# `TiDB` Server User Security

__*zz-BGL*__
__*zz-Jeff*__

+ Understand authentication and authorization
  + Authentication: "You are who you say you are"
  + Authorization: "What you are allowed to do"
+ User authentication methods
  + **`mysql_native_password`**
  + **`caching_sha2_password`**
  + **`auth_socket`**
  + **`TLS`** certificate
+ User authorization
  + Verify the granted privileges for the identified user
  + Privileges consist of 3 access levels
    + Global access: **`user`**
    + Database specific access: **`database`**
    + Table specific access: **`table`**

-------------------------------------------------------------
`TiDB` supports multiple authentication methods. These methods can be specified on a per user basis using `CREATE USER` and `ALTER USER`.

You can use one of the following supported authentication methods in the table. To specify a default method that the server advertises when the `client-server` connection is being established, set the `default_authentication_plugin` variable.

`TiDB` supports similar security functionality to `MySQL 5.7`, with the following exceptions:
- Column level permissions are not supported.
- Password expiry, as well as password last-changed tracking and password lifetime are not supported.
- The permission attributes `max_questions`, `max_updated`, `max_connections`, `max_user_connections` are not supported.
- Password validation is not currently supported.