Authentication Plugins If your system supports PAM and permits LDAP as a PAM authentication method, another way to use LDAP for MySQL user authentication is to use the server- side  authentication_pam  plugin. See Section 6.4.1.5, “PAM Pluggable Authentication” . Note Prerequisites for LDAP Pluggable Authentication •An LDAP server must be available for the LDAP authentication plugins to communicate with. •LDAP users to be authenticated by MySQL must be present in the directory managed by the LDAP server. •An LDAP client library must be available on systems where the server-side authentication_ldap_sasl  or  authentication_ldap_simple  plugin is used. Currently, supported libraries are the Windows native LDAP library, or the OpenLDAP library on non-Windows systems. •To use SASL-based LDAP authentication: •The LDAP server must be configured to communicate with a SASL server. •A SASL client library must be available on systems where the client-side authentication_ldap_sasl_client  plugin is used. Currently, the only supported library is the Cyrus SASL library. •To use a particular SASL authentication method, any other services required by that method must be available. For example, to use GSSAPI/Kerberos, a GSSAPI library and Kerberos services must be available. To use LDAP pluggable authentication for MySQL, these prerequisites must be satisfied: This section provides a general overview of how MySQL and LDAP work together to authenticate MySQL users. For examples showing how to set up MySQL accounts to use specific LDAP authentication plugins, see Using LDAP Pluggable Authentication. For information about authentication methods available to the LDAP plugins, see LDAP Authentication Methods. The client connects to the MySQL server, providing the MySQL client user name and a password: How LDAP Authentication of MySQL Users Works •For simple LDAP authentication, the client-side and server-side plugins communicate the password as cleartext. A secure connection between the MySQL client and server is recommended to prevent password exposure. •For SASL-based LDAP authentication, the client-side and server-side plugins avoid sending the cleartext password between the MySQL client and server. For example, the plugins might use SASL messages for secure transmission of credentials within the LDAP protocol. For the GSSAPI authentication method, the client-side and server-side plugins communicate securely using Kerberos without using LDAP messages directly. If the client user name and host name match no MySQL account, the connection is rejected. If there is a matching MySQL account, authentication against LDAP occurs. The LDAP server looks for an entry matching the user and authenticates the entry against the LDAP password: 1335