Pluggable Authentication On the client side, a given client indicates whether it can handle sandbox mode for expired passwords. For clients that use the C client library, there are two ways to do this: •Pass the  MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS  flag to  mysql_options()  prior to connecting: bool arg = 1; mysql_options(mysql, MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS, &arg); This is the technique used within the  mysql  client, which enables MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS  if invoked interactively or with the  --connect- expired-password  option. •Pass the  CLIENT_CAN_HANDLE_EXPIRED_PASSWORDS  flag to  mysql_real_connect()  at connect time: MYSQL mysql; mysql_init(&mysql); if (!mysql_real_connect(&mysql, host, user, password, db, port, unix_socket, CLIENT_CAN_HANDLE_EXPIRED_PASSWORDS)) { ... handle error ... } Other MySQL Connectors have their own conventions for indicating readiness to handle sandbox mode. See the documentation for the Connector in which you are interested. On the server side, if a client indicates that it can handle expired passwords, the server puts it in sandbox mode. If a client does not indicate that it can handle expired passwords (or uses an older version of the client library that cannot so indicate), the server action depends on the value of the disconnect_on_expired_password  system variable: •If  disconnect_on_expired_password  is enabled (the default), the server disconnects the client with an  ER_MUST_CHANGE_PASSWORD_LOGIN  error. •If  disconnect_on_expired_password  is disabled, the server puts the client in sandbox mode. 6.2.17 Pluggable Authentication When a client connects to the MySQL server, the server uses the user name provided by the client and the client host to select the appropriate account row from the  mysql.user  system table. The server then authenticates the client, determining from the account row which authentication plugin applies to the client: •If the server cannot find the plugin, an error occurs and the connection attempt is rejected. •Otherwise, the server invokes that plugin to authenticate the user, and the plugin returns a status to the server indicating whether the user provided the correct password and is permitted to connect. Pluggable authentication enables these important capabilities: • Choice of authentication methods.   Pluggable authentication makes it easy for DBAs to choose and change the authentication method used for individual MySQL accounts. • External authentication.   Pluggable authentication makes it possible for clients to connect to the MySQL server with credentials appropriate for authentication methods that store credentials 1258