CentOS 7 x86_64

Due to various considerations, some statements are written into the binary log even when they fail. In this case, CREATE USER is written into the binary log on master. The binlog event gets the error code 1819 (ER_NOT_VALID_PASSWORD). The expectation is that the slave will hit the same error while trying to execute the statement. However, you apparently don't have the simple_password_check plugin on the slave, so the password does not violate any restrictions, the statement works all right ("no error" on the slave), which causes the replication failure.

Reasons for writing erroneous statements into the binary log are different, depending on the statement. I don't know reasoning for single CREATE USER, it looks like the change was made in the scope of MDEV-7288, so I'll assign it to bar to confirm whether it was intentional. Meanwhile, the obvious workaround seems to be to have the same configuration on the slave as the master has, including smple_password_check plugin.

As far as I remember, password validation is always skipped on the slave. In particular, because normally passwords are not written to binlog, the statement is rewritten to use IDENTIFIED BY PASSWORD and the password hash.

The failed CREATE USER statement gets written into the binary log.
This test demonstrates the problem:

--source include/not_embedded.inc

--source include/have_binlog_format_statement.inc

if (!$SIMPLE_PASSWORD_CHECK_SO) {

  skip No SIMPLE_PASSWORD_CHECK plugin;

}

INSTALL SONAME "simple_password_check";

--echo #

--echo # Password policy causes replication failure

--echo #

SELECT PLUGIN_NAME FROM INFORMATION_SCHEMA.PLUGINS

WHERE PLUGIN_NAME='simple_password_check';

--disable_query_log

RESET MASTER; # get rid of previous tests binlog

--enable_query_log

--error ER_NOT_VALID_PASSWORD

CREATE USER USR_RO@'10.1.1.26' IDENTIFIED BY 'bsg9#d.cem#!85';

--let $binlog_file = LAST

source include/show_binlog_events.inc;

UNINSTALL PLUGIN simple_password_check;

The output is:

INSTALL SONAME "simple_password_check";

#

# Password policy causes replication failure

#

SELECT PLUGIN_NAME FROM INFORMATION_SCHEMA.PLUGINS

WHERE PLUGIN_NAME='simple_password_check';

PLUGIN_NAME

simple_password_check

CREATE USER USR_RO@'10.1.1.26' IDENTIFIED BY 'bsg9#d.cem#!85';

ERROR HY000: Your password does not satisfy the current policy requirements

include/show_binlog_events.inc

Log_name	Pos	Event_type	Server_id	End_log_pos	Info

master-bin.000001	#	Gtid	#	#	GTID #-#-#

master-bin.000001	#	Query	#	#	use `test`; CREATE USER USR_RO@'10.1.1.26' IDENTIFIED BY 'bsg9#d.cem#!85'

UNINSTALL PLUGIN simple_password_check;

binlog.binlog-AAA 'stmt'                 [ pass ]     54

Notice, the CREATE USER statement.

ok to push, but please create a bug report for the second issue we've discussed.