mariadb-alter-user

Documents MariaDB ALTER USER and SET PASSWORD syntax, semantics, and common pitfalls.

28|115|Updated Jan 28, 2025
One-click install
npx skills add https://github.com/mariadb-corporation/mariadb-docs --skill mariadb-alter-user-mariadb-corporation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mariadb-alter-user
Source: https://github.com/mariadb-corporation/mariadb-docs/tree/main/agent-skills/granular/statements/mariadb-alter-user
Command: npx skills add https://github.com/mariadb-corporation/mariadb-docs --skill mariadb-alter-user-mariadb-corporation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? LLMs frequently generate incorrect MariaDB account-management SQL — such as treating a bare string in SET PASSWORD as cleartext, omitting the DAY unit in PASSWORD EXPIRE INTERVAL, or assuming IDENTIFIED VIA merges rather than replaces authentication plugins. This Skill provides the exact MariaDB-specific syntax and behavioral deltas needed to write correct ALTER USER and SET PASSWORD statements. ## Core Features & Use Cases - Password semantics correction: Explains the three SET PASSWORD literal forms (PASSWORD(), OLD_PASSWORD(), pre-hashed string) and why there is no cleartext bare-string form. - Full ALTER USER option surface: Covers IF EXISTS warning semantics, IDENTIFIED BY vs IDENTIFIED BY PASSWORD vs IDENTIFIED VIA/WITH multi-plugin auth, PASSWORD EXPIRE variants, ACCOUNT LOCK/UNLOCK, TLS/REQUIRE options, and resource limits. - Behavioral edge cases: Details sandbox mode for expired passwords, lock-check ordering before credential validation, and default_password_lifetime being disabled by default. - Use Case: When asked to rotate a user's password or enforce 90-day expiry on MariaDB 11.8, generate ALTER USER 'app'@'%' IDENTIFIED BY 'newpass' PASSWORD EXPIRE INTERVAL 90 DAY; instead of the common incorrect forms. ## Quick Start Ask the AI to write or review a MariaDB statement that changes a user's password, expires credentials, or locks an account, and it will apply the correct MariaDB syntax.

Frequently Asked Questions about mariadb-alter-user

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I change a user's password in MariaDB?▼

Use ALTER USER 'user'@'host' IDENTIFIED BY 'newpass' or SET PASSWORD FOR 'user'@'host' = PASSWORD('newpass'). Both hash the cleartext input before storage; ALTER USER additionally supports IF EXISTS, expiry, locking, and resource-limit clauses.

Why does SET PASSWORD with a plain string not work in MariaDB?▼

A bare string in SET PASSWORD = 'text' is stored as-is as an already-hashed value, not re-hashed. Typing a plaintext password there silently creates an account nobody can log into; wrap cleartext in PASSWORD() instead.

Does ALTER USER IDENTIFIED VIA keep existing authentication plugins?▼

No. Since MariaDB 10.4.13, IDENTIFIED VIA replaces the account's entire authentication method list. Any previously configured plugin not repeated in the new IDENTIFIED VIA ... OR ... clause is removed.

How do I expire a MariaDB password after 90 days?▼

Use ALTER USER 'user'@'host' PASSWORD EXPIRE INTERVAL 90 DAY. The DAY unit is mandatory; there is no bare-integer form. PASSWORD EXPIRE NEVER opts out, and EXPIRE DEFAULT falls back to default_password_lifetime.

What happens when a MariaDB account is locked?▼

ACCOUNT LOCK blocks new connection attempts with ER_ACCOUNT_HAS_BEEN_LOCKED, checked before password validation. Existing open sessions are unaffected, and ACCOUNT UNLOCK re-permits connections.

Does MariaDB auto-expire passwords by default?▼

No. The default_password_lifetime system variable defaults to 0, meaning disabled. Passwords only auto-expire if an admin sets this global to a positive day count or sets per-account expiry with PASSWORD EXPIRE INTERVAL n DAY.