What problem does this PR solve?

Issue Number: close #54660

Problem Summary:

Support a global (password_require_current) and per account (mysql.user.Password_require_current) policy for requiring the current password when changing the password.

What changed and how does it work?

1. To create/modify the per user policy use:

CREATE USER ... PASSWORD REQUIRE CURRENT;
CREATE USER ... PASSWORD REQUIRE CURRENT OPTIONAL;
CREATE USER ... PASSWORD REQUIRE CURRENT DEFAULT;
ALTER USER ... PASSWORD REQUIRE CURRENT;
ALTER USER ... PASSWORD REQUIRE CURRENT OPTIONAL;
ALTER USER ... PASSWORD REQUIRE CURRENT DEFAULT;

2. To change the system policy:

SET GLOBAL password_require_current=OFF;
SET GLOBAL password_require_current=ON;

3. To specify a password when changing the password:

ALTER USER ... IDENTIFIED BY 'newpwd' REPLACE 'curentpwd';

parser:

• Support PASSWORD REQUIRE CURRENT
• Support PASSWORD REQUIRE CURRENT OPTIONAL
• Support ALTER USER...IDENTIFIED BY ... REPLACE ...
• Support ALTER USER...IDENTIFIED WITH ... BY ... REPLACE ...
• Support ALTER USER() IDENTIFIED BY ... REPLACE ...
• Add ErrIncorrectCurrentPassword
• Add ErrMissingCurrentPassword
• Add ErrCurrentPasswordNotRequired

session:

• Add Password_require_current column to mysql.user

sessionctx/variable:

• Add password_require_current system variable

executor:

• Include "PASSWORD REQUIRE CURRENT ..." in SHOW CREATE USER output
• Support modifying accounts with ALTER USER ... PASSWORD REQUIRE CURRENT ...
• Check current password in ALTER USER

errno:

• Add ErrIncorrectCurrentPassword
• Add ErrMissingCurrentPassword
• Add ErrCurrentPasswordNotRequired

privilege:

• Load current password policy from mysql.user table
• Check current password

Questions and remarks

• TestAbnormalMySQLTable has a comment that says it is testing with a mysql.user table synchronized from MySQL. However the supplied data looks like a TiDB mysql.user table instead. Is this test correct? Should this be multiple tests, with MySQL 5.7,8.0 and 8.4? Maybe 9.0? @CbcWestwolf ? TestAbnormalMySQLTable has multiple issues. #54924
• Looks like there is no interface or good abstraction for authentication plugins. Now (*UserPrivilege).checkPassword() for example needs to do something different based on what authentication plugin is being used. Maybe we can make auth.CheckHashingPassword() more generic, but then we should probably change the name. Maybe an interface is best, but probably that's out of scope for this PR.
• show.go has a "FIXME: the returned string is not escaped safely" comment. Maybe we should fix this outside of this PR?
• This should work for mysql_native_password, tidb_sm3_password and caching_sha2_password. For other methods more testing and work might be needed.
• Looks like we still have the PASSWORD() function and SET PASSWORD = PASSWORD(...) from the MySQL 5.7 era. Might be good to start the process of removing this (outside of this PR).

Documentation needed

• ALTER USER docs to include:
  • Add: ALTER USER...PASSWORD REQUIRE CURRENT ...
  • Add: ALTER USER...IDENTIFIED BY... REPLACE ...
• System variable docs
  • Add: password_require_current
• System table docs
  • Update mysql.user docs

TODO

• Check impact on audit logging for new field that contains a password
• Check impact on log redact for a new field that contains a password
• Check impact on BR for new column in mysql.user
• Check impact on TiCDC for new column in mysql.user
• Check impact on DM for new column in mysql.user

For log redaction and audit logging:

These take care of this for SET PASSWORD and ALTER USER:

pkg/parser/ast/misc.go:func (n *SetPwdStmt) SecureText() string {
pkg/parser/ast/misc.go:func (n *AlterUserStmt) SecureText() string {

• Both don't really need an update but (*AlterUserStmt).SecureText() was updated anyway to make the intention clear.
• The REPLACE <password> syntax is only used with SET PASSWORD and ALTER USER statements, which both already deal with passwords.

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No need to test

  • I checked and no code files have been changed.

Side effects

• Performance regression: Consumes more CPU
• Performance regression: Consumes more Memory
• Breaking backward compatibility

Documentation

• Affects user behaviors
• Contains syntax changes
• Contains variable changes
• Contains experimental features
• Changes MySQL compatibility

Release note

Please refer to Release Notes Language Style Guide to write a quality release note.

Support for a password policies that require the current password when changing passwords has been added.