<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="password-management">
      </a>
      8.2.15 Password Management
     </h3>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045248689824">
  </a>
  <p>
   MySQL supports these password-management capabilities:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      Password expiration, to require passwords to be changed
          periodically.
     </p>
    </li>
    <li class="listitem">
     <p>
      Password reuse restrictions, to prevent old passwords from
          being chosen again.
     </p>
    </li>
    <li class="listitem">
     <p>
      Password verification, to require that password changes also
          specify the current password to be replaced.
     </p>
    </li>
    <li class="listitem">
     <p>
      Dual passwords, to enable clients to connect using either a
          primary or secondary password.
     </p>
    </li>
    <li class="listitem">
     <p>
      Password strength assessment, to require strong passwords.
     </p>
    </li>
    <li class="listitem">
     <p>
      Random password generation, as an alternative to requiring
          explicit administrator-specified literal passwords.
     </p>
    </li>
    <li class="listitem">
     <p>
      Password failure tracking, to enable temporary account locking
          after too many consecutive incorrect-password login failures.
     </p>
    </li>
   </ul>
  </div>
  <p>
   The following sections describe these capabilities, except
      password strength assessment, which is implemented using the
   <code class="literal">
    validate_password
   </code>
   component and is described in
   <a class="xref" href="validate-password.html" title="8.4.3 The Password Validation Component">
    Section 8.4.3, “The Password Validation Component”
   </a>
   .
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="password-management.html#internal-versus-external-credentials" title="Internal Versus External Credentials Storage">
       Internal Versus External Credentials Storage
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="password-management.html#password-expiration-policy" title="Password Expiration Policy">
       Password Expiration Policy
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="password-management.html#password-reuse-policy" title="Password Reuse Policy">
       Password Reuse Policy
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="password-management.html#password-reverification-policy" title="Password Verification-Required Policy">
       Password Verification-Required Policy
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="password-management.html#dual-passwords" title="Dual Password Support">
       Dual Password Support
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="password-management.html#random-password-generation" title="Random Password Generation">
       Random Password Generation
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="password-management.html#failed-login-tracking" title="Failed-Login Tracking and Temporary Account Locking">
       Failed-Login Tracking and Temporary Account Locking
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    MySQL implements password-management capabilities using tables
        in the
    <code class="literal">
     mysql
    </code>
    system database. If you upgrade
        MySQL from an earlier version, your system tables might not be
        up to date. In that case, the server writes messages similar to
        these to the error log during the startup process (the exact
        numbers may vary):
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-none"><div class="docs-select-all right" id="sa66066346"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">[ERROR] Column count of mysql.user is wrong. Expected
49, found 47. The table is probably corrupted
[Warning] ACL table mysql.password_history missing.
Some operations may fail.</code></pre>
   </div>
   <p>
    To correct the issue, perform the MySQL upgrade procedure. See
    <a class="xref" href="upgrading.html" title="Chapter 3 Upgrading MySQL">
     Chapter 3,
     <i>
      Upgrading MySQL
     </i>
    </a>
    . Until this is done,
    <span class="emphasis">
     <em>
      password changes are not possible.
     </em>
    </span>
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="internal-versus-external-credentials">
       </a>
       Internal Versus External Credentials Storage
      </h4>
     </div>
    </div>
   </div>
   <p>
    Some authentication plugins store account credentials internally
        to MySQL, in the
    <code class="literal">
     mysql.user
    </code>
    system table:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        caching_sha2_password
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        mysql_native_password
       </code>
       (deprecated)
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        sha256_password
       </code>
       (deprecated)
      </p>
     </li>
    </ul>
   </div>
   <p>
    Most discussion in this section applies to such authentication
        plugins because most password-management capabilities described
        here are based on internal credentials storage handled by MySQL
        itself. Other authentication plugins store account credentials
        externally to MySQL. For accounts that use plugins that perform
        authentication against an external credentials system, password
        management must be handled externally against that system as
        well.
   </p>
   <p>
    The exception is that the options for failed-login tracking and
        temporary account locking apply to all accounts, not just
        accounts that use internal credentials storage, because MySQL is
        able to assess the status of login attempts for any account no
        matter whether it uses internal or external credentials storage.
   </p>
   <p>
    For information about individual authentication plugins, see
    <a class="xref" href="authentication-plugins.html" title="8.4.1 Authentication Plugins">
     Section 8.4.1, “Authentication Plugins”
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="password-expiration-policy">
       </a>
       Password Expiration Policy
      </h4>
     </div>
    </div>
   </div>
   <p>
    MySQL enables database administrators to expire account
        passwords manually, and to establish a policy for automatic
        password expiration. Expiration policy can be established
        globally, and individual accounts can be set to either defer to
        the global policy or override the global policy with specific
        per-account behavior.
   </p>
   <p>
    To expire an account password manually, use the
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    statement:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa36137687"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    This operation marks the password expired in the corresponding
        row in the
    <code class="literal">
     mysql.user
    </code>
    system table.
   </p>
   <p>
    Password expiration according to policy is automatic and is
        based on password age, which for a given account is assessed
        from the date and time of its most recent password change. The
    <code class="literal">
     mysql.user
    </code>
    system table indicates for each
        account when its password was last changed, and the server
        automatically treats the password as expired at client
        connection time if its age is greater than its permitted
        lifetime. This works with no explicit manual password
        expiration.
   </p>
   <p>
    To establish automatic password-expiration policy globally, use
        the
    <a class="link" href="server-system-variables.html#sysvar_default_password_lifetime">
     <code class="literal">
      default_password_lifetime
     </code>
    </a>
    system variable. Its default value is 0, which disables
        automatic password expiration. If the value of
    <a class="link" href="server-system-variables.html#sysvar_default_password_lifetime">
     <code class="literal">
      default_password_lifetime
     </code>
    </a>
    is a
        positive integer
    <em class="replaceable">
     <code>
      N
     </code>
    </em>
    , it indicates the
        permitted password lifetime, such that passwords must be changed
        every
    <em class="replaceable">
     <code>
      N
     </code>
    </em>
    days.
   </p>
   <p>
    Examples:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       To establish a global policy that passwords have a lifetime
            of approximately six months, start the server with these
            lines in a server
       <code class="filename">
        my.cnf
       </code>
       file:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa58424907"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">default_password_lifetime</span><span class="token attr-value"><span class="token punctuation">=</span>180</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       To establish a global policy such that passwords never
            expire, set
       <a class="link" href="server-system-variables.html#sysvar_default_password_lifetime">
        <code class="literal">
         default_password_lifetime
        </code>
       </a>
       to 0:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa18266153"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">default_password_lifetime</span><span class="token attr-value"><span class="token punctuation">=</span>0</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="server-system-variables.html#sysvar_default_password_lifetime">
        <code class="literal">
         default_password_lifetime
        </code>
       </a>
       can also be set and persisted at runtime:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa21654613"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SET</span> <span class="token keyword">PERSIST</span> default_password_lifetime <span class="token operator">=</span> <span class="token number">180</span><span class="token punctuation">;</span>
<span class="token keyword">SET</span> <span class="token keyword">PERSIST</span> default_password_lifetime <span class="token operator">=</span> <span class="token number">0</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       <a class="link" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
        <code class="literal">
         SET
            PERSIST
        </code>
       </a>
       sets a value for the running MySQL
            instance. It also saves the value to carry over to
            subsequent server restarts; see
       <a class="xref" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
        Section 15.7.6.1, “SET Syntax for Variable Assignment”
       </a>
       . To change the value for the
            running MySQL instance without having it carry over to
            subsequent restarts, use the
       <code class="literal">
        GLOBAL
       </code>
       keyword rather than
       <code class="literal">
        PERSIST
       </code>
       .
      </p>
     </li>
    </ul>
   </div>
   <p>
    The global password-expiration policy applies to all accounts
        that have not been set to override it. To establish policy for
        individual accounts, use the
    <code class="literal">
     PASSWORD EXPIRE
    </code>
    option of the
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    and
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    statements. See
    <a class="xref" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     Section 15.7.1.3, “CREATE USER Statement”
    </a>
    , and
    <a class="xref" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     Section 15.7.1.1, “ALTER USER Statement”
    </a>
    .
   </p>
   <p>
    Example account-specific statements:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Require the password to be changed every 90 days:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa45495337"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span> <span class="token keyword">INTERVAL</span> <span class="token number">90</span> <span class="token keyword">DAY</span><span class="token punctuation">;</span>
<span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span> <span class="token keyword">INTERVAL</span> <span class="token number">90</span> <span class="token keyword">DAY</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       This expiration option overrides the global policy for all
            accounts named by the statement.
      </p>
     </li>
     <li class="listitem">
      <p>
       Disable password expiration:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa66608953"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span> <span class="token keyword">NEVER</span><span class="token punctuation">;</span>
<span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span> <span class="token keyword">NEVER</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       This expiration option overrides the global policy for all
            accounts named by the statement.
      </p>
     </li>
     <li class="listitem">
      <p>
       Defer to the global expiration policy for all accounts named
            by the statement:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa33743257"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span> <span class="token keyword">DEFAULT</span><span class="token punctuation">;</span>
<span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">EXPIRE</span> <span class="token keyword">DEFAULT</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    When a client successfully connects, the server determines
        whether the account password has expired:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The server checks whether the password has been manually
            expired.
      </p>
     </li>
     <li class="listitem">
      <p>
       Otherwise, the server checks whether the password age is
            greater than its permitted lifetime according to the
            automatic password expiration policy. If so, the server
            considers the password expired.
      </p>
     </li>
    </ul>
   </div>
   <p>
    If the password is expired (whether manually or automatically),
        the server either disconnects the client or restricts the
        operations permitted to it (see
    <a class="xref" href="expired-password-handling.html" title="8.2.16 Server Handling of Expired Passwords">
     Section 8.2.16, “Server Handling of Expired Passwords”
    </a>
    ). Operations
        performed by a restricted client result in an error until the
        user establishes a new account password:
   </p>
   <a class="indexterm" name="idm46045248615248">
   </a>
   <a class="indexterm" name="idm46045248614208">
   </a>
   <a class="indexterm" name="idm46045248612720">
   </a>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa87304117"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token number">1</span><span class="token punctuation">;</span>
<span class="token output">ERROR 1820 (HY000)<span class="token punctuation">:</span> You must reset your password using ALTER USER
statement before executing this statement.
</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token function">USER</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span><span class="token punctuation">;</span>
<span class="token output">Query OK, 0 rows affected (0.01 sec)</span>

<span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token number">1</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> 1 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> 1 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output">1 row in set (0.00 sec)</span></code></pre>
   </div>
   <p>
    After the client resets the password, the server restores normal
        access for the session, as well as for subsequent connections
        that use the account. It is also possible for an administrative
        user to reset the account password, but any existing restricted
        sessions for that account remain restricted. A client using the
        account must disconnect and reconnect before statements can be
        executed successfully.
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     Although it is possible to
     <span class="quote">
      “
      <span class="quote">
       reset
      </span>
      ”
     </span>
     an expired
          password by setting it to its current value, it is preferable,
          as a matter of good policy, to choose a different password.
          DBAs can enforce non-reuse by establishing an appropriate
          password-reuse policy. See
     <a class="xref" href="password-management.html#password-reuse-policy" title="Password Reuse Policy">
      Password Reuse Policy
     </a>
     .
    </p>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="password-reuse-policy">
       </a>
       Password Reuse Policy
      </h4>
     </div>
    </div>
   </div>
   <p>
    MySQL enables restrictions to be placed on reuse of previous
        passwords. Reuse restrictions can be established based on number
        of password changes, time elapsed, or both. Reuse policy can be
        established globally, and individual accounts can be set to
        either defer to the global policy or override the global policy
        with specific per-account behavior.
   </p>
   <p>
    The password history for an account consists of passwords it has
        been assigned in the past. MySQL can restrict new passwords from
        being chosen from this history:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       If an account is restricted on the basis of number of
            password changes, a new password cannot be chosen from a
            specified number of the most recent passwords. For example,
            if the minimum number of password changes is set to 3, a new
            password cannot be the same as any of the most recent 3
            passwords.
      </p>
     </li>
     <li class="listitem">
      <p>
       If an account is restricted based on time elapsed, a new
            password cannot be chosen from passwords in the history that
            are newer than a specified number of days. For example, if
            the password reuse interval is set to 60, a new password
            must not be among those previously chosen within the last 60
            days.
      </p>
     </li>
    </ul>
   </div>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     The empty password does not count in the password history and
          is subject to reuse at any time.
    </p>
   </div>
   <p>
    To establish password-reuse policy globally, use the
    <a class="link" href="server-system-variables.html#sysvar_password_history">
     <code class="literal">
      password_history
     </code>
    </a>
    and
    <a class="link" href="server-system-variables.html#sysvar_password_reuse_interval">
     <code class="literal">
      password_reuse_interval
     </code>
    </a>
    system
        variables.
   </p>
   <p>
    Examples:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       To prohibit reusing any of the last 6 passwords or passwords
            newer than 365 days, put these lines in the server
       <code class="filename">
        my.cnf
       </code>
       file:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa46198965"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">password_history</span><span class="token attr-value"><span class="token punctuation">=</span>6</span>
<span class="token constant">password_reuse_interval</span><span class="token attr-value"><span class="token punctuation">=</span>365</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       To set and persist the variables at runtime, use statements
            like this:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa25580274"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini">SET PERSIST password_history <span class="token attr-value"><span class="token punctuation">=</span> 6;</span>
SET PERSIST password_reuse_interval <span class="token attr-value"><span class="token punctuation">=</span> 365;</span></code></pre>
      </div>
      <p>
       <a class="link" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
        <code class="literal">
         SET
            PERSIST
        </code>
       </a>
       sets a value for the running MySQL
            instance. It also saves the value to carry over to
            subsequent server restarts; see
       <a class="xref" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
        Section 15.7.6.1, “SET Syntax for Variable Assignment”
       </a>
       . To change the value for the
            running MySQL instance without having it carry over to
            subsequent restarts, use the
       <code class="literal">
        GLOBAL
       </code>
       keyword rather than
       <code class="literal">
        PERSIST
       </code>
       .
      </p>
     </li>
    </ul>
   </div>
   <p>
    The global password-reuse policy applies to all accounts that
        have not been set to override it. To establish policy for
        individual accounts, use the
    <code class="literal">
     PASSWORD HISTORY
    </code>
    and
    <code class="literal">
     PASSWORD REUSE INTERVAL
    </code>
    options of the
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    and
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    statements. See
    <a class="xref" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     Section 15.7.1.3, “CREATE USER Statement”
    </a>
    , and
    <a class="xref" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     Section 15.7.1.1, “ALTER USER Statement”
    </a>
    .
   </p>
   <p>
    Example account-specific statements:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Require a minimum of 5 password changes before permitting
            reuse:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa25412577"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">HISTORY</span> <span class="token number">5</span><span class="token punctuation">;</span>
<span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">HISTORY</span> <span class="token number">5</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       This history-length option overrides the global policy for
            all accounts named by the statement.
      </p>
     </li>
     <li class="listitem">
      <p>
       Require a minimum of 365 days elapsed before permitting
            reuse:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa75558374"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REUSE</span> <span class="token keyword">INTERVAL</span> <span class="token number">365</span> <span class="token keyword">DAY</span><span class="token punctuation">;</span>
<span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REUSE</span> <span class="token keyword">INTERVAL</span> <span class="token number">365</span> <span class="token keyword">DAY</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       This time-elapsed option overrides the global policy for all
            accounts named by the statement.
      </p>
     </li>
     <li class="listitem">
      <p>
       To combine both types of reuse restrictions, use
       <code class="literal">
        PASSWORD HISTORY
       </code>
       and
       <code class="literal">
        PASSWORD
            REUSE INTERVAL
       </code>
       together:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa86972695"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">PASSWORD</span> <span class="token keyword">HISTORY</span> <span class="token number">5</span>
  <span class="token keyword">PASSWORD</span> <span class="token keyword">REUSE</span> <span class="token keyword">INTERVAL</span> <span class="token number">365</span> <span class="token keyword">DAY</span><span class="token punctuation">;</span>
<span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">PASSWORD</span> <span class="token keyword">HISTORY</span> <span class="token number">5</span>
  <span class="token keyword">PASSWORD</span> <span class="token keyword">REUSE</span> <span class="token keyword">INTERVAL</span> <span class="token number">365</span> <span class="token keyword">DAY</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       These options override both global policy reuse restrictions
            for all accounts named by the statement.
      </p>
     </li>
     <li class="listitem">
      <p>
       Defer to the global policy for both types of reuse
            restrictions:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa73213764"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">PASSWORD</span> <span class="token keyword">HISTORY</span> <span class="token keyword">DEFAULT</span>
  <span class="token keyword">PASSWORD</span> <span class="token keyword">REUSE</span> <span class="token keyword">INTERVAL</span> <span class="token keyword">DEFAULT</span><span class="token punctuation">;</span>
<span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">PASSWORD</span> <span class="token keyword">HISTORY</span> <span class="token keyword">DEFAULT</span>
  <span class="token keyword">PASSWORD</span> <span class="token keyword">REUSE</span> <span class="token keyword">INTERVAL</span> <span class="token keyword">DEFAULT</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="password-reverification-policy">
       </a>
       Password Verification-Required Policy
      </h4>
     </div>
    </div>
   </div>
   <p>
    It is possible to require that attempts to change an account
        password be verified by specifying the current password to be
        replaced. This enables DBAs to prevent users from changing a
        password without proving that they know the current password.
        Such changes could otherwise occur, for example, if one user
        walks away from a terminal session temporarily without logging
        out, and a malicious user uses the session to change the
        original user's MySQL password. This can have unfortunate
        consequences:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The original user becomes unable to access MySQL until the
            account password is reset by an administrator.
      </p>
     </li>
     <li class="listitem">
      <p>
       Until the password reset occurs, the malicious user can
            access MySQL with the benign user's changed credentials.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Password-verification policy can be established globally, and
        individual accounts can be set to either defer to the global
        policy or override the global policy with specific per-account
        behavior.
   </p>
   <p>
    For each account, its
    <code class="literal">
     mysql.user
    </code>
    row
        indicates whether there is an account-specific setting requiring
        verification of the current password for password change
        attempts. The setting is established by the
    <code class="literal">
     PASSWORD
        REQUIRE
    </code>
    option of the
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE
        USER
     </code>
    </a>
    and
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    statements:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       If the account setting is
       <code class="literal">
        PASSWORD REQUIRE
            CURRENT
       </code>
       , password changes must specify the current
            password.
      </p>
     </li>
     <li class="listitem">
      <p>
       If the account setting is
       <code class="literal">
        PASSWORD REQUIRE CURRENT
            OPTIONAL
       </code>
       , password changes may but need not
            specify the current password.
      </p>
     </li>
     <li class="listitem">
      <p>
       If the account setting is
       <code class="literal">
        PASSWORD REQUIRE CURRENT
            DEFAULT
       </code>
       , the
       <a class="link" href="server-system-variables.html#sysvar_password_require_current">
        <code class="literal">
         password_require_current
        </code>
       </a>
       system variable determines the verification-required policy
            for the account:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          If
          <a class="link" href="server-system-variables.html#sysvar_password_require_current">
           <code class="literal">
            password_require_current
           </code>
          </a>
          is enabled, password changes must specify the current
                password.
         </p>
        </li>
        <li class="listitem">
         <p>
          If
          <a class="link" href="server-system-variables.html#sysvar_password_require_current">
           <code class="literal">
            password_require_current
           </code>
          </a>
          is disabled, password changes may but need not specify
                the current password.
         </p>
        </li>
       </ul>
      </div>
     </li>
    </ul>
   </div>
   <p>
    In other words, if the account setting is not
    <code class="literal">
     PASSWORD
        REQUIRE CURRENT DEFAULT
    </code>
    , the account setting takes
        precedence over the global policy established by the
    <a class="link" href="server-system-variables.html#sysvar_password_require_current">
     <code class="literal">
      password_require_current
     </code>
    </a>
    system
        variable. Otherwise, the account defers to the
    <a class="link" href="server-system-variables.html#sysvar_password_require_current">
     <code class="literal">
      password_require_current
     </code>
    </a>
    setting.
   </p>
   <p>
    By default, password verification is optional:
    <a class="link" href="server-system-variables.html#sysvar_password_require_current">
     <code class="literal">
      password_require_current
     </code>
    </a>
    is
        disabled and accounts created with no
    <code class="literal">
     PASSWORD
        REQUIRE
    </code>
    option default to
    <code class="literal">
     PASSWORD REQUIRE
        CURRENT DEFAULT
    </code>
    .
   </p>
   <p>
    The following table shows how per-account settings interact with
    <a class="link" href="server-system-variables.html#sysvar_password_require_current">
     <code class="literal">
      password_require_current
     </code>
    </a>
    system
        variable values to determine account password
        verification-required policy.
   </p>
   <div class="table">
    <a name="password-verification-policy-table">
    </a>
    <p class="title">
     <b>
      Table 8.10 Password-Verification Policy
     </b>
    </p>
    <div class="table-contents">
     <table summary="Interaction of mysql.user table and password_require_current system variable for password-verification policy.">
      <colgroup>
       <col style="width: 40%"/>
       <col style="width: 30%"/>
       <col style="width: 30%"/>
      </colgroup>
      <thead>
       <tr>
        <th scope="col">
         Per-Account Setting
        </th>
        <th scope="col">
         password_require_current System Variable
        </th>
        <th scope="col">
         Password Changes Require Current Password?
        </th>
       </tr>
      </thead>
      <tbody>
       <tr>
        <th scope="row">
         <code class="literal">
          PASSWORD REQUIRE CURRENT
         </code>
        </th>
        <td>
         <code class="literal">
          OFF
         </code>
        </td>
        <td>
         Yes
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          PASSWORD REQUIRE CURRENT
         </code>
        </th>
        <td>
         <code class="literal">
          ON
         </code>
        </td>
        <td>
         Yes
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          PASSWORD REQUIRE CURRENT OPTIONAL
         </code>
        </th>
        <td>
         <code class="literal">
          OFF
         </code>
        </td>
        <td>
         No
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          PASSWORD REQUIRE CURRENT OPTIONAL
         </code>
        </th>
        <td>
         <code class="literal">
          ON
         </code>
        </td>
        <td>
         No
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          PASSWORD REQUIRE CURRENT DEFAULT
         </code>
        </th>
        <td>
         <code class="literal">
          OFF
         </code>
        </td>
        <td>
         No
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          PASSWORD REQUIRE CURRENT DEFAULT
         </code>
        </th>
        <td>
         <code class="literal">
          ON
         </code>
        </td>
        <td>
         Yes
        </td>
       </tr>
      </tbody>
     </table>
    </div>
   </div>
   <br class="table-break"/>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     Privileged users can change any account password without
          specifying the current password, regardless of the
          verification-required policy. A privileged user is one who has
          the global
     <a class="link" href="privileges-provided.html#priv_create-user">
      <code class="literal">
       CREATE USER
      </code>
     </a>
     privilege or the
     <a class="link" href="privileges-provided.html#priv_update">
      <code class="literal">
       UPDATE
      </code>
     </a>
     privilege for the
     <code class="literal">
      mysql
     </code>
     system database.
    </p>
   </div>
   <p>
    To establish password-verification policy globally, use the
    <a class="link" href="server-system-variables.html#sysvar_password_require_current">
     <code class="literal">
      password_require_current
     </code>
    </a>
    system
        variable. Its default value is
    <code class="literal">
     OFF
    </code>
    , so it is
        not required that account password changes specify the current
        password.
   </p>
   <p>
    Examples:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       To establish a global policy that password changes must
            specify the current password, start the server with these
            lines in a server
       <code class="filename">
        my.cnf
       </code>
       file:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa77462526"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">password_require_current</span><span class="token attr-value"><span class="token punctuation">=</span>ON</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       To set and persist
       <a class="link" href="server-system-variables.html#sysvar_password_require_current">
        <code class="literal">
         password_require_current
        </code>
       </a>
       at
            runtime, use a statement such as one of these:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa25613991"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SET</span> <span class="token keyword">PERSIST</span> password_require_current <span class="token operator">=</span> <span class="token keyword">ON</span><span class="token punctuation">;</span>
<span class="token keyword">SET</span> <span class="token keyword">PERSIST</span> password_require_current <span class="token operator">=</span> <span class="token keyword">OFF</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       <a class="link" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
        <code class="literal">
         SET
            PERSIST
        </code>
       </a>
       sets a value for the running MySQL
            instance. It also saves the value to carry over to
            subsequent server restarts; see
       <a class="xref" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
        Section 15.7.6.1, “SET Syntax for Variable Assignment”
       </a>
       . To change the value for the
            running MySQL instance without having it carry over to
            subsequent restarts, use the
       <code class="literal">
        GLOBAL
       </code>
       keyword rather than
       <code class="literal">
        PERSIST
       </code>
       .
      </p>
     </li>
    </ul>
   </div>
   <p>
    The global password verification-required policy applies to all
        accounts that have not been set to override it. To establish
        policy for individual accounts, use the
    <code class="literal">
     PASSWORD
        REQUIRE
    </code>
    options of the
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE
        USER
     </code>
    </a>
    and
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    statements. See
    <a class="xref" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     Section 15.7.1.3, “CREATE USER Statement”
    </a>
    , and
    <a class="xref" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     Section 15.7.1.1, “ALTER USER Statement”
    </a>
    .
   </p>
   <p>
    Example account-specific statements:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Require that password changes specify the current password:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa66191533"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">CURRENT</span><span class="token punctuation">;</span>
<span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">CURRENT</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       This verification option overrides the global policy for all
            accounts named by the statement.
      </p>
     </li>
     <li class="listitem">
      <p>
       Do not require that password changes specify the current
            password (the current password may but need not be given):
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa68197266"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">CURRENT</span> <span class="token keyword">OPTIONAL</span><span class="token punctuation">;</span>
<span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">CURRENT</span> <span class="token keyword">OPTIONAL</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       This verification option overrides the global policy for all
            accounts named by the statement.
      </p>
     </li>
     <li class="listitem">
      <p>
       Defer to the global password verification-required policy
            for all accounts named by the statement:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa71463880"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">CURRENT</span> <span class="token keyword">DEFAULT</span><span class="token punctuation">;</span>
<span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">CURRENT</span> <span class="token keyword">DEFAULT</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    Verification of the current password comes into play when a user
        changes a password using the
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER
        USER
     </code>
    </a>
    or
    <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
     <code class="literal">
      SET PASSWORD
     </code>
    </a>
    statement. The examples use
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER
        USER
     </code>
    </a>
    , which is preferred over
    <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
     <code class="literal">
      SET
        PASSWORD
     </code>
    </a>
    , but the principles described here are the
        same for both statements.
   </p>
   <p>
    In password-change statements, a
    <code class="literal">
     REPLACE
    </code>
    clause specifies the current password to be replaced. Examples:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Change the current user's password:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa62807784"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token function">USER</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span> <span class="token keyword">REPLACE</span> <span class="token string">'<em class="replaceable">current_auth_string</em>'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Change a named user's password:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa85829751"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>
  <span class="token keyword">REPLACE</span> <span class="token string">'<em class="replaceable">current_auth_string</em>'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Change a named user's authentication plugin and password:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa46411606"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'jeffrey'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> caching_sha2_password <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">auth_string</em>'</span>
  <span class="token keyword">REPLACE</span> <span class="token string">'<em class="replaceable">current_auth_string</em>'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    The
    <code class="literal">
     REPLACE
    </code>
    clause works like this:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        REPLACE
       </code>
       must be given if password changes
            for the account are required to specify the current
            password, as verification that the user attempting to make
            the change actually knows the current password.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        REPLACE
       </code>
       is optional if password changes
            for the account may but need not specify the current
            password.
      </p>
     </li>
     <li class="listitem">
      <p>
       If
       <code class="literal">
        REPLACE
       </code>
       is specified, it must specify
            the correct current password, or an error occurs. This is
            true even if
       <code class="literal">
        REPLACE
       </code>
       is optional.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        REPLACE
       </code>
       can be specified only when
            changing the account password for the current user. (This
            means that in the examples just shown, the statements that
            explicitly name the account for
       <code class="literal">
        jeffrey
       </code>
       fail unless the current user is
       <code class="literal">
        jeffrey
       </code>
       .)
            This is true even if the change is attempted for another
            user by a privileged user; however, such a user can change
            any password without specifying
       <code class="literal">
        REPLACE
       </code>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        REPLACE
       </code>
       is omitted from the binary log to
            avoid writing cleartext passwords to it.
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="dual-passwords">
       </a>
       Dual Password Support
      </h4>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045248445344">
   </a>
   <a class="indexterm" name="idm46045248443856">
   </a>
   <a class="indexterm" name="idm46045248442784">
   </a>
   <a class="indexterm" name="idm46045248441712">
   </a>
   <p>
    User accounts are permitted to have dual passwords, designated
        as primary and secondary passwords. Dual-password capability
        makes it possible to seamlessly perform credential changes in
        scenarios like this:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       A system has a large number of MySQL servers, possibly
            involving replication.
      </p>
     </li>
     <li class="listitem">
      <p>
       Multiple applications connect to different MySQL servers.
      </p>
     </li>
     <li class="listitem">
      <p>
       Periodic credential changes must be made to the account or
            accounts used by the applications to connect to the servers.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Consider how a credential change must be performed in the
        preceding type of scenario when an account is permitted only a
        single password. In this case, there must be close cooperation
        in the timing of when the account password change is made and
        propagated throughout all servers, and when all applications
        that use the account are updated to use the new password. This
        process may involve downtime during which servers or
        applications are unavailable.
   </p>
   <p>
    With dual passwords, credential changes can be made more easily,
        in phases, without requiring close cooperation, and without
        downtime:
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       For each affected account, establish a new primary password
            on the servers, retaining the current password as the
            secondary password. This enables servers to recognize either
            the primary or secondary password for each account, while
            applications can continue to connect to the servers using
            the same password as previously (which is now the secondary
            password).
      </p>
     </li>
     <li class="listitem">
      <p>
       After the password change has propagated to all servers,
            modify applications that use any affected account to connect
            using the account primary password.
      </p>
     </li>
     <li class="listitem">
      <p>
       After all applications have been migrated from the secondary
            passwords to the primary passwords, the secondary passwords
            are no longer needed and can be discarded. After this change
            has propagated to all servers, only the primary password for
            each account can be used to connect. The credential change
            is now complete.
      </p>
     </li>
    </ol>
   </div>
   <p>
    MySQL implements dual-password capability with syntax that saves
        and discards secondary passwords:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The
       <code class="literal">
        RETAIN CURRENT PASSWORD
       </code>
       clause for
            the
       <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
        <code class="literal">
         ALTER USER
        </code>
       </a>
       and
       <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
        <code class="literal">
         SET PASSWORD
        </code>
       </a>
       statements saves
            an account current password as its secondary password when
            you assign a new primary password.
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <code class="literal">
        DISCARD OLD PASSWORD
       </code>
       clause for
       <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
        <code class="literal">
         ALTER USER
        </code>
       </a>
       discards an
            account secondary password, leaving only the primary
            password.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Suppose that, for the previously described credential-change
        scenario, an account named
    <code class="literal">
     'appuser1'@'host1.example.com'
    </code>
    is used by
        applications to connect to servers, and that the account
        password is to be changed from
    <code class="literal">
     '
     <em class="replaceable">
      <code>
       password_a
      </code>
     </em>
     '
    </code>
    to
    <code class="literal">
     '
     <em class="replaceable">
      <code>
       password_b
      </code>
     </em>
     '
    </code>
    .
   </p>
   <p>
    To perform this change of credentials, use
    <code class="literal">
     ALTER
        USER
    </code>
    as follows:
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       On each server that is not a replica, establish
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          password_b
         </code>
        </em>
        '
       </code>
       as the new
       <code class="literal">
        appuser1
       </code>
       primary password,
            retaining the current password as the secondary password:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa95975821"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'appuser1'</span>@<span class="token string">'host1.example.com'</span>
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password_b</em>'</span>
  <span class="token keyword">RETAIN</span> <span class="token keyword">CURRENT</span> <span class="token keyword">PASSWORD</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Wait for the password change to replicate throughout the
            system to all replicas.
      </p>
     </li>
     <li class="listitem">
      <p>
       Modify each application that uses the
       <code class="literal">
        appuser1
       </code>
       account so that it connects to
            the servers using a password of
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          password_b
         </code>
        </em>
        '
       </code>
       rather than
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          password_a
         </code>
        </em>
        '
       </code>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       At this point, the secondary password is no longer needed.
            On each server that is not a replica, discard the secondary
            password:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa12645861"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'appuser1'</span>@<span class="token string">'host1.example.com'</span>
  <span class="token keyword">DISCARD</span> <span class="token keyword">OLD</span> <span class="token keyword">PASSWORD</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       After the discard-password change has replicated to all
            replicas, the credential change is complete.
      </p>
     </li>
    </ol>
   </div>
   <p>
    The
    <code class="literal">
     RETAIN CURRENT PASSWORD
    </code>
    and
    <code class="literal">
     DISCARD OLD PASSWORD
    </code>
    clauses have the
        following effects:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        RETAIN CURRENT PASSWORD
       </code>
       retains an
            account current password as its secondary password,
            replacing any existing secondary password. The new password
            becomes the primary password, but clients can use the
            account to connect to the server using either the primary or
            secondary password. (Exception: If the new password
            specified by the
       <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
        <code class="literal">
         ALTER USER
        </code>
       </a>
       or
       <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
        <code class="literal">
         SET PASSWORD
        </code>
       </a>
       statement is
            empty, the secondary password becomes empty as well, even if
       <code class="literal">
        RETAIN CURRENT PASSWORD
       </code>
       is given.)
      </p>
     </li>
     <li class="listitem">
      <p>
       If you specify
       <code class="literal">
        RETAIN CURRENT PASSWORD
       </code>
       for an account that has an empty primary password, the
            statement fails.
      </p>
     </li>
     <li class="listitem">
      <p>
       If an account has a secondary password and you change its
            primary password without specifying
       <code class="literal">
        RETAIN CURRENT
            PASSWORD
       </code>
       , the secondary password remains
            unchanged.
      </p>
     </li>
     <li class="listitem">
      <p>
       For
       <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
        <code class="literal">
         ALTER USER
        </code>
       </a>
       , if you change
            the authentication plugin assigned to the account, the
            secondary password is discarded. If you change the
            authentication plugin and also specify
       <code class="literal">
        RETAIN
            CURRENT PASSWORD
       </code>
       , the statement fails.
      </p>
     </li>
     <li class="listitem">
      <p>
       For
       <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
        <code class="literal">
         ALTER USER
        </code>
       </a>
       ,
       <code class="literal">
        DISCARD OLD PASSWORD
       </code>
       discards the
            secondary password, if one exists. The account retains only
            its primary password, and clients can use the account to
            connect to the server only with the primary password.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Statements that modify secondary passwords require these
        privileges:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The
       <a class="link" href="privileges-provided.html#priv_application-password-admin">
        <code class="literal">
         APPLICATION_PASSWORD_ADMIN
        </code>
       </a>
       privilege is required to use the
       <code class="literal">
        RETAIN CURRENT
            PASSWORD
       </code>
       or
       <code class="literal">
        DISCARD OLD
            PASSWORD
       </code>
       clause for
       <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
        <code class="literal">
         ALTER
            USER
        </code>
       </a>
       and
       <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
        <code class="literal">
         SET
            PASSWORD
        </code>
       </a>
       statements that apply to your own
            account. The privilege is required to manipulate your own
            secondary password because most users require only one
            password.
      </p>
     </li>
     <li class="listitem">
      <p>
       If an account is to be permitted to manipulate secondary
            passwords for all accounts, it should be granted the
       <a class="link" href="privileges-provided.html#priv_create-user">
        <code class="literal">
         CREATE USER
        </code>
       </a>
       privilege rather
            than
       <a class="link" href="privileges-provided.html#priv_application-password-admin">
        <code class="literal">
         APPLICATION_PASSWORD_ADMIN
        </code>
       </a>
       .
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="random-password-generation">
       </a>
       Random Password Generation
      </h4>
     </div>
    </div>
   </div>
   <p>
    The
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    ,
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    , and
    <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
     <code class="literal">
      SET PASSWORD
     </code>
    </a>
    statements have the
        capability of generating random passwords for user accounts, as
        an alternative to requiring explicit administrator-specified
        literal passwords. See the description of each statement for
        details about the syntax. This section describes the
        characteristics common to generated random passwords.
   </p>
   <p>
    By default, generated random passwords have a length of 20
        characters. This length is controlled by the
    <a class="link" href="server-system-variables.html#sysvar_generated_random_password_length">
     <code class="literal">
      generated_random_password_length
     </code>
    </a>
    system variable, which has a range from 5 to 255.
   </p>
   <p>
    For each account for which a statement generates a random
        password, the statement stores the password in the
    <code class="literal">
     mysql.user
    </code>
    system table, hashed appropriately
        for the account authentication plugin. The statement also
        returns the cleartext password in a row of a result set to make
        it available to the user or application executing the statement.
        The result set columns are named
    <code class="literal">
     user
    </code>
    ,
    <code class="literal">
     host
    </code>
    ,
    <code class="literal">
     generated password
    </code>
    ,
        and
    <code class="literal">
     auth_factor
    </code>
    indicating the user name and
        host name values that identify the affected row in the
    <code class="literal">
     mysql.user
    </code>
    system table, the cleartext
        generated password, and the authentication factor the displayed
        password value applies to.
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa48582610"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">CREATE</span> <span class="token keyword">USER</span>
       <span class="token string">'u1'</span>@<span class="token string">'localhost'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span><span class="token punctuation">,</span>
       <span class="token string">'u2'</span>@<span class="token string">'%.example.com'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span><span class="token punctuation">,</span>
       <span class="token string">'u3'</span>@<span class="token string">'%.org'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> user <span class="token punctuation">|</span> host          <span class="token punctuation">|</span> generated password   <span class="token punctuation">|</span> auth_factor <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> u1   <span class="token punctuation">|</span> localhost     <span class="token punctuation">|</span> iOeqf&gt;Mh9:;XD&amp;qn(Hl} <span class="token punctuation">|</span>           1 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> u2   <span class="token punctuation">|</span> %.example.com <span class="token punctuation">|</span> sXTSAEvw3St<span class="token punctuation">-</span>R<span class="token punctuation">+</span>_<span class="token punctuation">-</span>C3Vb <span class="token punctuation">|</span>           1 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> u3   <span class="token punctuation">|</span> %.org         <span class="token punctuation">|</span> nEVe%Ctw/U/*Md)Exc7&amp; <span class="token punctuation">|</span>           1 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">ALTER</span> <span class="token keyword">USER</span>
       <span class="token string">'u1'</span>@<span class="token string">'localhost'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span><span class="token punctuation">,</span>
       <span class="token string">'u2'</span>@<span class="token string">'%.example.com'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token keyword">RANDOM</span> <span class="token keyword">PASSWORD</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> user <span class="token punctuation">|</span> host          <span class="token punctuation">|</span> generated password   <span class="token punctuation">|</span> auth_factor <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> u1   <span class="token punctuation">|</span> localhost     <span class="token punctuation">|</span> Seiei:&amp;cw}8]@3OA64vh <span class="token punctuation">|</span>           1 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> u2   <span class="token punctuation">|</span> %.example.com <span class="token punctuation">|</span> j@&amp;diTX80l8}(NiHXSae <span class="token punctuation">|</span>           1 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">SET</span> <span class="token keyword">PASSWORD</span> <span class="token keyword">FOR</span> <span class="token string">'u3'</span>@<span class="token string">'%.org'</span> <span class="token keyword">TO</span> <span class="token keyword">RANDOM</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> user <span class="token punctuation">|</span> host  <span class="token punctuation">|</span> generated password   <span class="token punctuation">|</span> auth_factor <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> u3   <span class="token punctuation">|</span> %.org <span class="token punctuation">|</span> n&amp;cz2xF;P3!U)<span class="token punctuation">+</span>]Vw52H <span class="token punctuation">|</span>           1 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
   </div>
   <p>
    A
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    ,
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    , or
    <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
     <code class="literal">
      SET PASSWORD
     </code>
    </a>
    statement that
        generates a random password for an account is written to the
        binary log as a
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    or
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    statement with an
    <code class="literal">
     IDENTIFIED WITH
     <em class="replaceable">
      <code>
       auth_plugin
      </code>
     </em>
     AS '
     <em class="replaceable">
      <code>
       auth_string
      </code>
     </em>
     '
    </code>
    , clause,
        where
    <em class="replaceable">
     <code>
      auth_plugin
     </code>
    </em>
    is the account
        authentication plugin and
    <code class="literal">
     '
     <em class="replaceable">
      <code>
       auth_string
      </code>
     </em>
     '
    </code>
    is
        the account hashed password value.
   </p>
   <p>
    If the
    <code class="literal">
     validate_password
    </code>
    component is
        installed, the policy that it implements has no effect on
        generated passwords. (The purpose of password validation is to
        help humans create better passwords.)
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="failed-login-tracking">
       </a>
       Failed-Login Tracking and Temporary Account Locking
      </h4>
     </div>
    </div>
   </div>
   <p>
    Administrators can configure user accounts such that too many
        consecutive login failures cause temporary account locking.
   </p>
   <p>
    <span class="quote">
     “
     <span class="quote">
      Login failure
     </span>
     ”
    </span>
    in this context means failure of
        the client to provide a correct password during a connection
        attempt. It does not include failure to connect for reasons such
        as unknown user or network issues. For accounts that have dual
        passwords (see
    <a class="xref" href="password-management.html#dual-passwords" title="Dual Password Support">
     Dual Password Support
    </a>
    ), either account
        password counts as correct.
   </p>
   <p>
    The required number of login failures and the lock time are
        configurable per account, using the
    <code class="literal">
     FAILED_LOGIN_ATTEMPTS
    </code>
    and
    <code class="literal">
     PASSWORD_LOCK_TIME
    </code>
    options of the
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    and
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    statements. Examples:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa23658352"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'u1'</span>@<span class="token string">'localhost'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span>
  <span class="token keyword">FAILED_LOGIN_ATTEMPTS</span> <span class="token number">3</span> <span class="token keyword">PASSWORD_LOCK_TIME</span> <span class="token number">3</span><span class="token punctuation">;</span>

<span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'u2'</span>@<span class="token string">'localhost'</span>
  <span class="token keyword">FAILED_LOGIN_ATTEMPTS</span> <span class="token number">4</span> <span class="token keyword">PASSWORD_LOCK_TIME</span> <span class="token keyword">UNBOUNDED</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    When too many consecutive login failures occur, the client
        receives an error that looks like this:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-none"><div class="docs-select-all right" id="sa42755714"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">ERROR 3957 (HY000): Access denied for user <em class="replaceable">user</em>.
Account is blocked for <em class="replaceable">D</em> day(s) (<em class="replaceable">R</em> day(s) remaining)
due to <em class="replaceable">N</em> consecutive failed logins.</code></pre>
   </div>
   <p>
    Use the options as follows:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        FAILED_LOGIN_ATTEMPTS
        <em class="replaceable">
         <code>
          N
         </code>
        </em>
       </code>
      </p>
      <p>
       This option indicates whether to track account login
            attempts that specify an incorrect password. The number
       <em class="replaceable">
        <code>
         N
        </code>
       </em>
       specifies how many consecutive
            incorrect passwords cause temporary account locking.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PASSWORD_LOCK_TIME {
        <em class="replaceable">
         <code>
          N
         </code>
        </em>
        |
            UNBOUNDED}
       </code>
      </p>
      <p>
       This option indicates how long to lock the account after too
            many consecutive login attempts provide an incorrect
            password. The value is a number
       <em class="replaceable">
        <code>
         N
        </code>
       </em>
       to specify the number of days the account remains locked, or
       <code class="literal">
        UNBOUNDED
       </code>
       to specify that when an account
            enters the temporarily locked state, the duration of that
            state is unbounded and does not end until the account is
            unlocked. The conditions under which unlocking occurs are
            described later.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Permitted values of
    <em class="replaceable">
     <code>
      N
     </code>
    </em>
    for each option
        are in the range from 0 to 32767. A value of 0 disables the
        option.
   </p>
   <p>
    Failed-login tracking and temporary account locking have these
        characteristics:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       For failed-login tracking and temporary locking to occur for
            an account, its
       <code class="literal">
        FAILED_LOGIN_ATTEMPTS
       </code>
       and
       <code class="literal">
        PASSWORD_LOCK_TIME
       </code>
       options both must be
            nonzero.
      </p>
     </li>
     <li class="listitem">
      <p>
       For
       <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
        <code class="literal">
         CREATE USER
        </code>
       </a>
       , if
       <code class="literal">
        FAILED_LOGIN_ATTEMPTS
       </code>
       or
       <code class="literal">
        PASSWORD_LOCK_TIME
       </code>
       is not specified, its
            implicit default value is 0 for all accounts named by the
            statement. This means that failed-login tracking and
            temporary account locking are disabled.
      </p>
     </li>
     <li class="listitem">
      <p>
       For
       <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
        <code class="literal">
         ALTER USER
        </code>
       </a>
       , if
       <code class="literal">
        FAILED_LOGIN_ATTEMPTS
       </code>
       or
       <code class="literal">
        PASSWORD_LOCK_TIME
       </code>
       is not specified, its
            value remains unchanged for all accounts named by the
            statement.
      </p>
     </li>
     <li class="listitem">
      <p>
       For temporary account locking to occur, password failures
            must be consecutive. Any successful login that occurs prior
            to reaching the
       <code class="literal">
        FAILED_LOGIN_ATTEMPTS
       </code>
       value for failed logins causes failure counting to reset.
            For example, if
       <code class="literal">
        FAILED_LOGIN_ATTEMPTS
       </code>
       is
            4 and three consecutive password failures have occurred, one
            more failure is necessary for locking to begin. But if the
            next login succeeds, failed-login counting for the account
            is reset so that four consecutive failures are again
            required for locking.
      </p>
     </li>
     <li class="listitem">
      <p>
       Once temporary locking begins, successful login cannot occur
            even with the correct password until either the lock
            duration has passed or the account is unlocked by one of the
            account-reset methods listed in the following discussion.
      </p>
     </li>
    </ul>
   </div>
   <p>
    When the server reads the grant tables, it initializes state
        information for each account regarding whether failed-login
        tracking is enabled, whether the account is currently
        temporarily locked and when locking began if so, and the number
        of failures before temporary locking occurs if the account is
        not locked.
   </p>
   <p>
    An account's state information can be reset, which means that
        failed-login counting is reset, and the account is unlocked if
        currently temporarily locked. Account resets can be global for
        all accounts or per account:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       A global reset of all accounts occurs for any of these
            conditions:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          A server restart.
         </p>
        </li>
        <li class="listitem">
         <p>
          Execution of
          <a class="link" href="flush.html#flush-privileges">
           <code class="literal">
            FLUSH
                PRIVILEGES
           </code>
          </a>
          . (Starting the server with
          <a class="link" href="server-options.html#option_mysqld_skip-grant-tables">
           <code class="option">
            --skip-grant-tables
           </code>
          </a>
          causes the grant tables not to be read, which disables
                failed-login tracking. In this case, the first execution
                of
          <a class="link" href="flush.html#flush-privileges">
           <code class="literal">
            FLUSH PRIVILEGES
           </code>
          </a>
          causes the server to read the grant tables and enable
                failed-login tracking, in addition to resetting all
                accounts.)
         </p>
        </li>
       </ul>
      </div>
     </li>
     <li class="listitem">
      <p>
       A per-account reset occurs for any of these conditions:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          Successful login for the account.
         </p>
        </li>
        <li class="listitem">
         <p>
          The lock duration passes. In this case, failed-login
                counting resets at the time of the next login attempt.
         </p>
        </li>
        <li class="listitem">
         <p>
          Execution of an
          <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
           <code class="literal">
            ALTER
                USER
           </code>
          </a>
          statement for the account that sets
                either
          <code class="literal">
           FAILED_LOGIN_ATTEMPTS
          </code>
          or
          <code class="literal">
           PASSWORD_LOCK_TIME
          </code>
          (or both) to any
                value (including the current option value), or execution
                of an
          <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
           <code class="literal">
            ALTER
                USER ... UNLOCK
           </code>
          </a>
          statement for the account.
         </p>
         <p>
          Other
          <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
           <code class="literal">
            ALTER USER
           </code>
          </a>
          statements for the account have no effect on its current
                failed-login count or its locking state.
         </p>
        </li>
       </ul>
      </div>
     </li>
    </ul>
   </div>
   <p>
    Failed-login tracking is tied to the login account that is used
        to check credentials. If user proxying is in use, tracking
        occurs for the proxy user, not the proxied user. That is,
        tracking is tied to the account indicated by
    <a class="link" href="information-functions.html#function_user">
     <code class="literal">
      USER()
     </code>
    </a>
    , not the account indicated
        by
    <a class="link" href="information-functions.html#function_current-user">
     <code class="literal">
      CURRENT_USER()
     </code>
    </a>
    . For
        information about the distinction between proxy and proxied
        users, see
    <a class="xref" href="proxy-users.html" title="8.2.19 Proxy Users">
     Section 8.2.19, “Proxy Users”
    </a>
    .
   </p>
  </div>
 </div>
 <br/>
</div>
