diff --git a/README-CN.md b/README-CN.md
index 7d2888327..2a9dcebf6 100644
--- a/README-CN.md
+++ b/README-CN.md
@@ -101,7 +101,7 @@ make dialyzer
 
 ##### 要分析特定的应用程序，（用逗号分隔的应用程序列表）
 ```
-DIALYZER_ANALYSE_APP=emqx_lwm2m,emqx_auth_jwt,emqx_auth_ldap make dialyzer
+DIALYZER_ANALYSE_APP=emqx_lwm2m,emqx_authz make dialyzer
 ```
 
 ## 社区
diff --git a/README-JP.md b/README-JP.md
index b7afe8195..580a76268 100644
--- a/README-JP.md
+++ b/README-JP.md
@@ -95,7 +95,7 @@ make dialyzer
 
 ##### 特定のアプリケーションのみ解析する（アプリケーション名をコンマ区切りで入力）
 ```
-DIALYZER_ANALYSE_APP=emqx_lwm2m,emqx_auth_jwt,emqx_auth_ldap make dialyzer
+DIALYZER_ANALYSE_APP=emqx_lwm2m,emqx_authz make dialyzer
 ```
 
 ## コミュニティ
diff --git a/README-RU.md b/README-RU.md
index cddaba4a5..5001f3fd3 100644
--- a/README-RU.md
+++ b/README-RU.md
@@ -104,7 +104,7 @@ make dialyzer
 
 ##### Статический анализ части приложений (список через запятую)
 ```
-DIALYZER_ANALYSE_APP=emqx_lwm2m,emqx_auth_jwt,emqx_auth_ldap make dialyzer
+DIALYZER_ANALYSE_APP=emqx_lwm2m,emqx_authz make dialyzer
 ```
 
 ## Сообщество
diff --git a/README.md b/README.md
index 8d8ed8731..f76d7ae0a 100644
--- a/README.md
+++ b/README.md
@@ -103,7 +103,7 @@ make dialyzer
 
 ##### To Analyse specific apps, (list of comma separated apps)
 ```
-DIALYZER_ANALYSE_APP=emqx_lwm2m,emqx_auth_jwt,emqx_auth_ldap make dialyzer
+DIALYZER_ANALYSE_APP=emqx_lwm2m,emqx_authz make dialyzer
 ```
 
 ## Community
diff --git a/apps/emqx_authentication/rebar.config b/apps/emqx_authentication/rebar.config
index 0a0af8c29..89bd1f54a 100644
--- a/apps/emqx_authentication/rebar.config
+++ b/apps/emqx_authentication/rebar.config
@@ -1,4 +1,5 @@
-{deps, []}.
+{deps, [{jose, {git, "https://github.com/potatosalad/erlang-jose", {tag, "1.11.1"}}}
+       ]}.
 
 {edoc_opts, [{preprocess, true}]}.
 {erl_opts, [warn_unused_vars,
@@ -15,4 +16,4 @@
 
 {cover_enabled, true}.
 {cover_opts, [verbose]}.
-{cover_export_enabled, true}.
\ No newline at end of file
+{cover_export_enabled, true}.
diff --git a/apps/emqx_management/test/emqx_mgmt_SUITE.erl b/apps/emqx_management/test/emqx_mgmt_SUITE.erl
index 6826e050b..84d5f2ebb 100644
--- a/apps/emqx_management/test/emqx_mgmt_SUITE.erl
+++ b/apps/emqx_management/test/emqx_mgmt_SUITE.erl
@@ -53,7 +53,7 @@ groups() ->
        ]}].
 
 apps() ->
-    [emqx_management, emqx_auth_mnesia, emqx_modules].
+    [emqx_management, emqx_retainer, emqx_modules].
 
 init_per_suite(Config) ->
     application:set_env(ekka, strict_mode, true),
@@ -317,12 +317,12 @@ t_plugins_cmd(_) ->
     meck:expect(emqx_plugins, reload, fun(_) -> ok end),
     ?assertEqual(emqx_mgmt_cli:plugins(["list"]), ok),
     ?assertEqual(
-       emqx_mgmt_cli:plugins(["unload", "emqx_auth_mnesia"]),
-       "Plugin emqx_auth_mnesia unloaded successfully.\n"
+       emqx_mgmt_cli:plugins(["unload", "emqx_retainer"]),
+       "Plugin emqx_retainer unloaded successfully.\n"
       ),
     ?assertEqual(
-       emqx_mgmt_cli:plugins(["load", "emqx_auth_mnesia"]),
-       "Plugin emqx_auth_mnesia loaded successfully.\n"
+       emqx_mgmt_cli:plugins(["load", "emqx_retainer"]),
+       "Plugin emqx_retainer loaded successfully.\n"
       ),
     ?assertEqual(
        emqx_mgmt_cli:plugins(["unload", "emqx_management"]),
diff --git a/apps/emqx_management/test/emqx_mgmt_api_SUITE.erl b/apps/emqx_management/test/emqx_mgmt_api_SUITE.erl
index d4d284e69..22d4f51ef 100644
--- a/apps/emqx_management/test/emqx_mgmt_api_SUITE.erl
+++ b/apps/emqx_management/test/emqx_mgmt_api_SUITE.erl
@@ -285,61 +285,61 @@ t_nodes(_) ->
     meck:unload(emqx_mgmt).
 
 t_plugins(_) ->
-    application:ensure_all_started(emqx_auth_mnesia),
+    application:ensure_all_started(emqx_retainer),
     {ok, Plugins1} = request_api(get, api_path(["plugins"]), auth_header_()),
     [Plugins11] = filter(get(<<"data">>, Plugins1), <<"node">>, atom_to_binary(node(), utf8)),
-    [Plugin1] = filter(maps:get(<<"plugins">>, Plugins11), <<"name">>, <<"emqx_auth_mnesia">>),
-    ?assertEqual(<<"emqx_auth_mnesia">>, maps:get(<<"name">>, Plugin1)),
+    [Plugin1] = filter(maps:get(<<"plugins">>, Plugins11), <<"name">>, <<"emqx_retainer">>),
+    ?assertEqual(<<"emqx_retainer">>, maps:get(<<"name">>, Plugin1)),
     ?assertEqual(true, maps:get(<<"active">>, Plugin1)),
 
     {ok, _} = request_api(put,
                           api_path(["plugins",
-                                    atom_to_list(emqx_auth_mnesia),
+                                    atom_to_list(emqx_retainer),
                                     "unload"]),
                           auth_header_()),
     {ok, Error1} = request_api(put,
                                api_path(["plugins",
-                                         atom_to_list(emqx_auth_mnesia),
+                                         atom_to_list(emqx_retainer),
                                          "unload"]),
                                auth_header_()),
     ?assertEqual(<<"not_started">>, get(<<"message">>, Error1)),
     {ok, Plugins2} = request_api(get,
                                  api_path(["nodes", atom_to_list(node()), "plugins"]),
                                  auth_header_()),
-    [Plugin2] = filter(get(<<"data">>, Plugins2), <<"name">>, <<"emqx_auth_mnesia">>),
-    ?assertEqual(<<"emqx_auth_mnesia">>, maps:get(<<"name">>, Plugin2)),
+    [Plugin2] = filter(get(<<"data">>, Plugins2), <<"name">>, <<"emqx_retainer">>),
+    ?assertEqual(<<"emqx_retainer">>, maps:get(<<"name">>, Plugin2)),
     ?assertEqual(false, maps:get(<<"active">>, Plugin2)),
 
     {ok, _} = request_api(put,
                           api_path(["nodes",
                                     atom_to_list(node()),
                                     "plugins",
-                                    atom_to_list(emqx_auth_mnesia),
+                                    atom_to_list(emqx_retainer),
                                     "load"]),
                           auth_header_()),
     {ok, Plugins3} = request_api(get,
                                  api_path(["nodes", atom_to_list(node()), "plugins"]),
                                  auth_header_()),
-    [Plugin3] = filter(get(<<"data">>, Plugins3), <<"name">>, <<"emqx_auth_mnesia">>),
-    ?assertEqual(<<"emqx_auth_mnesia">>, maps:get(<<"name">>, Plugin3)),
+    [Plugin3] = filter(get(<<"data">>, Plugins3), <<"name">>, <<"emqx_retainer">>),
+    ?assertEqual(<<"emqx_retainer">>, maps:get(<<"name">>, Plugin3)),
     ?assertEqual(true, maps:get(<<"active">>, Plugin3)),
 
     {ok, _} = request_api(put,
                           api_path(["nodes",
                                     atom_to_list(node()),
                                     "plugins",
-                                    atom_to_list(emqx_auth_mnesia),
+                                    atom_to_list(emqx_retainer),
                                     "unload"]),
                           auth_header_()),
     {ok, Error2} = request_api(put,
                                api_path(["nodes",
                                          atom_to_list(node()),
                                          "plugins",
-                                         atom_to_list(emqx_auth_mnesia),
+                                         atom_to_list(emqx_retainer),
                                          "unload"]),
                                auth_header_()),
     ?assertEqual(<<"not_started">>, get(<<"message">>, Error2)),
-    application:stop(emqx_auth_mnesia).
+    application:stop(emqx_retainer).
 
 t_acl_cache(_) ->
     ClientId = <<"client1">>,
diff --git a/deploy/docker/README.md b/deploy/docker/README.md
index 5702b622c..f243c7a4b 100644
--- a/deploy/docker/README.md
+++ b/deploy/docker/README.md
@@ -136,16 +136,16 @@ Default environment variable ``EMQX_LOADED_PLUGINS``, including
 EMQX_LOADED_PLUGINS="emqx_recon,emqx_retainer,emqx_management,emqx_dashboard"
 ```
 
-For example, set ``EMQX_LOADED_PLUGINS= emqx_auth_redis,emqx_auth_mysql`` to load these two plugins.
+For example, set ``EMQX_LOADED_PLUGINS= emqx_retainer,emqx_rule_engine`` to load these two plugins.
 
 You can use comma, space or other separator that you want.
 
 All the plugins defined in ``EMQX_LOADED_PLUGINS`` will be loaded.
 
 ```bash
-EMQX_LOADED_PLUGINS="emqx_auth_redis,emqx_auth_mysql"
-EMQX_LOADED_PLUGINS="emqx_auth_redis emqx_auth_mysql"
-EMQX_LOADED_PLUGINS="emqx_auth_redis | emqx_auth_mysql"
+EMQX_LOADED_PLUGINS="emqx_retainer,emqx_rule_engine"
+EMQX_LOADED_PLUGINS="emqx_retainer emqx_rule_engine"
+EMQX_LOADED_PLUGINS="emqx_retainer | emqx_rule_engine"
 ```
 
 #### EMQ X Plugins Configuration
@@ -155,8 +155,8 @@ The environment variables which with ``EMQX_`` prefix are mapped to all emqx plu
 Example:
 
 ```bash
-EMQX_AUTH__REDIS__SERVER   <--> auth.redis.server
-EMQX_AUTH__REDIS__PASSWORD <--> auth.redis.password
+EMQX_RETAINER__STORAGE_TYPE <--> retainer.storage_type
+EMQX_RETAINER__MAX_PAYLOAD_SIZE <--> retainer.max_payload_size
 ```
 
 Don't worry about where to find the configuration file of emqx plugins, this docker image will find and config them automatically using some magic.
@@ -166,15 +166,14 @@ All plugin of emqx project could config in this way, following the environment v
 Assume you are using redis auth plugin, for example:
 
 ```bash
-#EMQX_AUTH__REDIS__SERVER="redis.at.yourserver"
-#EMQX_AUTH__REDIS__PASSWORD="password_for_redis"
+#EMQX_RETAINER__STORAGE_TYPE = "ram"
+#EMQX_RETAINER.MAX_PAYLOAD_SIZE = 1MB
 
 docker run -d --name emqx -p 18083:18083 -p 1883:1883 -p 4369:4369 \
     -e EMQX_LISTENER__TCP__EXTERNAL=1883 \
-    -e EMQX_LOADED_PLUGINS="emqx_auth_redis" \
-    -e EMQX_AUTH__REDIS__SERVER="your.redis.server:6379" \
-    -e EMQX_AUTH__REDIS__PASSWORD="password_for_redis" \
-    -e EMQX_AUTH__REDIS__PASSWORD_HASH=plain \
+    -e EMQX_LOADED_PLUGINS="emqx_retainer" \
+    -e EMQX_RETAINER__STORAGE_TYPE = "ram" \
+    -e EMQX_RETAINER__MAX_PAYLOAD_SIZE = 1MB \
     emqx/emqx:latest
 ```
 
diff --git a/rebar.config.erl b/rebar.config.erl
index 88148818e..7a473cc6a 100644
--- a/rebar.config.erl
+++ b/rebar.config.erl
@@ -279,10 +279,6 @@ relx_plugin_apps(ReleaseType) ->
     , emqx_coap
     , emqx_stomp
     , emqx_authentication
-    , emqx_auth_http
-    , emqx_auth_mysql
-    , emqx_auth_jwt
-    , emqx_auth_mnesia
     , emqx_web_hook
     , emqx_rule_engine
     , emqx_sasl
@@ -294,10 +290,6 @@ relx_plugin_apps(ReleaseType) ->
 
 relx_plugin_apps_per_rel(cloud) ->
     [ emqx_lwm2m
-    , emqx_auth_ldap
-    , emqx_auth_pgsql
-    , emqx_auth_redis
-    , emqx_auth_mongo
     , emqx_lua_hook
     , emqx_exhook
     , emqx_exproto