Authentication Plugins •Installing SHA-2 Pluggable Authentication •Using SHA-2 Pluggable Authentication •Cache Operation for SHA-2 Pluggable Authentication For general information about pluggable authentication in MySQL, see Section 6.2.17, “Pluggable Authentication” . The  caching_sha2_password  plugin exists in server and client forms: The server-side plugin uses the  sha2_cache_cleaner  audit plugin as a helper to perform password cache management.  sha2_cache_cleaner , like  caching_sha2_password , is built in and need not be installed. To set up an account that uses the  caching_sha2_password  plugin for SHA-256 password hashing, use the following statement, where  password  is the desired account password: The server assigns the  caching_sha2_password  plugin to the account and uses it to encrypt the password using SHA-256, storing those values in the  plugin  and  authentication_string  columns of the  mysql.user  system table. The preceding instructions do not assume that  caching_sha2_password  is the default authentication plugin. If  caching_sha2_password  is the default authentication plugin, a simpler  CREATE USER  syntax can be used. To start the server with the default authentication plugin set to  caching_sha2_password , put these lines in the server option file: That causes the  caching_sha2_password  plugin to be used by default for new accounts. As a result, it is possible to create the account and set its password without naming the plugin explicitly: Another consequence of setting  default_authentication_plugin  to  caching_sha2_password  is that, to use some other plugin for account creation, you must specify that plugin explicitly. For example, to use the  mysql_native_password  plugin, use this statement: caching_sha2_password  supports connections over secure transport. If you follow the RSA configuration procedure given later in this section, it also supports encrypted password exchange using RSA over unencrypted connections. RSA support has these characteristics: CREATE USER ’nativeuser’@’localhost’ IDENTIFIED WITH mysql_native_password BY ’ password ’; CREATE USER ’sha2user’@’localhost’ IDENTIFIED BY ’ password ’; [mysqld] default_authentication_plugin=caching_sha2_password 1308 Using SHA-2 Pluggable Authentication CREATE USER ’sha2user’@’localhost’ IDENTIFIED WITH caching_sha2_password BY ’ password ’; Installing SHA-2 Pluggable Authentication •The server-side plugin is built into the server, need not be loaded explicitly, and cannot be disabled by unloading it. •The client-side plugin is built into the  libmysqlclient  client library and is available to any program linked against  libmysqlclient .