The MySQLAuth authenticator loads all users regardless of the authentication plugin they use. This means that MaxScale does authentication with users as if they used the default authentication plugin when in reality they use a specific plugin. The problem with this is that any user that uses an authentication plugin, will have an empty password and will appear to behave like a normal user without a password.

The correct behavior is to add a WHERE clause that has plugin = ''.