6.4.3.2 Password Validation Options and Variables

validate_password.check_user_name

Whether validate_password compares passwords to the user name part of the effective user account for the current session and rejects them if they match. This variable is unavailable unless validate_password is installed.

By default, validate_password.check_user_name is enabled. This variable controls user name matching independent of the value of validate_password.policy.

When validate_password.check_user_name is enabled, it has these effects:

validate_password.dictionary_file

The path name of the dictionary file that validate_password uses for checking passwords. This variable is unavailable unless validate_password is installed.

By default, this variable has an empty value and dictionary checks are not performed. For dictionary checks to occur, the variable value must be nonempty. If the file is named as a relative path, it is interpreted relative to the server data directory. File contents should be lowercase, one word per line. Contents are treated as having a character set of utf8. The maximum permitted file size is 1MB.

For the dictionary file to be used during password checking, the password policy must be set to 2 (STRONG); see the description of the validate_password.policy system variable. Assuming that is true, each substring of the password of length 4 up to 100 is compared to the words in the dictionary file. Any match causes the password to be rejected. Comparisons are not case sensitive.

For VALIDATE_PASSWORD_STRENGTH(), the password is checked against all policies, including STRONG, so the strength assessment includes the dictionary check regardless of the validate_password.policy value.

validate_password.dictionary_file can be set at runtime and assigning a value causes the named file to be read without a server restart.

validate_password.length

The minimum number of characters that validate_password requires passwords to have. This variable is unavailable unless validate_password is installed.

The validate_password.length minimum value is a function of several other related system variables. The value cannot be set less than the value of this expression:

validate_password.number_count
+ validate_password.special_char_count
+ (2 * validate_password.mixed_case_count)

If validate_password adjusts the value of validate_password.length due to the preceding constraint, it writes a message to the error log.

validate_password.mixed_case_count

The minimum number of lowercase and uppercase characters that validate_password requires passwords to have if the password policy is MEDIUM or stronger. This variable is unavailable unless validate_password is installed.

For a given validate_password.mixed_case_count value, the password must have that many lowercase characters, and that many uppercase characters.

validate_password.number_count

The minimum number of numeric (digit) characters that validate_password requires passwords to have if the password policy is MEDIUM or stronger. This variable is unavailable unless validate_password is installed.

validate_password.policy

The password policy enforced by validate_password. This variable is unavailable unless validate_password is installed.

validate_password.policy affects how validate_password uses its other policy-setting system variables, except for checking passwords against user names, which is controlled independently by validate_password.check_user_name.

The validate_password.policy value can be specified using numeric values 0, 1, 2, or the corresponding symbolic values LOW, MEDIUM, STRONG. The following table describes the tests performed for each policy. For the length test, the required length is the value of the validate_password.length system variable. Similarly, the required values for the other tests are given by other validate_password.xxx variables.

validate_password.special_char_count

The minimum number of nonalphanumeric characters that validate_password requires passwords to have if the password policy is MEDIUM or stronger. This variable is unavailable unless validate_password is installed.

validate_password.dictionary_file_last_parsed

When the dictionary file was last parsed. This variable is unavailable unless validate_password is installed.

validate_password.dictionary_file_words_count

The number of words read from the dictionary file. This variable is unavailable unless validate_password is installed.

--validate-password[=value]

This option controls how the server loads the deprecated validate_password plugin at startup. The value should be one of those available for plugin-loading options, as described in Section 5.6.1, “Installing and Uninstalling Plugins”. For example, --validate-password=FORCE_PLUS_PERMANENT tells the server to load the plugin at startup and prevents it from being removed while the server is running.

This option is available only if the validate_password plugin has been previously registered with INSTALL PLUGIN or is loaded with --plugin-load-add. See Section 6.4.3.1, “Password Validation Component Installation and Uninstallation”.

validate_password_check_user_name

This validate_password plugin system variable is deprecated and will be removed in a future version of MySQL. Use the corresponding validate_password.check_user_name system variable of the validate_password component instead.

validate_password_dictionary_file

This validate_password plugin system variable is deprecated and will be removed in a future version of MySQL. Use the corresponding validate_password.dictionary_file system variable of the validate_password component instead.

validate_password_length

This validate_password plugin system variable is deprecated and will be removed in a future version of MySQL. Use the corresponding validate_password.length system variable of the validate_password component instead.

validate_password_mixed_case_count

This validate_password plugin system variable is deprecated and will be removed in a future version of MySQL. Use the corresponding validate_password.mixed_case_count system variable of the validate_password component instead.

validate_password_number_count

This validate_password plugin system variable is deprecated and will be removed in a future version of MySQL. Use the corresponding validate_password.number_count system variable of the validate_password component instead.

validate_password_policy

This validate_password plugin system variable is deprecated and will be removed in a future version of MySQL. Use the corresponding validate_password.policy system variable of the validate_password component instead.

validate_password_special_char_count

This validate_password plugin system variable is deprecated and will be removed in a future version of MySQL. Use the corresponding validate_password.special_char_count system variable of the validate_password component instead.

validate_password_dictionary_file_last_parsed

This validate_password plugin status variable is deprecated and will be removed in a future version of MySQL. Use the corresponding validate_password.dictionary_file_last_parsed status variable of the validate_password component instead.

validate_password_dictionary_file_words_count

This validate_password plugin status variable is deprecated and will be removed in a future version of MySQL. Use the corresponding validate_password.dictionary_file_words_count status variable of the validate_password component instead.