Authentication Plugins After the server has been configured with the RSA key files, accounts that authenticate with the sha256_password  plugin have the option of using those key files to connect to the server. As mentioned previously, such accounts can use either a secure connection (in which case RSA is not used) or an unencrypted connection that performs password exchange using RSA. Suppose that an unencrypted connection is used. For example: For this connection attempt by  sha256user , the server determines that  sha256_password  is the appropriate authentication plugin and invokes it (because that was the plugin specified at  CREATE USER  time). The plugin finds that the connection is not encrypted and thus requires the password to be transmitted using RSA encryption. In this case, the plugin sends the RSA public key to the client, which uses it to encrypt the password and returns the result to the server. The plugin uses the RSA private key on the server side to decrypt the password and accepts or rejects the connection based on whether the password is correct. The server sends the RSA public key to the client as needed. However, if the client has a file containing a local copy of the RSA public key required by the server, it can specify the file using the  --server- public-key-path  option: The public key value in the file named by the  --server-public-key-path  option should be the same as the key value in the server-side file named by the  sha256_password_public_key_path  system variable. If the key file contains a valid public key value but the value is incorrect, an access-denied error occurs. If the key file does not contain a valid public key, the client program cannot use it. In this case, the  sha256_password  plugin sends the public key to the client as if no  --server-public-key-path option had been specified. Client users can obtain the RSA public key two ways: A client-side authentication plugin is available that enables clients to send passwords to the server as cleartext, without hashing or encryption. This plugin is built into the MySQL client library. The following table shows the plugin name. Many client-side authentication plugins perform hashing or encryption of a password before the client sends it to the server. This enables clients to avoid sending passwords as cleartext. Hashing or encryption cannot be done for authentication schemes that require the server to receive the password as entered on the client side. In such cases, the client-side  mysql_clear_password shell>  mysql --ssl-mode=DISABLED -u sha256user -p Enter password:  password shell>  mysql --ssl-mode=DISABLED -u sha256user -p --server-public-key-path= file_name Enter password:  password •The database administrator can provide a copy of the public key file. •A client user who can connect to the server some other way can use a  SHOW STATUS LIKE ’Rsa_public_key’  statement and save the returned key value in a file. Table 6.15 Plugin and Library Names for Cleartext Authentication 6.4.1.4 Client-Side Cleartext Pluggable Authentication Plugin or File Plugin or File Name Server-side plugin None, see discussion Client-side plugin mysql_clear_password Library file None (plugin is built in) 1316