validate_password component serves to test
passwords and improve security. This component exposes system
variables that enable you to define password policy, and status
variables for component monitoring.
In MySQL 8.0.4, the
was reimplemented as the
component. The following instructions describe how to use the
component, not the plugin. For instructions on using the plugin,
see The Password Validation Plugin in
MySQL 5.7 Reference Manual.
The plugin form of
validate_password is still
available but is deprecated and will be removed in a future
version of MySQL. MySQL installations that use the plugin should
make the transition to using the component instead. See
Section 7.3.3, “Transitioning to the Password Validation Component”.
validate_password component implements
In SQL statements that assign a password supplied as a cleartext value, the component checks the password against the current password policy and rejects the password if it is weak (the statement returns an
ER_NOT_VALID_PASSWORDerror). This applies to the
VALIDATE_PASSWORD_STRENGTH()SQL function assesses the strength of potential passwords. The function takes a password argument and returns an integer from 0 (weak) to 100 (strong).
validate_password checks the
cleartext password in the following statement. Under the default
password policy, which requires passwords to be at least 8
characters long, the password is weak and the statement produces
mysql> ALTER USER USER() IDENTIFIED BY 'abc'; ERROR 1819 (HY000): Your password does not satisfy the current policy requirements
Passwords specified as hashed values are not checked because the original password value is not available for checking:
mysql> ALTER USER 'jeffrey'@'localhost' IDENTIFIED WITH mysql_native_password AS '*0D3CED9BEC10A777AEC23CCC353A8C08A633045E'; Query OK, 0 rows affected (0.01 sec)
To configure password checking, modify the system variables having
names of the form
these are the parameters that control password policy. See
Section 7.3.2, “Password Validation Options and Variables”.
validate_password is not installed, the
system variables are not available, passwords in statements are
not checked, and the
function always returns 0. For example, without the plugin
installed, accounts can be assigned passwords shorter than 8
validate_password is installed,
it implements three levels of password checking:
STRONG. The default is
MEDIUM; to change this, modify the value of
policies implement increasingly strict password tests. The
following descriptions refer to default parameter values, which
can be modified by changing the appropriate system variables.
LOWpolicy tests password length only. Passwords must be at least 8 characters long. To change this length, modify
MEDIUMpolicy adds the conditions that passwords must contain at least 1 numeric character, 1 lowercase character, 1 uppercase character, and 1 special (nonalphanumeric) character. To change these values, modify
STRONGpolicy adds the condition that password substrings of length 4 or longer must not match words in the dictionary file, if one has been specified. To specify the dictionary file, modify
validate_password supports the
capability of rejecting passwords that match the user name part of
the effective user account for the current session, either forward
or in reverse. To provide control over this capability,
validate_password exposes a
system variable, which is enabled by default.