[CalvinKirs]

New clusters in Doris 4.2.1 and 5.0 require root to set a password through a local MySQL bootstrap session before normal SQL. Empty-password admin client logins are disabled until its password is set. Existing deployment guides run status queries and register nodes before this step, and some recovery instructions assume localhost always bypasses authentication.

This documents the initialization flow and updates the commands in the authentication guide, FE configuration reference, quick start, and both manual deployment guides. Related implementation: apache/doris#70495.

Changes

• Explain new versus upgraded clusters, current-password checks, MySQL error 1820, remote/protocol restrictions including Web and Arrow Flight SQL/ADBC, and why internal JOB/MTMV/statistics execution does not need an admin login password.
• Document the existing hash-only, first-initialization initial_root_password, offline hash generation, optional admin activation, test compatibility, and temporary local password recovery with cleanup. Distinguish allow_empty_password_for_root_admin from skip_localhost_auth_check.
• Initialize root before status queries or node registration and use password prompts for subsequent connections. Keep the existing Docker helper example explicitly on 4.1.0; direct 4.2.1/5.0 users to local initialization or a deployment tool with matching credential support.
• Synchronize 20 pages across English/Chinese and current/4.x. The current tree covers 5.0; the 4.x tree states availability from 4.2.1. Leave 3.x and archives unchanged because they do not support this feature.

Review and validation

Review checkpoint	Conclusion
Goal and behavior	Covered; checked against the implementation and runtime evidence in the linked code PR.
Scope and clarity	Five existing topics per version/language; no product, deployment-script, or site-framework changes.
Versions, locales and information architecture	English/Chinese current and 4.x updated together; version-specific existing content preserved.
Links, anchors and navigation	No new governance findings; existing routes and front matter preserved.
Framework, responsive behavior and styling	Not applicable; documentation content only.
Verification	Repository docs-review.cjs completed against exact base/head commits; 20/20 Markdown/MDX pages compiled with the locked MDX 3.1.0 compiler; 8 offline hash checks passed; current/4.x patch parity and git diff --check passed.
Other correctness/usability issues	No introduced issue found after correcting initialization order, Docker version scope, and recovery cleanup.

docs-review produced no introduced findings compared with the base revision. Its four existing priority_networks anchor errors are checker false positives: the headings exist, but an earlier inline triple-backtick snippet is interpreted as an unclosed fence by the link checker. Existing warnings and informational findings are unchanged.

A full Docusaurus site build was not run. No new product runtime testing is claimed by this documentation PR; those results are recorded in the linked implementation PR.

Versions

• dev
• 4.x
• 3.x
• 2.1 or older (not covered by version/language sync gate)

Languages

• Chinese
• English

Docs Checklist

• Checked by AI
• Test Cases Built (offline hash examples and Markdown/MDX compilation)
• Updated required version and language counterparts, or explained why not
• If only one language changed, confirmed whether source/translation counterparts need sync (both languages updated)