Authentication Plugins Name Cmd-Line Option File System Var Status Var Var Scope Dynamic authentication_ldap_simple_group_search_attr Yes Yes Yes Global Yes authentication_ldap_simple_group_search_filter Yes Yes Yes Global Yes authentication_ldap_simple_init_pool_size Yes Yes Yes Global Yes authentication_ldap_simple_log_status Yes Yes Yes Global Yes authentication_ldap_simple_max_pool_size Yes Yes Yes Global Yes authentication_ldap_simple_referral Yes Yes Yes Global Yes authentication_ldap_simple_server_host Yes Yes Yes Global Yes authentication_ldap_simple_server_port Yes Yes Yes Global Yes authentication_ldap_simple_tls Yes Yes Yes Global Yes authentication_ldap_simple_user_search_attr Yes Yes Yes Global Yes authentication_windows_log_level Yes Yes Yes Global No authentication_windows_use_principal_name Yes Yes Yes Global No Command-Line Format --authentication-ldap-sasl-auth- method-name=value System Variable authentication_ldap_sasl_auth_method_name Scope Global Dynamic Yes SET_VAR  Hint Applies No Type String Default Value SCRAM-SHA-1 Valid Values ( ≥  8.0.23) SCRAM-SHA-1 SCRAM-SHA-256 GSSAPI Valid Values ( ≥  8.0.20,  ≤  8.0.22) SCRAM-SHA-1 GSSAPI Valid Values ( ≤  8.0.19) SCRAM-SHA-1 • authentication_ldap_sasl_auth_method_name • SCRAM-SHA-1 : Use a SASL challenge-response mechanism. For SASL LDAP authentication, the authentication method name. Communication between the authentication plugin and the LDAP server occurs according to this authentication method to ensure password security. These authentication method values are permitted: The client-side  authentication_ldap_sasl_client  plugin communicates with the SASL server, using the password to create a challenge and obtain a SASL request buffer, then passes this buffer to the server-side  authentication_ldap_sasl  plugin. The client-side and server-side SASL LDAP plugins use SASL messages for secure transmission of credentials within the LDAP protocol, to avoid sending the cleartext password between the MySQL client and server. 1361