<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="webauthn-pluggable-authentication">
      </a>
      8.4.1.11 WebAuthn Pluggable Authentication
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045244070640">
  </a>
  <a class="indexterm" name="idm46045244069536">
  </a>
  <a class="indexterm" name="idm46045244068048">
  </a>
  <a class="indexterm" name="idm46045244066944">
  </a>
  <a class="indexterm" name="idm46045244065440">
  </a>
  <a class="indexterm" name="idm46045244063952">
  </a>
  <a class="indexterm" name="idm46045244062464">
  </a>
  <a class="indexterm" name="idm46045244061376">
  </a>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    WebAuthn authentication is an extension included in MySQL Enterprise Edition, a
          commercial product. To learn more about commercial products,
          see
    <a class="ulink" href="https://www.mysql.com/products/" target="_blank">
     https://www.mysql.com/products/
    </a>
    .
   </p>
  </div>
  <p>
   MySQL Enterprise Edition supports an authentication method that enables users to
        authenticate to MySQL Server using WebAuthn authentication.
  </p>
  <p>
   WebAuthn stands for Web Authentication, which is a web standard
        published by the World Wide Web Consortium (W3C) and web
        application APIs that add FIDO-based authentication to supported
        browsers and platforms.
  </p>
  <p>
   WebAuthn pluggable authentication replaces FIDO pluggable
        authentication, which is deprecated. WebAuthn pluggable
        authentication supports both FIDO and FIDO2 devices.
  </p>
  <p>
   WebAuthn pluggable authentication provides these capabilities:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      WebAuthn enables authentication to MySQL Server using
            devices such as smart cards, security keys, and biometric
            readers.
     </p>
    </li>
    <li class="listitem">
     <p>
      Because authentication can occur other than by providing a
            password, WebAuthn enables passwordless authentication.
     </p>
    </li>
    <li class="listitem">
     <p>
      On the other hand, device authentication is often used in
            conjunction with password authentication, so WebAuthn
            authentication can be used to good effect for MySQL accounts
            that use multifactor authentication; see
      <a class="xref" href="multifactor-authentication.html" title="8.2.18 Multifactor Authentication">
       Section 8.2.18, “Multifactor Authentication”
      </a>
      .
     </p>
    </li>
   </ul>
  </div>
  <p>
   The following table shows the plugin and library file names. The
        file name suffix might differ on your system. Common suffixes
        are
   <code class="filename">
    .so
   </code>
   for Unix and Unix-like systems, and
   <code class="filename">
    .dll
   </code>
   for Windows. The file must be located
        in the directory named by the
   <a class="link" href="server-system-variables.html#sysvar_plugin_dir">
    <code class="literal">
     plugin_dir
    </code>
   </a>
   system variable. For
        installation information, see
   <a class="xref" href="webauthn-pluggable-authentication.html#webauthn-pluggable-authentication-installation" title="Installing WebAuthn Pluggable Authentication">
    Installing WebAuthn Pluggable Authentication
   </a>
   .
  </p>
  <div class="table">
   <a name="idm46045244047568">
   </a>
   <p class="title">
    <b>
     Table 8.26 Plugin and Library Names for WebAuthn Authentication
    </b>
   </p>
   <div class="table-contents">
    <table summary="Names for the plugins and library file used for WebAuthn authentication.">
     <colgroup>
      <col style="width: 30%"/>
      <col style="width: 70%"/>
     </colgroup>
     <thead>
      <tr>
       <th>
        Plugin or File
       </th>
       <th>
        Plugin or File Name
       </th>
      </tr>
     </thead>
     <tbody>
      <tr>
       <td>
        Server-side plugin
       </td>
       <td>
        <code class="literal">
         authentication_webauthn
        </code>
       </td>
      </tr>
      <tr>
       <td>
        Client-side plugin
       </td>
       <td>
        <code class="literal">
         authentication_webauthn_client
        </code>
       </td>
      </tr>
      <tr>
       <td>
        Library file
       </td>
       <td>
        <code class="filename">
         authentication_webauthn.so
        </code>
        ,
        <code class="filename">
         authentication_webauthn_client.so
        </code>
       </td>
      </tr>
     </tbody>
    </table>
   </div>
  </div>
  <br class="table-break"/>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    A
    <code class="literal">
     libfido2
    </code>
    library must be available on
          systems where either the server-side or client-side WebAuthn
          authentication plugin is used.
   </p>
  </div>
  <p>
   The server-side WebAuthn authentication plugin is included only
        in MySQL Enterprise Edition. It is not included in MySQL community distributions.
        The client-side plugin is included in all distributions,
        including community distributions, which enables clients from
        any distribution to connect to a server that has the server-side
        plugin loaded.
  </p>
  <p>
   The following sections provide installation and usage
        information specific to WebAuthn pluggable authentication:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="webauthn-pluggable-authentication.html#webauthn-pluggable-authentication-installation" title="Installing WebAuthn Pluggable Authentication">
       Installing WebAuthn Pluggable Authentication
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="webauthn-pluggable-authentication.html#webauthn-pluggable-authentication-usage" title="Using WebAuthn Authentication">
       Using WebAuthn Authentication
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="webauthn-pluggable-authentication.html#webauthn-pluggable-authentication-passwordless" title="WebAuthn Passwordless Authentication">
       WebAuthn Passwordless Authentication
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="webauthn-pluggable-authentication.html#webauthn-pluggable-authentication-unregistration" title="Device Unregistration for WebAuthn">
       Device Unregistration for WebAuthn
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="webauthn-pluggable-authentication.html#webauthn-pluggable-authentication-process" title="How WebAuthn Authentication of MySQL Users Works">
       How WebAuthn Authentication of MySQL Users Works
      </a>
     </p>
    </li>
   </ul>
  </div>
  <p>
   For general information about pluggable authentication in MySQL,
        see
   <a class="xref" href="pluggable-authentication.html" title="8.2.17 Pluggable Authentication">
    Section 8.2.17, “Pluggable Authentication”
   </a>
   .
  </p>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="webauthn-pluggable-authentication-installation">
       </a>
       Installing WebAuthn Pluggable Authentication
      </h5>
     </div>
    </div>
   </div>
   <p>
    This section describes how to install the server-side WebAuthn
          authentication plugin. For general information about
          installing plugins, see
    <a class="xref" href="plugin-loading.html" title="7.6.1 Installing and Uninstalling Plugins">
     Section 7.6.1, “Installing and Uninstalling Plugins”
    </a>
    .
   </p>
   <p>
    To be usable by the server, the plugin library file must be
          located in the MySQL plugin directory (the directory named by
          the
    <a class="link" href="server-system-variables.html#sysvar_plugin_dir">
     <code class="literal">
      plugin_dir
     </code>
    </a>
    system
          variable). If necessary, configure the plugin directory
          location by setting the value of
    <a class="link" href="server-system-variables.html#sysvar_plugin_dir">
     <code class="literal">
      plugin_dir
     </code>
    </a>
    at server startup.
   </p>
   <p>
    The server-side plugin library file base name is
    <code class="literal">
     authentication_webauthn
    </code>
    . The file name
          suffix differs per platform (for example,
    <code class="filename">
     .so
    </code>
    for Unix and Unix-like systems,
    <code class="filename">
     .dll
    </code>
    for Windows).
   </p>
   <p>
    Before installing the server-side plugin, define a unique name
          for the relying party ID (used for device registration and
          authentication), which is the MySQL server. Start the server
          using the
    <code class="literal">
     --loose-authentication-webauthn-rp-id=
     <em class="replaceable">
      <code>
       value
      </code>
     </em>
    </code>
    option. The example here specifies the value
    <code class="literal">
     mysql.com
    </code>
    as the relying party ID. Replace
          this value with one that satisfies your requirements.
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa97699547"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysqld</span> <span class="token punctuation">[</span><em class="replaceable">options</em><span class="token punctuation">]</span> <span class="token constant">--loose-authentication-webauthn-rp-id</span><span class="token attr-value"><span class="token punctuation">=</span>mysql.com</span></code></pre>
   </div>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     For replication, use the same
     <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_webauthn_rp_id">
      <code class="literal">
       authentication_webauthn_rp_id
      </code>
     </a>
     value on all nodes if a user is expected to connect to
            multiple servers.
    </p>
   </div>
   <p>
    To define the relying party and load the plugin at server
          startup, use the
    <a class="link" href="server-options.html#option_mysqld_plugin-load-add">
     <code class="option">
      --plugin-load-add
     </code>
    </a>
    option to
          name the library file that contains it, adjusting the .so
          suffix for your platform as necessary. With this
          plugin-loading method, the option must be given each time the
          server starts.
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa44507495"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysqld</span> <span class="token punctuation">[</span><em class="replaceable">options</em><span class="token punctuation">]</span> 
    <span class="token constant">--loose-authentication-webauthn-rp-id</span><span class="token attr-value"><span class="token punctuation">=</span>mysql.com</span>
    <span class="token constant">--plugin-load-add</span><span class="token attr-value"><span class="token punctuation">=</span>authentication_webauthn.so</span></code></pre>
   </div>
   <p>
    To define the relying party and load the plugin, put lines
          such as this in your
    <code class="filename">
     my.cnf
    </code>
    file,
          adjusting the
    <code class="filename">
     .so
    </code>
    suffix for your
          platform as necessary:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa45661962"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">plugin-load-add</span><span class="token attr-value"><span class="token punctuation">=</span>authentication_webauthn.so</span>
<span class="token constant">authentication_webauthn_rp_id</span><span class="token attr-value"><span class="token punctuation">=</span>mysql.com</span></code></pre>
   </div>
   <p>
    After modifying
    <code class="filename">
     my.cnf
    </code>
    , restart the
          server to cause the new setting to take effect.
   </p>
   <p>
    Alternatively, to load the plugin at runtime, use this
          statement, adjusting the
    <code class="filename">
     .so
    </code>
    suffix for
          your platform as necessary:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa89807855"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">INSTALL</span> <span class="token keyword">PLUGIN</span> authentication_webauthn
  <span class="token keyword">SONAME</span> <span class="token string">'authentication_webauthn.so'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    <a class="link" href="install-plugin.html" title="15.7.4.4 INSTALL PLUGIN Statement">
     <code class="literal">
      INSTALL PLUGIN
     </code>
    </a>
    loads the plugin
          immediately, and also registers it in the
    <code class="literal">
     mysql.plugins
    </code>
    system table to cause the
          server to load it for each subsequent normal startup without
          the need for
    <a class="link" href="server-options.html#option_mysqld_plugin-load-add">
     <code class="option">
      --plugin-load-add
     </code>
    </a>
    .
   </p>
   <p>
    To verify plugin installation, examine the Information Schema
    <a class="link" href="information-schema-plugins-table.html" title="28.3.22 The INFORMATION_SCHEMA PLUGINS Table">
     <code class="literal">
      PLUGINS
     </code>
    </a>
    table or use the
    <a class="link" href="show-plugins.html" title="15.7.7.27 SHOW PLUGINS Statement">
     <code class="literal">
      SHOW PLUGINS
     </code>
    </a>
    statement (see
    <a class="xref" href="obtaining-plugin-information.html" title="7.6.2 Obtaining Server Plugin Information">
     Section 7.6.2, “Obtaining Server Plugin Information”
    </a>
    ). For example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa98903244"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> PLUGIN_NAME<span class="token punctuation">,</span> PLUGIN_STATUS
       <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span><span class="token keyword">PLUGINS</span>
       <span class="token keyword">WHERE</span> PLUGIN_NAME <span class="token operator">=</span> <span class="token string">'authentication_webauthn'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> PLUGIN_NAME             <span class="token punctuation">|</span> PLUGIN_STATUS <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> authentication_webauthn <span class="token punctuation">|</span> ACTIVE        <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
   </div>
   <p>
    If a plugin fails to initialize, check the server error log
          for diagnostic messages.
   </p>
   <p>
    To associate MySQL accounts with the WebAuthn authentication
          plugin, see
    <a class="xref" href="webauthn-pluggable-authentication.html#webauthn-pluggable-authentication-usage" title="Using WebAuthn Authentication">
     Using WebAuthn Authentication
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="webauthn-pluggable-authentication-usage">
       </a>
       Using WebAuthn Authentication
      </h5>
     </div>
    </div>
   </div>
   <p>
    WebAuthn authentication typically is used in the context of
          multifactor authentication (see
    <a class="xref" href="multifactor-authentication.html" title="8.2.18 Multifactor Authentication">
     Section 8.2.18, “Multifactor Authentication”
    </a>
    ). This section
          shows how to incorporate WebAuthn device-based authentication
          into a multifactor account, using the
    <code class="literal">
     authentication_webauthn
    </code>
    plugin.
   </p>
   <p>
    It is assumed in the following discussion that the server is
          running with the server-side WebAuthn authentication plugin
          enabled, as described in
    <a class="xref" href="webauthn-pluggable-authentication.html#webauthn-pluggable-authentication-installation" title="Installing WebAuthn Pluggable Authentication">
     Installing WebAuthn Pluggable Authentication
    </a>
    ,
          and that the client-side WebAuthn plugin is available in the
          plugin directory on the client host.
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     On Windows, WebAuthn authentication only functions if the
            client process runs as a user with administrator privileges.
            It might also be necessary to add the location of your
            FIDO/FIDO2 device to the client host'
     <code class="literal">
      PATH
     </code>
     environment variable.
    </p>
   </div>
   <p>
    It is also assumed that WebAuthn authentication is used in
          conjunction with non-WebAuthn authentication (which implies a
          2FA or 3FA account). WebAuthn can also be used by itself to
          create 1FA accounts that authenticate in a passwordless
          manner. In this case, the setup process differs somewhat. For
          instructions, see
    <a class="xref" href="webauthn-pluggable-authentication.html#webauthn-pluggable-authentication-passwordless" title="WebAuthn Passwordless Authentication">
     WebAuthn Passwordless Authentication
    </a>
    .
   </p>
   <p>
    An account that is configured to use the
    <code class="literal">
     authentication_webauthn
    </code>
    plugin is
          associated with a Fast Identity Online (FIDO/FIDO2) device.
          Because of this, a one-time device registration step is
          required before WebAuthn authentication can occur. The device
          registration process has these characteristics:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Any FIDO/FIDO2 device associated with an account must be
              registered before the account can be used.
      </p>
     </li>
     <li class="listitem">
      <p>
       Registration requires that a FIDO/FIDO2 device be
              available on the client host, or registration fails.
      </p>
     </li>
     <li class="listitem">
      <p>
       The user is expected to perform the appropriate FIDO/FIDO2
              device action when prompted during registration (for
              example, touching the device or performing a biometric
              scan).
      </p>
     </li>
     <li class="listitem">
      <p>
       To perform device registration, the client user must
              invoke the
       <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
        <span class="command">
         <strong>
          mysql
         </strong>
        </span>
       </a>
       client program and
              specify the
       <a class="link" href="mysql-command-options.html#option_mysql_register-factor">
        <code class="option">
         --register-factor
        </code>
       </a>
       option to
              specify the factor or factors for which a device is being
              registered. For example, if the account is set to use
              WebAuthn as the second authentication factor, the user
              invokes
       <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
        <span class="command">
         <strong>
          mysql
         </strong>
        </span>
       </a>
       with the
       <a class="link" href="mysql-command-options.html#option_mysql_register-factor">
        <code class="option">
         --register-factor=2
        </code>
       </a>
       option.
      </p>
     </li>
     <li class="listitem">
      <p>
       If the user account is configured with the
       <code class="literal">
        authentication_webauthn
       </code>
       plugin set as
              the second or third factor, authentication for all
              preceding factors must succeed before the registration
              step can proceed.
      </p>
     </li>
     <li class="listitem">
      <p>
       The server knows from the information in the user account
              whether the FIDO/FIDO2 device requires registration or has
              already been registered. When the client program connects,
              the server places the client session in sandbox mode if
              the device must be registered, so that registration must
              occur before anything else can be done. Sandbox mode used
              for FIDO/FIDO2 device registration is similar to that used
              for handling of expired passwords. See
       <a class="xref" href="expired-password-handling.html" title="8.2.16 Server Handling of Expired Passwords">
        Section 8.2.16, “Server Handling of Expired Passwords”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       In sandbox mode, no statements other than
       <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
        <code class="literal">
         ALTER USER
        </code>
       </a>
       are permitted.
              Registration is performed using forms of this statement.
              When invoked with the
       <a class="link" href="mysql-command-options.html#option_mysql_register-factor">
        <code class="option">
         --register-factor
        </code>
       </a>
       option,
              the
       <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
        <span class="command">
         <strong>
          mysql
         </strong>
        </span>
       </a>
       client generates the
       <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
        <code class="literal">
         ALTER USER
        </code>
       </a>
       statements
              required to perform registration. After registration has
              been accomplished, the server switches the session out of
              sandbox mode, and the client can proceed normally. For
              information about the generated
       <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
        <code class="literal">
         ALTER
              USER
        </code>
       </a>
       statements, refer to the
       <a class="link" href="mysql-command-options.html#option_mysql_register-factor">
        <code class="option">
         --register-factor
        </code>
       </a>
       description.
      </p>
     </li>
     <li class="listitem">
      <p>
       When device registration has been performed for the
              account, the server updates the
       <code class="literal">
        mysql.user
       </code>
       system table row for that
              account to update the device registration status and to
              store the public key and credential ID. (The server does
              not retain the credential ID following FIDO2 device
              registration.)
      </p>
     </li>
     <li class="listitem">
      <p>
       The registration step can be performed only by the user
              named by the account. If one user attempts to perform
              registration for another user, an error occurs.
      </p>
     </li>
     <li class="listitem">
      <p>
       The user should use the same FIDO/FIDO2 device during
              registration and authentication. If, after registering a
              FIDO/FIDO2 device on the client host, the device is reset
              or a different device is inserted, authentication fails.
              In this case, the device associated with the account must
              be unregistered and registration must be done again.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Suppose that you want an account to authenticate first using
          the
    <code class="literal">
     caching_sha2_password
    </code>
    plugin, then
          using the
    <code class="literal">
     authentication_webauthn
    </code>
    plugin.
          Create a multifactor account using a statement like this:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa10606600"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'u2'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> caching_sha2_password
    <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">sha2_password</em>'</span>
  <span class="token operator">AND</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> authentication_webauthn<span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    To connect, supply the factor 1 password to satisfy
          authentication for that factor, and to initiate registration
          of the FIDO/FIDO2 device, set the
    <a class="link" href="mysql-command-options.html#option_mysql_register-factor">
     <code class="option">
      --register-factor
     </code>
    </a>
    to factor 2.
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa54241711"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token constant">--user</span><span class="token attr-value"><span class="token punctuation">=</span>u2</span> <span class="token property">--password1</span> <span class="token constant">--register-factor</span><span class="token attr-value"><span class="token punctuation">=</span>2</span>
Enter password<span class="token punctuation">:</span> <span class="token punctuation"></span><em class="replaceable"><span class="token punctuation">(</span>enter factor 1 password<span class="token punctuation">)</span></em><span class="token punctuation"></span>
Please insert FIDO device and follow the instruction<span class="token punctuation">.</span> Depending on the device<span class="token punctuation">,</span> 
you may have to perform gesture action multiple times<span class="token punctuation">.</span>
1<span class="token punctuation">.</span> Perform gesture action <span class="token punctuation">(</span>Skip this step if you are prompted to enter device PIN<span class="token punctuation">)</span><span class="token punctuation">.</span>
2<span class="token punctuation">.</span> Enter PIN for token device<span class="token punctuation">:</span>
3<span class="token punctuation">.</span> Perform gesture action for registration to complete<span class="token punctuation">.</span>
Welcome to the MySQL monitor<span class="token punctuation">.</span>  Commands end with <span class="token punctuation">;</span> or \g<span class="token punctuation">.</span>
Your MySQL connection id is 8</code></pre>
   </div>
   <p>
    After the factor 1 password is accepted, the client session
          enters sandbox mode so that device registration can be
          performed for factor 2. During registration, you are prompted
          to perform the appropriate FIDO/FIDO2 device action, such as
          touching the device or performing a biometric scan.
   </p>
   <p>
    Optionally, you can invoke the
    <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
     <span class="command">
      <strong>
       mysql
      </strong>
     </span>
    </a>
    client
          program and specify the
    <a class="link" href="mysql-command-options.html#option_mysql_plugin-authentication-webauthn-client-preserve-privacy">
     <code class="option">
      --plugin-authentication-webauthn-client-preserve-privacy
     </code>
    </a>
    option. If the FIDO2 device contains multiple discoverable
          credentials (resident keys) for a given replying party (RP)
          ID, this option permits choosing a key to be used for
          assertion. By default, the option is set to
    <code class="literal">
     FALSE
    </code>
    , indicating that assertions are to be
          created using all resident keys for a given RP ID. When
          specified with this option,
    <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
     <span class="command">
      <strong>
       mysql
      </strong>
     </span>
    </a>
    prompts
          the you for a device PIN and lists all of the available
          credentials for given RP ID. Select one key and then perform
          the remaining online instructions to complete the
          authentication. The example here assumes that
    <code class="literal">
     mysql.com
    </code>
    is a valid RP ID:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa43534959"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token constant">--user</span><span class="token attr-value"><span class="token punctuation">=</span>u2</span> <span class="token property">--password1</span> <span class="token constant">--register-factor</span><span class="token attr-value"><span class="token punctuation">=</span>2</span>
     <span class="token property">--plugin-authentication-webauthn-client-preserve-privacy</span>
Enter password<span class="token punctuation">:</span> <span class="token punctuation"></span><em class="replaceable"><span class="token punctuation">(</span>enter factor 1 password<span class="token punctuation">)</span></em><span class="token punctuation"></span>
Enter PIN for token device<span class="token punctuation">:</span> 
Found following credentials for RP ID<span class="token punctuation">:</span> mysql<span class="token punctuation">.</span>com
<span class="token punctuation">[</span>1<span class="token punctuation">]</span>`u2`@`127<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>1`
<span class="token punctuation">[</span>2<span class="token punctuation">]</span>`u2`@`%`
Please select one<span class="token punctuation">(</span>1<span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span>N<span class="token punctuation">)</span><span class="token punctuation">:</span>
1
Please insert FIDO device and perform gesture action for authentication to complete<span class="token punctuation">.</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> CURRENT_USER() <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> u2@127.0.0.1   <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
   </div>
   <p>
    The
    <a class="link" href="mysql-command-options.html#option_mysql_plugin-authentication-webauthn-client-preserve-privacy">
     <code class="option">
      --plugin-authentication-webauthn-client-preserve-privacy
     </code>
    </a>
    option has no effect on FIDO devices that do not support the
          resident-key feature.
   </p>
   <p>
    When the registration process is complete, the connection to
          the server is permitted.
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     The connection to the server is permitted following
            registration regardless of additional authentication factors
            in the account's authentication chain. For example, if
            the account in the preceding example was defined with a
            third authentication factor (using non-WebAuthn
            authentication), the connection would be permitted after a
            successful registration without authenticating the third
            factor. However, subsequent connections would require
            authenticating all three factors.
    </p>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="webauthn-pluggable-authentication-passwordless">
       </a>
       WebAuthn Passwordless Authentication
      </h5>
     </div>
    </div>
   </div>
   <p>
    This section describes how WebAuthn can be used by itself to
          create 1FA accounts that authenticate in a passwordless
          manner. In this context,
    <span class="quote">
     “
     <span class="quote">
      passwordless
     </span>
     ”
    </span>
    means
          that authentication occurs but uses a method other than a
          password, such as a security key or biometric scan. It does
          not refer to an account that uses a password-based
          authentication plugin for which the password is empty. That
          kind of
    <span class="quote">
     “
     <span class="quote">
      passwordless
     </span>
     ”
    </span>
    is completely insecure and
          is not recommended.
   </p>
   <p>
    The following prerequisites apply when using the
    <code class="literal">
     authentication_webauthn
    </code>
    plugin to achieve
          passwordless authentication:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The user that creates a passwordless-authentication
              account requires the
       <a class="link" href="privileges-provided.html#priv_passwordless-user-admin">
        <code class="literal">
         PASSWORDLESS_USER_ADMIN
        </code>
       </a>
       privilege in addition to the
       <a class="link" href="privileges-provided.html#priv_create-user">
        <code class="literal">
         CREATE
              USER
        </code>
       </a>
       privilege.
      </p>
     </li>
     <li class="listitem">
      <p>
       The first element of the
       <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
        <code class="literal">
         authentication_policy
        </code>
       </a>
       value must be an asterisk (
       <code class="literal">
        *
       </code>
       ) and not a
              plugin name. For example, the default
       <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
        <code class="literal">
         authentication_policy
        </code>
       </a>
       value supports enabling passwordless authentication
              because the first element is an asterisk:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-ini"><div class="docs-select-all right" id="sa8355260"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token constant">authentication_policy</span><span class="token attr-value"><span class="token punctuation">=</span>'*,,'</span></code></pre>
      </div>
      <p>
       For information about configuring the
       <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
        <code class="literal">
         authentication_policy
        </code>
       </a>
       value, see
       <a class="xref" href="multifactor-authentication.html#multifactor-authentication-policy" title="Configuring the Multifactor Authentication Policy">
        Configuring the Multifactor Authentication Policy
       </a>
       .
      </p>
     </li>
    </ul>
   </div>
   <p>
    To use
    <code class="literal">
     authentication_webauthn
    </code>
    as a
          passwordless authentication method, the account must be
          created with
    <code class="literal">
     authentication_webauthn
    </code>
    as the
          first factor authentication method. The
    <code class="literal">
     INITIAL
          AUTHENTICATION IDENTIFIED BY
    </code>
    clause must also be
          specified for the first factor (it is not supported with 2nd
          or 3rd factors). This clause specifies whether a randomly
          generated or user-specified password will be used for
          FIDO/FIDO2 device registration. After device registration, the
          server deletes the password and modifies the account to make
    <code class="literal">
     authentication_webauthn
    </code>
    the sole
          authentication method (the 1FA method).
   </p>
   <p>
    The required
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    syntax
          is as follows:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa2152259"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token keyword"><em class="replaceable">user</em></span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> authentication_webauthn
  INITIAL AUTHENTICATION <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> {<span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span> <span class="token operator">|</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>}<span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    The following example uses the
    <code class="literal">
     RANDOM
          PASSWORD
    </code>
    syntax:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa70030828"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'u1'</span>@<span class="token string">'localhost'</span>
         <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> authentication_webauthn
         INITIAL AUTHENTICATION <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> user <span class="token punctuation">|</span> host      <span class="token punctuation">|</span> generated password   <span class="token punctuation">|</span> auth_factor <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> u1   <span class="token punctuation">|</span> localhost <span class="token punctuation">|</span> 9XHK]M{l2rnD;VXyHzeF <span class="token punctuation">|</span>           1 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
   </div>
   <p>
    To perform registration, the user must authenticate to the
          server with the password associated with the
    <code class="literal">
     INITIAL
          AUTHENTICATION IDENTIFIED BY
    </code>
    clause, either the
          randomly generated password, or the
    <code class="literal">
     '
     <em class="replaceable">
      <code>
       auth_string
      </code>
     </em>
     '
    </code>
    value. If the account was created as just shown, the user
          executes this command and pastes in the preceding randomly
          generated password (
    <code class="literal">
     9XHK]M{l2rnD;VXyHzeF
    </code>
    )
          at the prompt:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa58683290"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token constant">--user</span><span class="token attr-value"><span class="token punctuation">=</span>u1</span> <span class="token property">--password</span> <span class="token constant">--register-factor</span><span class="token attr-value"><span class="token punctuation">=</span>2</span>
Enter password<span class="token punctuation">:</span>
Please insert FIDO device and follow the instruction<span class="token punctuation">.</span> Depending on the device<span class="token punctuation">,</span> 
you may have to perform gesture action multiple times<span class="token punctuation">.</span>
1<span class="token punctuation">.</span> Perform gesture action <span class="token punctuation">(</span>Skip this step if you are prompted to enter device PIN<span class="token punctuation">)</span><span class="token punctuation">.</span>
2<span class="token punctuation">.</span> Enter PIN for token device<span class="token punctuation">:</span>
3<span class="token punctuation">.</span> Perform gesture action for registration to complete<span class="token punctuation">.</span>
Welcome to the MySQL monitor<span class="token punctuation">.</span>  Commands end with <span class="token punctuation">;</span> or \g<span class="token punctuation">.</span>
Your MySQL connection id is 10</code></pre>
   </div>
   <p>
    Alternatively, use the
    <a class="link" href="mysql-command-options.html#option_mysql_plugin-authentication-webauthn-client-preserve-privacy">
     <code class="option">
      --plugin-authentication-webauthn-client-preserve-privacy
     </code>
    </a>
    option to select a discoverable credential for authentication.
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa97840356"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token constant">--user</span><span class="token attr-value"><span class="token punctuation">=</span>u1</span> <span class="token property">--password</span> <span class="token constant">--register-factor</span><span class="token attr-value"><span class="token punctuation">=</span>2</span>
     <span class="token property">--plugin-authentication-webauthn-client-preserve-privacy</span>
Enter password<span class="token punctuation">:</span>
Enter PIN for token device<span class="token punctuation">:</span> 
Found following credentials for RP ID<span class="token punctuation">:</span> mysql<span class="token punctuation">.</span>com
<span class="token punctuation">[</span>1<span class="token punctuation">]</span>`u1`@`127<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>1`
<span class="token punctuation">[</span>2<span class="token punctuation">]</span>`u1`@`%`
Please select one<span class="token punctuation">(</span>1<span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span>N<span class="token punctuation">)</span><span class="token punctuation">:</span>
1
Please insert FIDO device and perform gesture action for authentication to complete<span class="token punctuation">.</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> CURRENT_USER() <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> u1@127.0.0.1   <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
   </div>
   <p>
    The option
    <a class="link" href="mysql-command-options.html#option_mysql_register-factor">
     <code class="option">
      --register-factor=2
     </code>
    </a>
    is used because the
    <code class="literal">
     INITIAL AUTHENTICATION IDENTIFIED
          BY
    </code>
    clause is currently acting as the first factor
          authentication method. The user must therefore provide the
          temporary password by using the second factor. On a successful
          registration, the server removes the temporary password and
          revises the account entry in the
    <code class="literal">
     mysql.user
    </code>
    system table to list
    <code class="literal">
     authentication_webauthn
    </code>
    as the sole (1FA)
          authentication method.
   </p>
   <p>
    When creating a passwordless-authentication account, it is
          important to include the
    <code class="literal">
     INITIAL AUTHENTICATION
          IDENTIFIED BY
    </code>
    clause in the
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    statement. The
          server accepts a statement without the clause, but the
          resulting account is unusable because there is no way to
          connect to the server to register the device. Suppose that you
          execute a statement like this:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa63711153"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'u2'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> authentication_webauthn<span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Subsequent attempts to use the account to connect fail like
          this:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa93138608"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token constant">--user</span><span class="token attr-value"><span class="token punctuation">=</span>u2</span> <span class="token property">--skip-password</span>
mysql<span class="token punctuation">:</span> <span class="token punctuation">[</span>Warning<span class="token punctuation">]</span> Using a password on the command line can be insecure<span class="token punctuation">.</span>
No FIDO device on client host<span class="token punctuation">.</span>
<span class="token output">ERROR 1 (HY000)<span class="token punctuation">:</span> Unknown MySQL error</span></code></pre>
   </div>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     Passwordless authentication is achieved using the Universal
            2nd Factor (U2F) protocol, which does not support additional
            security measures such as setting a PIN on the device to be
            registered. It is therefore the responsibility of the device
            holder to ensure the device is handled in a secure manner.
    </p>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="webauthn-pluggable-authentication-unregistration">
       </a>
       Device Unregistration for WebAuthn
      </h5>
     </div>
    </div>
   </div>
   <p>
    It is possible to unregister FIDO/FIDO2 devices associated
          with a MySQL account. This might be desirable or necessary
          under multiple circumstances:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       A FIDO/FIDO2 device is to be replaced with a different
              device. The previous device must be unregistered and the
              new device registered.
      </p>
      <p>
       In this case, the account owner or any user who has the
       <a class="link" href="privileges-provided.html#priv_create-user">
        <code class="literal">
         CREATE USER
        </code>
       </a>
       privilege can
              unregister the device. The account owner can register the
              new device.
      </p>
     </li>
     <li class="listitem">
      <p>
       A FIDO/FIDO2 device is reset or lost. Authentication
              attempts will fail until the current device is
              unregistered and a new registration is performed.
      </p>
      <p>
       In this case, the account owner, being unable to
              authenticate, cannot unregister the current device and
              must contact the DBA (or any user who has the
       <a class="link" href="privileges-provided.html#priv_create-user">
        <code class="literal">
         CREATE USER
        </code>
       </a>
       privilege) to
              do so. Then the account owner can reregister the reset
              device or register a new device.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Unregistering a FIDO/FIDO2 device can be done by the account
          owner or by any user who has the
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE
          USER
     </code>
    </a>
    privilege. Use this syntax:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa73837816"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token keyword"><em class="replaceable">user</em></span> {<span class="token number">2</span> <span class="token operator">|</span> <span class="token number">3</span>} FACTOR UNREGISTER<span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    To re-register a device or perform a new registration, refer
          to the instructions in
    <a class="xref" href="webauthn-pluggable-authentication.html#webauthn-pluggable-authentication-usage" title="Using WebAuthn Authentication">
     Using WebAuthn Authentication
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="webauthn-pluggable-authentication-process">
       </a>
       How WebAuthn Authentication of MySQL Users Works
      </h5>
     </div>
    </div>
   </div>
   <p>
    This section provides an overview of how MySQL and WebAuthn
          work together to authenticate MySQL users. For examples
          showing how to set up MySQL accounts to use the WebAuthn
          authentication plugins, see
    <a class="xref" href="webauthn-pluggable-authentication.html#webauthn-pluggable-authentication-usage" title="Using WebAuthn Authentication">
     Using WebAuthn Authentication
    </a>
    .
   </p>
   <p>
    An account that uses WebAuthn authentication must perform an
          initial device registration step before it can connect to the
          server. After the device has been registered, authentication
          can proceed. WebAuthn device registration process is as
          follows:
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       The server sends a random challenge, user ID, and relying
              party ID (which uniquely identifies a server) to the
              client in JSON format. The relying party ID is defined by
              the
       <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_webauthn_rp_id">
        <code class="literal">
         authentication_webauthn_rp_id
        </code>
       </a>
       system variable. The default value is
       <code class="literal">
        mysql.com
       </code>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       The client receives that information and sends it to the
              client-side WebAuthn authentication plugin, which in turn
              provides it to the FIDO/FIDO2 device. Client also sends
              1-byte capability, with RESIDENT_KEYS bit set to
       <code class="literal">
        ON
       </code>
       (if it is FIDO2 device) or
       <code class="literal">
        OFF
       </code>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       After the user has performed the appropriate device action
              (for example, touching the device or performing a
              biometric scan) the FIDO/FIDO2 device generates a
              public/private key pair, a key handle, an X.509
              certificate, and a signature, which is returned to the
              server.
      </p>
     </li>
     <li class="listitem">
      <p>
       The server-side WebAuthn authentication plugin verifies
              the signature. With successful verification, the server
              stores the credential ID (for FIDO devices only) and
              public key in the
       <code class="literal">
        mysql.user
       </code>
       system
              table.
      </p>
     </li>
    </ol>
   </div>
   <p>
    After registration has been performed successfully, WebAuthn
          authentication follows this process:
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       The server sends a random challenge, user ID, relying
              party ID and credentials to the client. The challenge is
              converted to URL-safe Base64 format.
      </p>
     </li>
     <li class="listitem">
      <p>
       The client sends the same information to the device. The
              client queries the device to check if it supports
              Client-to-Authenticator Protocols (CTAP2) protocol. CTAP2
              support indicates that the device is FIDO2-protocol aware.
      </p>
     </li>
     <li class="listitem">
      <p>
       The FIDO/FIDO2 device prompts the user to perform the
              appropriate device action, based on the selection made
              during registration.
      </p>
      <p>
       If the device is FIDO2-protocol aware, the device signs
              with all private keys available in the device for a given
              RP ID. Optionally, it may prompt user to pick one from the
              list as well. If the device is not FIDO2 capable, it
              fetches the right private key.
      </p>
     </li>
     <li class="listitem">
      <p>
       This action unlocks the private key and the challenge is
              signed.
      </p>
     </li>
     <li class="listitem">
      <p>
       This signed challenge is returned to the server.
      </p>
     </li>
     <li class="listitem">
      <p>
       The server-side WebAuthn authentication plugin verifies
              the signature with the public key and responds to indicate
              authentication success or failure.
      </p>
     </li>
    </ol>
   </div>
  </div>
 </div>
 <br/>
</div>
