three factors.
        </td>
       </tr>
       <tr>
        <td>
         <code class="literal">
          '*,
          <em class="replaceable">
           <code>
            auth_plugin
           </code>
          </em>
          '
         </code>
        </td>
        <td>
         Permit creating or altering accounts with two factors, where the first
              factor can be any authentication method, and the second
              factor must be the named plugin.
        </td>
       </tr>
       <tr>
        <td>
         <code class="literal">
          '
          <em class="replaceable">
           <code>
            auth_plugin
           </code>
          </em>
          ,*,'
         </code>
        </td>
        <td>
         Permit creating or altering accounts with two or three factors, where
              the first factor must be the named plugin.
        </td>
       </tr>
       <tr>
        <td>
         <code class="literal">
          '
          <em class="replaceable">
           <code>
            auth_plugin
           </code>
          </em>
          ,'
         </code>
        </td>
        <td>
         Permit creating or altering accounts with one or two factors, where the
              first factor must be the named plugin.
        </td>
       </tr>
       <tr>
        <td>
         <code class="literal">
          '
          <em class="replaceable">
           <code>
            auth_plugin
           </code>
          </em>
          ,
          <em class="replaceable">
           <code>
            auth_plugin
           </code>
          </em>
          ,
          <em class="replaceable">
           <code>
            auth_plugin
           </code>
          </em>
          '
         </code>
        </td>
        <td>
         Permits creating or altering accounts with three factors, where the
              factors must use the named plugins.
        </td>
       </tr>
      </tbody>
     </table>
    </div>
    <div class="table-contents">
     <table cellpadding="0" cellspacing="0" style="position: fixed; top: 0px; display: none; left: 401px; width: 739px;">
      <thead>
       <tr>
        <th style="width: 369px;">
         authentication_policy Value
        </th>
        <th style="width: 369px;">
         Effective Policy
        </th>
       </tr>
      </thead>
     </table>
    </div>
   </div>
   <br class="table-break"/>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="multifactor-authentication-getting-started">
       </a>
       Getting Started with Multifactor Authentication
      </h4>
     </div>
    </div>
   </div>
   <p>
    By default, MySQL uses a multifactor authentication policy that
        permits any authentication plugin for the first factor, and
        optionally permits second and third authentication factors. This
        policy is configurable; for details, see
    <a class="xref" href="multifactor-authentication.html#multifactor-authentication-policy" title="Configuring the Multifactor Authentication Policy">
     Configuring the Multifactor Authentication Policy
    </a>
    .
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     It is not permitted to use any internal credential storage
          plugins (
     <code class="literal">
      caching_sha2_password
     </code>
     or
     <code class="literal">
      mysql_native_password
     </code>
     ) for factor 2 or 3.
    </p>
   </div>
   <p>
    Suppose that you want an account to authenticate first using the
    <code class="literal">
     caching_sha2_password
    </code>
    plugin, then using the
    <code class="literal">
     authentication_ldap_sasl
    </code>
    SASL LDAP plugin.
        (This assumes that LDAP authentication is already set up as
        described in
    <a class="xref" href="ldap-pluggable-authentication.html" title="8.4.1.7 LDAP Pluggable Authentication">
     Section 8.4.1.7, “LDAP Pluggable Authentication”
    </a>
    ,
        and that the user has an entry in the LDAP directory
        corresponding to the authentication string shown in the
        example.) Create the account using a statement like this:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa16701669"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'alice'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> caching_sha2_password
    <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">sha2_password</em>'</span>
  <span class="token operator">AND</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> authentication_ldap_sasl
    <span class="token keyword">AS</span> <span class="token string">'uid=u1_ldap,ou=People,dc=example,dc=com'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    To connect, the user must supply two passwords. To enable
        authentication to the MySQL server using accounts that require
        multiple passwords, client programs have
    <a class="link" href="connection-options.html#option_general_password1">
     <code class="option">
      --password1
     </code>
    </a>
    ,
    <a class="link" href="connection-options.html#option_general_password2">
     <code class="option">
      --password2
     </code>
    </a>
    , and
    <a class="link" href="connection-options.html#option_general_password3">
     <code class="option">
      --password3
     </code>
    </a>
    options that permit
        up to three passwords to be specified. These options are similar
        to the
    <a class="link" href="connection-options.html#option_general_password">
     <code class="option">
      --password
     </code>
    </a>
    option in that
        they can take a password value following the option on the
        command line (which is insecure) or if given without a password
        value cause the user to be prompted for one. For the account
        just created, factors 1 and 2 take passwords, so invoke the
    <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
     <span class="command">
      <strong>
       mysql
      </strong>
     </span>
    </a>
    client with the
    <a class="link" href="mysql-command-options.html#option_mysql_password1">
     <code class="option">
      --password1
     </code>
    </a>
    and
    <a class="link" href="mysql-command-options.html#option_mysql_password2">
     <code class="option">
      --password2
     </code>
    </a>
    options.
    <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
     <span class="command">
      <strong>
       mysql
      </strong>
     </span>
    </a>
    prompts for each password in turn:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa16941170"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token constant">--user</span><span class="token attr-value"><span class="token punctuation">=</span>alice</span> <span class="token property">--password1</span> <span class="token property">--password2</span>
Enter password<span class="token punctuation">:</span> <span class="token punctuation"></span><em class="replaceable"><span class="token punctuation">(</span>enter factor 1 password<span class="token punctuation">)</span></em><span class="token punctuation"></span>
Enter password<span class="token punctuation">:</span> <span class="token punctuation"></span><em class="replaceable"><span class="token punctuation">(</span>enter factor 2 password<span class="token punctuation">)</span></em><span class="token punctuation"></span></code></pre>
   </div>
   <p>
    Suppose you want to add a third authentication factor. This can
        be achieved by dropping and recreating the user with a third
        factor or by using
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
      <em class="replaceable">
       <code>
        user
       </code>
      </em>
      ADD
      <em class="replaceable">
       <code>
        factor
       </code>
      </em>
     </code>
    </a>
    syntax. Both methods
        are shown below:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa19938233"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">DROP</span> <span class="token keyword">USER</span> <span class="token string">'alice'</span>@<span class="token string">'localhost'</span><span class="token punctuation">;</span>
  
<span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'alice'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> caching_sha2_password
    <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">sha2_password</em>'</span>
  <span class="token operator">AND</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> authentication_ldap_sasl
    <span class="token keyword">AS</span> <span class="token string">'uid=u1_ldap,ou=People,dc=example,dc=com'</span>
  <span class="token operator">AND</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> authentication_webauthn<span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    <code class="literal">
     ADD
     <em class="replaceable">
      <code>
       factor
      </code>
     </em>
    </code>
    syntax
        includes the factor number and
    <code class="literal">
     FACTOR
    </code>
    keyword:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa17515829"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'alice'</span>@<span class="token string">'localhost'</span> <span class="token keyword">ADD</span> <span class="token number">3</span> FACTOR <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> authentication_webauthn<span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
      <em class="replaceable">
       <code>
        user
       </code>
      </em>
      DROP
      <em class="replaceable">
       <code>
        factor
       </code>
      </em>
     </code>
    </a>
    syntax permits
        dropping a factor. The following example drops the third factor
        (
    <code class="literal">
     authentication_webauthn
    </code>
    ) that was added in
        the previous example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa17512122"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'alice'</span>@<span class="token string">'localhost'</span> <span class="token keyword">DROP</span> <span class="token number">3</span> FACTOR<span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
      <em class="replaceable">
       <code>
        user
       </code>
      </em>
      MODIFY
      <em class="replaceable">
       <code>
        factor
       </code>
      </em>
     </code>
    </a>
    syntax permits
        changing the plugin or authentication string for a particular
        factor, provided that the factor exists. The following example
        modifies the second factor, changing the authentication method
        from
    <code class="literal">
     authentication_ldap_sasl
    </code>
    to
    <code class="literal">
     authetication_webauthn
    </code>
    :
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa76260624"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'alice'</span>@<span class="token string">'localhost'</span> <span class="token keyword">MODIFY</span> <span class="token number">2</span> FACTOR <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> authentication_webauthn<span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Use
    <a class="link" href="show-create-user.html" title="15.7.7.13 SHOW CREATE USER Statement">
     <code class="literal">
      SHOW CREATE USER
     </code>
    </a>
    to view the
        authentication methods defined for an account:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa60053557"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SHOW</span> <span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'u1'</span>@<span class="token string">'localhost'</span>\G
<span class="token output"><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span> 1. row <span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span>
CREATE USER for u1@localhost<span class="token punctuation">:</span> CREATE USER `u1`@`localhost` 
IDENTIFIED WITH 'caching_sha2_password' AS '<em class="replaceable">sha2_password</em>' 
AND IDENTIFIED WITH 'authentication_authn' REQUIRE NONE 
PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY 
DEFAULT PASSWORD REUSE INTERVAL DEFAULT PASSWORD REQUIRE 
CURRENT DEFAULT</span></code></pre>
   </div>
  </div>
 </div>
 <br/>
</div>
