Skip to main content

Authentication Methods

Overview​

ProxySQL supports distinct authentication mechanisms depending on the direction of the connection.

Frontend Authentication (Clients → ProxySQL)​

MethodNotes
mysql_native_passwordSupported in all versions
mysql_clear_passwordSupported in all versions
caching_sha2_passwordFull support from v2.6.0; v2.0.2–2.5.x requires cleartext passwords
SPIFFEPasswordless X.509 certificate-based authentication
LDAPDirectory-based authentication

Backend Authentication (ProxySQL → Databases)​

MethodNotes
mysql_native_passwordSupported in all versions
mysql_clear_passwordSupported in all versions
caching_sha2_passwordFull support from v2.6.0

Version-Specific Notes​

  • Pre-2.0.2 — No caching_sha2_password support at all
  • 2.0.2–2.5.x — Frontend caching_sha2_password requires passwords stored in cleartext
  • 2.6.0+ — Full caching_sha2_password support for both frontend and backend with flexible password storage

Configuration​

-- Set default authentication plugin
SET mysql-default_authentication_plugin='mysql_native_password';
LOAD MYSQL VARIABLES TO RUNTIME;
SAVE MYSQL VARIABLES TO DISK;

Users are configured in the mysql_users table. See Users Configuration.

Known Limitations​

  • Passwords starting with * may cause detection mechanism failures
  • Authentication method switching during handshakes presents challenges with caching_sha2_password
  • MariaDB clients using caching_sha2_password require the --ssl flag for versions before 10.10

See Also​