MySQL Bugs: #115257: 8.4+: Authentication plugin confusion: messages / configuration / docs

Bug #115257	8.4+: Authentication plugin confusion: messages / configuration / docs
Submitted:	8 Jun 2024 13:44	Modified:	5 Jul 2024 22:59
Reporter:	Simon Mudd (OCA)	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Documentation	Severity:	S3 (Non-critical)
Version:	8.4.0	OS:	Any
Assigned to:		CPU Architecture:	Any
Tags:	configuration, directory_initialisation, mysql_native_password

Description:
I see the following information here: https://dev.mysql.com/doc/refman/8.4/en/data-directory-initialization.html

-- quote --
Note
The default authentication plugin is caching_sha2_password, and the 'root'@'localhost' administrative account uses caching_sha2_password by default.

mysql_native_password (the default authentication plugin prior to MySQL 8.0) is still supported but deprecated.
-- quote --

The default configuration of MySQL 8.4+ has the mysql_native_password plugin disabled. This is not mentioned in the paragraph above and it's an important change.  To use it requires a specific configuration addition. That could be mentioned.

Either way it is important to mention that while mysql_native_password is still supported it is not ENABLED by default.

How to repeat:
Read the documentation.

Suggested fix:
My suggestion would be to add the following comments or something similar:

Change the following:

mysql_native_password (the default authentication plugin prior to MySQL 8.0) is still supported but deprecated.

to

mysql_native_password (the default authentication plugin prior to MySQL 8.0) is still supported but deprecated.  To maintain the use of the mysql_native_password you must enable it explicitly when starting mysqld using one of the following methods:

- start mysqld with the additional parameter: --mysql-native-password=ON
- enable the setting in the [mysqld] section of your my.cnf file:
      mysql_native_password = ON

Adjust synopsis

Additionally MySQL 8.4 appears not to have the variable available in 8.0, default_authentication_plugin   (https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_default_authen...)

mysql> show global variables like '%authentication%';
+-----------------------+-------+
| Variable_name         | Value |
+-----------------------+-------+
| authentication_policy | *,,   |
+-----------------------+-------+
1 row in set (0.00 sec)

mysql> select @@version;
+-----------+
| @@version |
+-----------+
| 8.4.0     |
+-----------+
1 row in set (0.00 sec)

Yet the setting is referred to in the docs. It seems not to actually exist: https://dev.mysql.com/doc/refman/8.4/en/server-system-variables.html#sysvar_default_authen...

Also the mysql_native_password setting that can be used in 8.4 to provide backwards compatibility is not visible when querying the server directly:

mysql> show global variables like '%native%';
+-----------------------------------+-------+
| Variable_name                     | Value |
+-----------------------------------+-------+
| innodb_use_native_aio             | ON    |
| mysql_native_password_proxy_users | OFF   |   <---- or is this related? If so it's confusing
+-----------------------------------+-------+
2 rows in set (0.00 sec)

mysql> select @@version;
+-----------+
| @@version |
+-----------+
| 8.4.0     |
+-----------+
1 row in set (0.00 sec)

So figuring out what the default authentication method that will be used if you create a user seems not to be determinable dynamically, or it's certainly less obvious than it was in 8.0.

I find this rather confusing. Clearer documentation would be better and better, more explicit settings would enable us query the server for it's behaviour dynamically.

If I'm missing something please point me at the docs which makes this clearer:
- how to determine the default authentication plugin being used?
- how to determine if mysql_native_password is enabled or not?
- clarify if the default_authentication_plugin sysvar or command line parameter still works

Hello Simon,

Thank you for the report and feedback.

regards,
Umesh

Modify Synopsis to better reflect issue:
- was: 8.4+: Misleading information in 2.9.1 Initializing the Data Directory

Posted by developer:
 
Thank you for the bug report, this is fixed in the documentation source. We document how to enable it elsewhere so the docs now link there, but specific information (disabled by default as of 8.4.0 and removed as of 9.0.0) was added.

The 8.0 reference manual was also updated to include when it was deprecated (8.0.34), disabled by default (8.4.0), and removed (9.0.0).