Pluggable Authentication •A plugin that prevents all client connections to any account that uses it. Use cases for this plugin include proxied accounts that should never permit direct login but are accessed only through proxy accounts and accounts that must be able to execute stored programs and views with elevated privileges without exposing those privileges to ordinary users. See Section 6.4.1.8, “No-Login Pluggable Authentication” . •A plugin that authenticates clients that connect from the local host through the Unix socket file. See Section 6.4.1.9, “Socket Peer-Credential Pluggable Authentication” . •A test plugin that checks account credentials and logs success or failure to the server error log. This plugin is intended for testing and development purposes, and as an example of how to write an authentication plugin. See Section 6.4.1.10, “Test Pluggable Authentication” . •If necessary, install the plugin library or libraries containing the appropriate plugins. On the server host, install the library containing the server-side plugin, so that the server can use it to authenticate client connections. Similarly, on each client host, install the library containing the client-side plugin for use by client programs. Authentication plugins that are built in need not be installed. •For each MySQL account that you create, specify the appropriate server-side plugin to use for authentication. If the account is to use the default authentication plugin, the account-creation statement need not specify the plugin explicitly. The  default_authentication_plugin  system variable configures the default authentication plugin. •When a client connects, the server-side plugin tells the client program which client-side plugin to use for authentication. 1260 Note Authentication Plugin Usage For information about current restrictions on the use of pluggable authentication, including which connectors support which plugins, see Restrictions on Pluggable Authentication. Third-party connector developers should read that section to determine the extent to which a connector can take advantage of pluggable authentication capabilities and what steps to take to become more compliant. If you are interested in writing your own authentication plugins, see Writing Authentication Plugins. This section provides general instructions for installing and using authentication plugins. For instructions specific to a given plugin, see the section that describes that plugin under Section 6.4.1, “Authentication Plugins” . In general, pluggable authentication uses a pair of corresponding plugins on the server and client sides, so you use a given authentication method like this: In the case that an account uses an authentication method that is the default for both the server and the client program, the server need not communicate to the client which client-side plugin to use, and a round trip in client/server negotiation can be avoided. For standard MySQL clients such as  mysql  and  mysqladmin , the  --default-auth= plugin_name option can be specified on the command line as a hint about which client-side plugin the program can expect to use, although the server overrides this if the server-side plugin associated with the user account requires a different client-side plugin. If the client program does not find the client-side plugin library file, specify a  --plugin-dir= dir_name option to indicate the plugin library directory location.