<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="x-plugin-sha2-cache-plugin">
      </a>
      22.5.4 Using X Plugin with the Caching SHA-2 Authentication Plugin
     </h3>
    </div>
   </div>
  </div>
  <p>
   X Plugin supports MySQL user accounts created with the
   <code class="literal">
    caching_sha2_password
   </code>
   authentication plugin.
      For more information on this plugin, see
   <a class="xref" href="caching-sha2-pluggable-authentication.html" title="8.4.1.2 Caching SHA-2 Pluggable Authentication">
    Section 8.4.1.2, “Caching SHA-2 Pluggable Authentication”
   </a>
   . You can
      use X Plugin to authenticate against such accounts using non-SSL
      connections with
   <code class="literal">
    SHA256_MEMORY
   </code>
   authentication
      and SSL connections with
   <code class="literal">
    PLAIN
   </code>
   authentication.
  </p>
  <p>
   Although the
   <code class="literal">
    caching_sha2_password
   </code>
   authentication plugin holds an authentication cache, this cache is
      not shared with X Plugin, so X Plugin uses its own
      authentication cache for
   <code class="literal">
    SHA256_MEMORY
   </code>
   authentication. The X Plugin authentication cache stores hashes
      of user account passwords, and cannot be accessed using SQL. If a
      user account is modified or removed, the relevant entries are
      removed from the cache. The X Plugin authentication cache is
      maintained by the
   <code class="literal">
    mysqlx_cache_cleaner
   </code>
   plugin,
      which is enabled by default, and has no related system variables
      or status variables.
  </p>
  <p>
   Before you can use non-SSL X Protocol connections to authenticate
      an account that uses the
   <code class="literal">
    caching_sha2_password
   </code>
   authentication plugin, the account must have authenticated at
      least once over an X Protocol connection with SSL, to supply the
      password to the X Plugin authentication cache. Once this initial
      authentication over SSL has succeeded, non-SSL X Protocol
      connections can be used.
  </p>
  <p>
   It is possible to disable the
   <code class="literal">
    mysqlx_cache_cleaner
   </code>
   plugin by starting the
      MySQL server with the option
   <code class="literal">
    --mysqlx_cache_cleaner=0
   </code>
   . If you do this, the
      X Plugin authentication cache is disabled, and therefore SSL must
      always be used for X Protocol connections when authenticating
      with
   <code class="literal">
    SHA256_MEMORY
   </code>
   authentication.
  </p>
 </div>
 <br/>
</div>
