Pluggable Authentication •When a 5.7 client tries to connect to an 8.0 server, the server specifies  caching_sha2_password as its default authentication plugin, but the client still sends credential details per either mysql_native_password  or whatever is specified through  MYSQL_DEFAULT_AUTH . •The only time the client loads the plugin specified by the server is for a change-plugin request, but in that case it can be any plugin depending on the user account. In this case, the client must try to load the plugin, and if that plugin is not available, an error is not optional. The first part of this section describes general restrictions on the applicability of the pluggable authentication framework described at Section 6.2.17, “Pluggable Authentication” . The second part describes how third-party connector developers can determine the extent to which a connector can take advantage of pluggable authentication capabilities and what steps to take to become more compliant. The term “native authentication”  used here refers to authentication against passwords stored in the mysql.user  system table. This is the same authentication method provided by older MySQL servers, before pluggable authentication was implemented. “Windows native authentication”  refers to authentication using the credentials of a user who has already logged in to Windows, as implemented by the Windows Native Authentication plugin (“Windows plugin”  for short). Exception: A connector supports pluggable authentication if it was built to link to  libmysqlclient dynamically (rather than statically) and it loads the current version of  libmysqlclient  if that version is installed, or if the connector is recompiled from source to link against the current  libmysqlclient . For information about writing connectors to handle informatin from the server about the default server- side authentication plugin, see Authentication Plugin Connector-Writing Considerations. •General Pluggable Authentication Restrictions •Pluggable Authentication and Third-Party Connectors • Connector/C++:  Clients that use this connector can connect to the server only through accounts that use native authentication. • Connector/NET:  Clients that use Connector/NET can connect to the server through accounts that use native authentication or Windows native authentication. • Connector/PHP:  Clients that use this connector can connect to the server only through accounts that use native authentication, when compiled using the MySQL native driver for PHP ( mysqlnd ). • Windows native authentication:  Connecting through an account that uses the Windows plugin requires Windows Domain setup. Without it, NTLM authentication is used and then only local connections are possible; that is, the client and server must run on the same computer. • Proxy users:  Proxy user support is available to the extent that clients can connect through accounts authenticated with plugins that implement proxy user capability (that is, plugins that can return a user name different from that of the connecting user). For example, the PAM and Windows plugins support proxy users. The  mysql_native_password  and  sha256_password  authentication plugins do not support proxy users by default, but can be configured to do so; see Server Support for Proxy User Mapping. • Replication : Replicas can not only employ replication user accounts using native authentication, but can also connect through replication user accounts that use nonnative authentication if the required client- 1262 Restrictions on Pluggable Authentication General Pluggable Authentication Restrictions