User password expiry was introduced in MariaDB 10.4.3.
 
Password expiry permits administrators to expire user
passwords, either manually or automatically. 
 
System Variables
 
There are two system variables which affect password expiry:
default_password_lifetime, which determines the amount of
time between requiring the user to change their password. 0,
the default, means automatic password expiry is not active.
 
The second variable, disconnect_on_expired_password
determines whether a client is permitted to connect if their
password has expired, or whether they are permitted to
connect in sandbox mode, able to perform a limited subset of
queries related to resetting the password, in particular SET
PASSWORD and SET.
 
Setting a Password Expiry Limit for a User
 
Besides automatic password expiry, as determined by
default_password_lifetime, password expiry times can be set
on an individual user basis, overriding the global using the
CREATE USER or ALTER USER statements, for example:
 
CREATE USER 'monty'@'localhost' PASSWORD EXPIRE INTERVAL
120 DAY;
 
ALTER USER 'monty'@'localhost' PASSWORD EXPIRE INTERVAL
120 DAY;
 
Limits can be disabled by use of the NEVER keyword, for
example:
 
CREATE USER 'monty'@'localhost' PASSWORD EXPIRE NEVER;
 
ALTER USER 'monty'@'localhost' PASSWORD EXPIRE NEVER;
 
A manually set limit can be restored the system default by
use of DEFAULT, for example:
 
CREATE USER 'monty'@'localhost' PASSWORD EXPIRE DEFAULT;
 
ALTER USER 'monty'@'localhost' PASSWORD EXPIRE DEFAULT;
 
SHOW CREATE USER
 
The SHOW CREATE USER statement will display information
about the password expiry status of the user. Unlike MySQL,
it will not display if the user is unlocked, or if the
password expiry is set to default.
 
CREATE USER 'monty'@'localhost' PASSWORD EXPIRE INTERVAL
120 DAY;
 
CREATE USER 'konstantin'@'localhost' PASSWORD EXPIRE
NEVER;
 
CREATE USER 'amse'@'localhost' PASSWORD EXPIRE DEFAULT;
 
SHOW CREATE USER 'monty'@'localhost';
 
+------------------------------------------------------------------+
| CREATE USER for monty@localhost |
+------------------------------------------------------------------+
| CREATE USER 'monty'@'localhost' PASSWORD EXPIRE
INTERVAL 120 DAY |
+------------------------------------------------------------------+
 
SHOW CREATE USER 'konstantin'@'localhost';
 
+------------------------------------------------------------+
| CREATE USER for konstantin@localhost |
+------------------------------------------------------------+
| CREATE USER 'konstantin'@'localhost' PASSWORD EXPIRE
NEVER |
+------------------------------------------------------------+
 
SHOW CREATE USER 'amse'@'localhost';
 
+--------------------------------+
| CREATE USER for amse@localhost |
+--------------------------------+
| CREATE USER 'amse'@'localhost' |
+--------------------------------+
 
--connect-expired-password Client Option
 
The mysql client --connect-expired-password option notifies
the server that the client is prepared to handle expired
password sandbox mode (even if the --batch option was
specified).
 

 
 
 
 
 
 
 

URL: https://mariadb.com/kb/en/user-password-expiry/