how to manage polardb database account passwords-PolarDB(PolarDB)-阿里云帮助中心

If you use UPDATE or INSERT statements to directly modify the permission table in the MySQL database to change account passwords or permissions, the changes are not synchronized to read-only nodes. You must use the methods described in this topic to make these changes. This topic describes how to change database account passwords, configure password expiration, and enable or disable the password validation feature.

Background information

PolarDB supports two types of database accounts: privileged accounts and standard accounts. You can manage all accounts in the console.

Note

For security reasons, PolarDB does not provide a root account.

Account type	Description
Privileged Account	Can be created and managed only in the console. Each cluster can have only one privileged account. This account can manage all standard accounts and databases in the cluster. Can create databases and standard accounts. It can also grant a standard account permissions on a specific database, which allows the standard account to add, delete, modify, and query data in that database. Provides more permissions to meet custom and fine-grained permission management needs. For example, query permissions on different tables can be assigned to different users. Can disconnect any account.
Standard Account	Can be created and managed in the console or using SQL statements. A cluster can have multiple standard accounts. The specific number depends on the database kernel. Does not have permissions to create databases or standard accounts. Can manage only authorized databases. Cannot manage other accounts or disconnect other accounts.
Global Read-only Account	Can be created and managed in the console or using SQL statements. Cannot create or manage databases. Does not have permissions to create databases or standard accounts. Can only view databases. A cluster can have multiple global read-only accounts. By default, these accounts have read-only permissions on all data. Cannot manage other accounts or disconnect other accounts.

Change an account password

Log on to the PolarDB console and select the region where the cluster is located. On the Clusters page, click the ID of the destination cluster to go to its product page.
In the navigation pane on the left, click Settings and Management > Accounts.
Find the destination account, and click Change Password in the Actions column.
In the Change Password dialog box, enter and confirm the new password, and then click OK.

Change an account password from the command line

You can use a privileged account and run the following commands to change an account password:

PolarDB for MySQL 8.0:
```
ALTER USER 'username'@'host' IDENTIFIED BY '{password}'
```
Parameter
Description
username
The account whose password you want to change.
password
The password of the account.

PolarDB for MySQL 5.6 or 5.7:

SET PASSWORD FOR 'username'@'host' = PASSWORD('password')

Parameter	Description
username	The account whose password you want to change.
host	The host from which the account can log on. To allow the account to log on from any host, use a percent sign (%).
password	The password of the account.

Configure password expiration

You must use a privileged account to configure password expiration. Follow these steps:

Use a privileged account to connect to the database. For more information, see Connect to a database cluster.
Execute the following SQL statement to configure the password expiration time.
```
ALTER USER 'username'@'hostname' PASSWORD EXPIRE INTERVAL N DAY;
```
In the statement, username is the name of the destination account. hostname is the name of the host where the destination account is located. N is the number of days the password is valid.

Note

PolarDB for MySQL 5.6 does not support password expiration configuration.

Enable or disable the password validation feature

You can enable or disable the password validation feature by installing or uninstalling the validate_password plugin. Follow these steps:

Use a privileged account to connect to the database. For more information, see Connect to a database cluster.
Execute the following SQL statements to install or uninstall the validate_password plugin.
- PolarDB for MySQL 8.0.
  - Install the validate_password component:
```
INSTALL COMPONENT 'file://component_validate_password';
```
  - Uninstall the validate_password component:
```
UNINSTALL COMPONENT 'file://component_validate_password';
```
- PolarDB for MySQL 5.7.
  - Install the validate_password plugin:
```
INSTALL PLUGIN validate_password SONAME 'validate_password.so';
```
  - Uninstall the validate_password plugin:
```
UNINSTALL PLUGIN validate_password;
```
- PolarDB for MySQL version 5.6 does not support the installation or uninstallation of the validate_password plugin to enable or disable the password validation feature.

Modify validate_password parameters

You cannot modify validate_password parameters in the PolarDB console.