一个执行本地身份验证的插件；也就是说，基于在引入可插拔身份验证之前使用的密码散列方法的身份验证。mysql_native_password 插件基于这种本地密码散列方法实现身份验证。请参见 第 8.4.1.1 节，“本地可插拔身份验证”。A plugin that performs native authentication; that is, authentication based on the password hashing method in use from before the introduction of pluggable authentication in MySQL. The mysql_native_password plugin implements authentication based on this native password hashing method. See Section 8.4.1.1, “Native Pluggable Authentication”.

使用 SHA-256 密码哈希进行身份验证的插件。这比本地身份验证可用的加密更强。请参阅 8.4.1.2 节，“缓存 SHA-2 可插拔身份验证”，以及 8.4.1.3 节，“SHA-256 可插拔身份验证”。Plugins that perform authentication using SHA-256 password hashing. This is stronger encryption than that available with native authentication. See Section 8.4.1.2, “Caching SHA-2 Pluggable Authentication”, and Section 8.4.1.3, “SHA-256 Pluggable Authentication”.

一个客户端插件，将密码发送到服务器时不进行哈希或加密。此插件与需要按客户端用户提供的原始密码访问的服务器端插件一起使用。请参阅 8.4.1.4 节，“客户端明文可插拔身份验证”。A client-side plugin that sends the password to the server without hashing or encryption. This plugin is used in conjunction with server-side plugins that require access to the password exactly as provided by the client user. See Section 8.4.1.4, “Client-Side Cleartext Pluggable Authentication”.

一个使用 PAM（可插入认证模块）执行外部认证的插件，使 MySQL 服务器能够使用 PAM 来认证 MySQL 用户。该插件也支持代理用户。参见 第 8.4.1.5 节，“PAM 可插入认证”。A plugin that performs external authentication using PAM (Pluggable Authentication Modules), enabling MySQL Server to use PAM to authenticate MySQL users. This plugin supports proxy users as well. See Section 8.4.1.5, “PAM Pluggable Authentication”.

一个在 Windows 上执行外部认证的插件，使 MySQL 服务器能够使用本地 Windows 服务来认证客户端连接。已登录 Windows 的用户可以根据其环境中的信息从 MySQL 客户端程序连接到服务器，而无需指定额外的密码。该插件也支持代理用户。参见 第 8.4.1.6 节，“Windows 可插入认证”。A plugin that performs external authentication on Windows, enabling MySQL Server to use native Windows services to authenticate client connections. Users who have logged in to Windows can connect from MySQL client programs to the server based on the information in their environment without specifying an additional password. This plugin supports proxy users as well. See Section 8.4.1.6, “Windows Pluggable Authentication”.

通过 LDAP（轻量目录访问协议）执行身份验证的插件，通过访问 X.500 等目录服务来验证 MySQL 用户。这些插件也支持代理用户。参见 第 8.4.1.7 节，“LDAP 可插拔身份验证”。Plugins that perform authentication using LDAP (Lightweight Directory Access Protocol) to authenticate MySQL users by accessing directory services such as X.500. These plugins support proxy users as well. See Section 8.4.1.7, “LDAP Pluggable Authentication”.

通过 Kerberos 执行身份验证的插件，用于验证与 Kerberos 主体对应的 MySQL 用户。参见 第 8.4.1.8 节，“Kerberos 可插拔身份验证”。A plugin that performs authentication using Kerberos to authenticate MySQL users that correspond to Kerberos principals. See Section 8.4.1.8, “Kerberos Pluggable Authentication”.

一个插件，它阻止所有客户端连接到使用它的任何账户。该插件的使用场景包括那些永远不允许直接登录但只能通过代理账户访问的代理账户，以及必须能够以提升权限执行存储程序和视图但不向普通用户暴露这些权限的账户。请参阅 第 8.4.1.9 节，“无登录可插拔认证”。A plugin that prevents all client connections to any account that uses it. Use cases for this plugin include proxied accounts that should never permit direct login but are accessed only through proxy accounts and accounts that must be able to execute stored programs and views with elevated privileges without exposing those privileges to ordinary users. See Section 8.4.1.9, “No-Login Pluggable Authentication”.

一个插件，它验证通过 Unix 套接字文件从本地主机连接的客户端。请参阅 第 8.4.1.10 节，“套接字对等凭证可插拔认证”。A plugin that authenticates clients that connect from the local host through the Unix socket file. See Section 8.4.1.10, “Socket Peer-Credential Pluggable Authentication”.

一个使用 FIDO/FIDO2 设备按 WebAuthn 格式对用户进行 MySQL 服务器认证的插件。请参见 第 8.4.1.11 节，“WebAuthn 可插拔认证”。A plugin that authenticates users to MySQL Server using WebAuthn format with a FIDO/FIDO2 device. See Section 8.4.1.11, “WebAuthn Pluggable Authentication”.

一个测试插件，用于检查账户凭证并将成功或失败记录到服务器错误日志中。该插件用于测试和开发目的，并作为编写认证插件的示例。请参见 第 8.4.1.12 节，“测试可插拔认证”。A test plugin that checks account credentials and logs success or failure to the server error log. This plugin is intended for testing and development purposes, and as an example of how to write an authentication plugin. See Section 8.4.1.12, “Test Pluggable Authentication”.

因素 1：如果 authentication_policy 的第 1 个元素指定了一个身份验证插件，则该插件为默认插件。如果 authentication_policy 的第 1 个元素为 *，则 caching_sha2_password 为默认插件。Factor 1: If authentication_policy element 1 names an authentication plugin, that plugin is the default. If authentication_policy element 1 is *, caching_sha2_password is the default.

根据上述规则，以下语句创建了一个双因素身份验证账户，其第一个因素的身份验证方法由 authentication_policy 决定，如下所示：Given the rules above, the following statement creates a two-factor authentication account, with the first factor authentication method determined by authentication_policy, as shown here:

CREATE USER 'wei'@'localhost' IDENTIFIED BY 'password'
  AND IDENTIFIED WITH authentication_ldap_simple;

以同样的方式，此示例创建了一个三因素认证账户：In the same way, this example creates a three-factor authentication account:

CREATE USER 'mateo'@'localhost' IDENTIFIED BY 'password'
  AND IDENTIFIED WITH authentication_ldap_simple
  AND IDENTIFIED WITH authentication_fido;

您可以使用 SHOW CREATE USER 来查看应用的身份验证方法。You can use SHOW CREATE USER to view the applied authentication methods.

因素 2 或 3：如果相应的 authentication_policy 元素指定了一个身份验证插件，则该插件为默认插件。如果 authentication_policy 元素为 * 或为空，则没有默认值；在没有指定插件的情况下尝试为该因素定义帐户身份验证方法将导致错误，如以下示例所示：Factor 2 or 3: If the corresponding authentication_policy element names an authentication plugin, that plugin is the default. If the authentication_policy element is * or empty, there is no default; attempting to define an account authentication method for the factor without naming a plugin is an error, as in the following examples:

mysql> CREATE USER 'sofia'@'localhost' IDENTIFIED WITH authentication_ldap_simple 
       AND IDENTIFIED BY 'abc';
ERROR 1524 (HY000): Plugin '' is not loaded

mysql> CREATE USER 'sofia'@'localhost' IDENTIFIED WITH authentication_ldap_simple 
       AND IDENTIFIED BY 'abc';
ERROR 1524 (HY000): Plugin '*' is not loaded

如果需要，安装包含适当插件的插件库。在服务器主机上，安装包含服务器端插件的库，以便服务器可以使用它来验证客户端连接。同样，在每个客户端主机上，安装包含客户端插件的库以供客户端程序使用。内置的认证插件无需安装。If necessary, install the plugin library or libraries containing the appropriate plugins. On the server host, install the library containing the server-side plugin, so that the server can use it to authenticate client connections. Similarly, on each client host, install the library containing the client-side plugin for use by client programs. Authentication plugins that are built in need not be installed.

对于您创建的每个 MySQL 帐户，请指定用于身份验证的适当服务器端插件。如果该帐户使用默认身份验证插件，则创建帐户的语句无需显式指定插件。服务器会分配默认的身份验证插件，如默认身份验证插件中所述。For each MySQL account that you create, specify the appropriate server-side plugin to use for authentication. If the account is to use the default authentication plugin, the account-creation statement need not specify the plugin explicitly. The server assigns the default authentication plugin, determined as described in The Default Authentication Plugin.

当客户端连接时，服务器端插件会告诉客户端程序应使用哪个客户端插件进行身份验证。When a client connects, the server-side plugin tells the client program which client-side plugin to use for authentication.

使用 MySQL 5.7 客户端（版本 5.7.22 或更低）连接到使用 caching_sha2_password 进行认证的 MySQL 8.4 服务器账户。这会失败，因为 5.7 客户端不识别该插件。（在 MySQL 5.7.23 中，这个问题得到了处理，当时在 MySQL 客户端库和客户端程序中添加了对 caching_sha2_password 的客户端支持。）Connect using a MySQL 5.7 client from 5.7.22 or lower to a MySQL 8.4 server account that authenticates with caching_sha2_password. This fails because the 5.7 client does not recognize the plugin. (This issue is addressed in MySQL 5.7 as of 5.7.23, when caching_sha2_password client-side support was added to the MySQL client library and client programs.)

使用 MySQL 5.7 客户端连接到使用 mysql_old_password 进行认证的 5.7 之前的服务器账户。这会因为多种原因失败。首先，这种连接需要 --secure-auth=0，而该选项已不再受支持。即使该选项仍被支持，5.7 客户端也不识别该插件，因为它在 MySQL 5.7 中已被移除。Connect using a MySQL 5.7 client to a pre-5.7 server account that authenticates with mysql_old_password. This fails for multiple reasons. First, such a connection requires --secure-auth=0, which is no longer a supported option. Even were it supported, the 5.7 client does not recognize the plugin because it was removed in MySQL 5.7.

使用来自社区版的 MySQL 5.7 客户端连接到使用企业版专有 LDAP 认证插件进行认证的 MySQL 5.7 企业版服务器账户。这会失败，因为社区版客户端无法访问企业版插件。Connect using a MySQL 5.7 client from a Community distribution to a MySQL 5.7 Enterprise server account that authenticates using one of the Enterprise-only LDAP authentication plugins. This fails because the Community client does not have access to the Enterprise plugin.

在 MySQL 5.7 中，libmysqlclient 默认使用 mysql_native_password 或通过 MYSQL_DEFAULT_AUTH 选项在 mysql_options() 中指定的插件。In MySQL 5.7, libmysqlclient uses as its default choice either mysql_native_password or the plugin specified through the MYSQL_DEFAULT_AUTH option for mysql_options().

当 5.7 客户端尝试连接到 8.4 服务器时，服务器将 caching_sha2_password 指定为默认认证插件，但客户端仍然会根据 mysql_native_password 或通过 MYSQL_DEFAULT_AUTH 指定的内容发送凭证信息。When a 5.7 client tries to connect to an 8.4 server, the server specifies caching_sha2_password as its default authentication plugin, but the client still sends credential details per either mysql_native_password or whatever is specified through MYSQL_DEFAULT_AUTH.

客户端唯一加载服务器指定的插件的情况是在换插件请求时，但在这种情况下，插件可以是任何插件，取决于用户账户。在这种情况下，客户端必须尝试加载该插件，如果该插件不可用，则错误不可避免。The only time the client loads the plugin specified by the server is for a change-plugin request, but in that case it can be any plugin depending on the user account. In this case, the client must try to load the plugin, and if that plugin is not available, an error is not optional.

通用可插拔认证限制General Pluggable Authentication Restrictions

可插入式认证和第三方连接器Pluggable Authentication and Third-Party Connectors

Connector/C : 使用此连接器的客户端只能通过使用本地认证的账户连接到服务器。Connector/C++: Clients that use this connector can connect to the server only through accounts that use native authentication.

例外情况：如果连接器被构建为动态链接到 libmysqlclient（而非静态链接），并且如果安装了该版本，它会加载当前版本的 libmysqlclient，或者如果连接器从源代码重新编译以链接到当前的 libmysqlclient，则该连接器支持可插入式认证。Exception: A connector supports pluggable authentication if it was built to link to libmysqlclient dynamically (rather than statically) and it loads the current version of libmysqlclient if that version is installed, or if the connector is recompiled from source to link against the current libmysqlclient.

有关编写连接器以处理来自服务器的默认服务器端身份验证插件信息的详细信息，请参阅 身份验证插件连接器编写考虑事项。For information about writing connectors to handle information from the server about the default server-side authentication plugin, see Authentication Plugin Connector-Writing Considerations.

Connector/NET： 使用 Connector/NET 的客户端可以通过使用本地身份验证或 Windows 本地身份验证的帐户连接到服务器。Connector/NET: Clients that use Connector/NET can connect to the server through accounts that use native authentication or Windows native authentication.

Connector/PHP： 使用此连接器的客户端仅能通过使用本地身份验证的帐户连接到服务器，当使用 PHP 的 MySQL 本地驱动程序（mysqlnd）编译时。Connector/PHP: Clients that use this connector can connect to the server only through accounts that use native authentication, when compiled using the MySQL native driver for PHP (mysqlnd).

Windows 本地认证： 通过使用 Windows 插件的账户连接需要进行 Windows 域设置。如果没有设置，则使用 NTLM 认证，并且只能进行本地连接；也就是说，客户端和服务器必须运行在同一台计算机上。Windows native authentication: Connecting through an account that uses the Windows plugin requires Windows Domain setup. Without it, NTLM authentication is used and then only local connections are possible; that is, the client and server must run on the same computer.

代理用户： 代理用户支持在客户端能够通过使用实现代理用户功能的插件进行身份验证的账户连接时提供（即，能够返回与连接用户不同的用户名的插件）。例如，PAM 和 Windows 插件支持代理用户。mysql_native_password（已弃用）和 sha256_password（已弃用）身份验证插件默认不支持代理用户，但可以配置为支持；参见 代理用户映射服务器支持。Proxy users: Proxy user support is available to the extent that clients can connect through accounts authenticated with plugins that implement proxy user capability (that is, plugins that can return a user name different from that of the connecting user). For example, the PAM and Windows plugins support proxy users. The mysql_native_password (deprecated) and sha256_password (deprecated) authentication plugins do not support proxy users by default, but can be configured to do so; see Server Support for Proxy User Mapping.

复制：副本不仅可以使用本地认证的复制用户账户进行复制，还可以在具备所需客户端插件的情况下，通过使用非本地认证的复制用户账户进行连接。如果插件已内置于libmysqlclient中，则默认可用。否则，插件必须安装在副本端，安装目录为副本的plugin_dir系统变量指定的目录。Replication: Replicas can not only employ replication user accounts using native authentication, but can also connect through replication user accounts that use nonnative authentication if the required client-side plugin is available. If the plugin is built into libmysqlclient, it is available by default. Otherwise, the plugin must be installed on the replica side in the directory named by the replica's plugin_dir system variable.

FEDERATED 表： FEDERATED 表只能通过远程服务器上使用本地认证的账户访问远程表。FEDERATED tables: A FEDERATED table can access the remote table only through accounts on the remote server that use native authentication.

一个未经过任何修改的现有连接器使用本地认证，并且使用该连接器的客户端只能通过使用本地认证的账户连接到服务器。但是，你应该针对服务器的最新版本测试该连接器，以验证这种连接仍然能够正常工作。An existing connector to which no changes have been made uses native authentication and clients that use the connector can connect to the server only through accounts that use native authentication. However, you should test the connector against a recent version of the server to verify that such connections still work without problem.

例外情况：如果连接器动态（而非静态）链接到libmysqlclient，并且在安装了该版本时加载当前版本的libmysqlclient，那么它可能在不做任何修改的情况下可以与可插拔认证一起工作。Exception: A connector might work with pluggable authentication without any changes if it links to libmysqlclient dynamically (rather than statically) and it loads the current version of libmysqlclient if that version is installed.

为了利用可插拔身份验证功能，基于libmysqlclient的连接器应重新链接到当前版本的libmysqlclient。这使连接器能够支持通过需要客户端插件的帐户连接，这些插件现在内置于libmysqlclient中（例如 PAM 身份验证所需的明文插件和 Windows 本机身份验证所需的 Windows 插件）。与当前libmysqlclient链接还使连接器能够访问安装在默认 MySQL 插件目录中的客户端插件（通常为本地服务器的plugin_dir系统变量默认值所指定的目录）。To take advantage of pluggable authentication capabilities, a connector that is libmysqlclient-based should be relinked against the current version of libmysqlclient. This enables the connector to support connections though accounts that require client-side plugins now built into libmysqlclient (such as the cleartext plugin needed for PAM authentication and the Windows plugin needed for Windows native authentication). Linking with a current libmysqlclient also enables the connector to access client-side plugins installed in the default MySQL plugin directory (typically the directory named by the default value of the local server's plugin_dir system variable).

如果连接器动态地链接到libmysqlclient，必须确保在客户端主机上安装了更新版本的libmysqlclient，并且连接器在运行时加载它。If a connector links to libmysqlclient dynamically, it must be ensured that the newer version of libmysqlclient is installed on the client host and that the connector loads it at runtime.

连接器支持给定身份验证方法的另一种方式是在客户端/服务器协议中直接实现它。Connector/NET 使用这种方法来提供对 Windows 本地身份验证的支持。Another way for a connector to support a given authentication method is to implement it directly in the client/server protocol. Connector/NET uses this approach to provide support for Windows native authentication.

如果一个连接器能够从不同于默认插件目录的目录加载客户端插件，它必须实现某种方式让客户端用户指定该目录。这种方式的可能性包括命令行选项或环境变量，通过它连接器可以获取目录名称。标准的 MySQL 客户端程序，例如 mysql 和 mysqladmin 实现了一个 --plugin-dir 选项。另请参见 C API 客户端插件接口。If a connector should be able to load client-side plugins from a directory different from the default plugin directory, it must implement some means for client users to specify the directory. Possibilities for this include a command-line option or environment variable from which the connector can obtain the directory name. Standard MySQL client programs such as mysql and mysqladmin implement a --plugin-dir option. See also C API Client Plugin Interface.

如本节前面所述，连接器对代理用户的支持取决于其支持的身份验证方法是否允许代理用户。Proxy user support by a connector depends, as described earlier in this section, on whether the authentication methods that it supports permit proxy users.