身份验证因素通常包括以下类型的信息：Authentication factors commonly include these types of information:

该“你知道的事情”因子类型依赖于在身份验证过程双方保密的信息。不幸的是，秘密可能会被泄露：有人可能会看到你输入密码，或者通过钓鱼攻击欺骗你，服务器端存储的密码可能因安全漏洞而暴露，等等。通过使用多个密码可以提高安全性，但每个密码仍可能被泄露。使用其他因子类型可以在降低泄露风险的情况下提高安全性。The “something you know” factor type relies on information that is kept secret on both sides of the authentication process. Unfortunately, secrets may be subject to compromise: Someone might see you enter your password or fool you with a phishing attack, a password stored on the server side might be exposed by a security breach, and so forth. Security can be improved by using multiple passwords, but each may still be subject to compromise. Use of the other factor types enables improved security with less risk of compromise.

在 MySQL 中实施多因素认证包括以下几个要素：Implementation of multifactor authentication in MySQL comprises these elements:

authentication_policy 系统变量定义了多因素认证策略。具体来说，它定义了账户可以拥有（或需要拥有）的认证因素数量，以及每个因素可以使用的认证方法。The authentication_policy system variable defines the multifactor authentication policy. Specifically, it defines how many authentication factors accounts may have (or are required to have) and the authentication methods that can be used for each factor.

authentication_policy 的值是由 1、2 或 3 个逗号分隔的元素组成的列表。列表中的每个元素对应一个身份验证因素，可以是身份验证插件名称、星号（*）、空的或缺失的。（例外：元素 1 不能是空的或缺失的。）整个列表用单引号括起来。例如，以下 authentication_policy 值包括一个星号、一个身份验证插件名称以及一个空元素：The value of authentication_policy is a list of 1, 2, or 3 comma-separated elements. Each element in the list corresponds to an authentication factor and can be an authentication plugin name, an asterisk (*), empty, or missing. (Exception: Element 1 cannot be empty or missing.) The entire list is enclosed in single quotes. For example, the following authentication_policy value includes an asterisk, an authentication plugin name, and an empty element:

authentication_policy = '*,authentication_webauthn,'

星号（*）表示需要认证方法，但允许使用任何方法。空元素表示认证方法是可选的，且允许使用任何方法。缺失元素（没有星号、空元素或认证插件名称）表示不允许使用认证方法。当指定插件名称时，在创建或修改账户时，相应因素必须使用该认证方法。An asterisk (*) indicates that an authentication method is required but any method is permitted. An empty element indicates that an authentication method is optional and any method is permitted. A missing element (no asterisk, empty element, or authentication plugin name) indicates that an authentication method is not permitted. When a plugin name is specified, that authentication method is required for the respective factor when creating or modifying an account.

默认的 authentication_policy 值是 '*,,'（一个星号和两个空元素），这要求一个第一因素，并可选择地允许第二和第三因素。因此，默认的 authentication_policy 值与现有的 1FA 账户向后兼容，同时也允许创建或修改账户以使用 2FA 或 3FA。The default authentication_policy value is '*,,' (an asterisk and two empty elements), which requires a first factor, and optionally permits second and third factors. The default authentication_policy value is thus backward compatible with existing 1FA accounts, but also permits creation or modification of accounts to use 2FA or 3FA.

具有 AUTHENTICATION_POLICY_ADMIN 权限的用户不受 authentication_policy 设置施加的限制。（对于原本不允许的语句，将显示警告。）A user who has the AUTHENTICATION_POLICY_ADMIN privilege is not subject to the constraints imposed by the authentication_policy setting. (A warning occurs for statements that otherwise would not be permitted.)

authentication_policy 的值可以在选项文件中定义，或者使用 SET GLOBAL 语句指定：authentication_policy values can be defined in an option file or specified using a SET GLOBAL statement:

SET GLOBAL authentication_policy='*,*,';

有几条规则用来规范 authentication_policy 值的定义方式。有关这些规则的完整说明，请参阅 authentication_policy 系统变量描述。下表提供了一些 authentication_policy 示例值以及每个值所建立的策略。There are several rules that govern how the authentication_policy value can be defined. Refer to the authentication_policy system variable description for a compete account of those rules. The following table provides several authentication_policy example values and the policy established by each.

默认情况下，MySQL 使用多因素认证策略，该策略允许第一因素使用任何认证插件，并可选择性地允许第二和第三认证因素。此策略是可配置的；有关详细信息，请参见 配置多因素认证策略。By default, MySQL uses a multifactor authentication policy that permits any authentication plugin for the first factor, and optionally permits second and third authentication factors. This policy is configurable; for details, see Configuring the Multifactor Authentication Policy.

假设您希望一个账户首先使用 caching_sha2_password 插件进行身份验证，然后使用 authentication_ldap_sasl SASL LDAP 插件进行身份验证。（这假设 LDAP 身份验证已经按照 第 8.4.1.7 节，“LDAP 可插拔认证” 中的描述设置完毕，并且该用户在 LDAP 目录中有与示例中显示的身份验证字符串相对应的条目。）使用如下语句创建账户：Suppose that you want an account to authenticate first using the caching_sha2_password plugin, then using the authentication_ldap_sasl SASL LDAP plugin. (This assumes that LDAP authentication is already set up as described in Section 8.4.1.7, “LDAP Pluggable Authentication”, and that the user has an entry in the LDAP directory corresponding to the authentication string shown in the example.) Create the account using a statement like this:

CREATE USER 'alice'@'localhost'
  IDENTIFIED WITH caching_sha2_password
    BY 'sha2_password'
  AND IDENTIFIED WITH authentication_ldap_sasl
    AS 'uid=u1_ldap,ou=People,dc=example,dc=com';

要连接，用户必须提供两个密码。为了使用需要多个密码的账户进行 MySQL 服务器认证，客户端程序提供了 --password1、--password2 和 --password3 选项，允许最多指定三个密码。这些选项类似于 --password 选项，可以在命令行中跟随选项提供密码值（不安全），或者如果没有提供密码值，则会提示用户输入密码。对于刚创建的账户，因素 1 和 2 需要密码，因此使用 mysql 客户端，并加上 --password1 和 --password2 选项。mysql 会依次提示输入每个密码：To connect, the user must supply two passwords. To enable authentication to the MySQL server using accounts that require multiple passwords, client programs have --password1, --password2, and --password3 options that permit up to three passwords to be specified. These options are similar to the --password option in that they can take a password value following the option on the command line (which is insecure) or if given without a password value cause the user to be prompted for one. For the account just created, factors 1 and 2 take passwords, so invoke the mysql client with the --password1 and --password2 options. mysql prompts for each password in turn:

$> mysql --user=alice --password1 --password2
Enter password: (enter factor 1 password)
Enter password: (enter factor 2 password)

假设您想添加第三个身份验证因素。这可以通过删除并重新创建带有第三个因素的用户来实现，或者通过使用 ALTER USER user ADD factor 语法来实现。以下展示了两种方法：Suppose you want to add a third authentication factor. This can be achieved by dropping and recreating the user with a third factor or by using ALTER USER user ADD factor syntax. Both methods are shown below:

DROP USER 'alice'@'localhost';
  
CREATE USER 'alice'@'localhost'
  IDENTIFIED WITH caching_sha2_password
    BY 'sha2_password'
  AND IDENTIFIED WITH authentication_ldap_sasl
    AS 'uid=u1_ldap,ou=People,dc=example,dc=com'
  AND IDENTIFIED WITH authentication_webauthn;

ADD factor 语法包括因素编号和 FACTOR 关键字：ADD factor syntax includes the factor number and FACTOR keyword:

ALTER USER 'alice'@'localhost' ADD 3 FACTOR IDENTIFIED WITH authentication_webauthn;

ALTER USER user DROP factor 语法允许删除一个因子。下面的例子删除了在前一个例子中添加的第三个因子（authentication_webauthn）：ALTER USER user DROP factor syntax permits dropping a factor. The following example drops the third factor (authentication_webauthn) that was added in the previous example:

ALTER USER 'alice'@'localhost' DROP 3 FACTOR;

ALTER USER user MODIFY factor 语法允许更改特定因子的插件或认证字符串，前提是该因子存在。下面的例子修改了第二个因子，将认证方法从 authentication_ldap_sasl 改为 authetication_webauthn：ALTER USER user MODIFY factor syntax permits changing the plugin or authentication string for a particular factor, provided that the factor exists. The following example modifies the second factor, changing the authentication method from authentication_ldap_sasl to authetication_webauthn:

ALTER USER 'alice'@'localhost' MODIFY 2 FACTOR IDENTIFIED WITH authentication_webauthn;

使用 SHOW CREATE USER 查看为某个帐户定义的认证方法：Use SHOW CREATE USER to view the authentication methods defined for an account:

SHOW CREATE USER 'u1'@'localhost'\G
*************************** 1. row ***************************
CREATE USER for u1@localhost: CREATE USER `u1`@`localhost` 
IDENTIFIED WITH 'caching_sha2_password' AS 'sha2_password' 
AND IDENTIFIED WITH 'authentication_authn' REQUIRE NONE 
PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY 
DEFAULT PASSWORD REUSE INTERVAL DEFAULT PASSWORD REQUIRE 
CURRENT DEFAULT