6.2.18 Proxy Users 1263 Proxy Users side plugin is available. If the plugin is built into  libmysqlclient , it is available by default. Otherwise, the plugin must be installed on the replica side in the directory named by the replica’s  plugin_dir system variable. Third-party connector developers can use the following guidelines to determine readiness of a connector to take advantage of pluggable authentication capabilities and what steps to take to become more compliant: Pluggable Authentication and Third-Party Connectors • FEDERATED  tables:  A  FEDERATED  table can access the remote table only through accounts on the remote server that use native authentication. Exception: A connector might work with pluggable authentication without any changes if it links to  libmysqlclient  dynamically (rather than statically) and it loads the current version of libmysqlclient  if that version is installed. If a connector links to  libmysqlclient  dynamically, it must be ensured that the newer version of libmysqlclient  is installed on the client host and that the connector loads it at runtime. The MySQL server authenticates client connections using authentication plugins. The plugin that authenticates a given connection may request that the connecting (external) user be treated as a different user for privilege-checking purposes. This enables the external user to be a proxy for the second user; that is, to assume the privileges of the second user: •The external user is a “proxy user”  (a user who can impersonate or become known as another user). •The second user is a “proxied user”  (a user whose identity and privileges can be assumed by a proxy user). •Proxy user support by a connector depends, as described earlier in this section, on whether the authentication methods that it supports permit proxy users. •If a connector should be able to load client-side plugins from a directory different from the default plugin directory, it must implement some means for client users to specify the directory. Possibilities for this include a command-line option or environment variable from which the connector can obtain the directory name. Standard MySQL client programs such as  mysql  and  mysqladmin  implement a  -- plugin-dir  option. See also C API Client Plugin Interface. •Another way for a connector to support a given authentication method is to implement it directly in the client/server protocol. Connector/NET uses this approach to provide support for Windows native authentication. •To take advantage of pluggable authentication capabilities, a connector that is  libmysqlclient -based should be relinked against the current version of  libmysqlclient . This enables the connector to support connections though accounts that require client-side plugins now built into  libmysqlclient (such as the cleartext plugin needed for PAM authentication and the Windows plugin needed for Windows native authentication). Linking with a current  libmysqlclient  also enables the connector to access client-side plugins installed in the default MySQL plugin directory (typically the directory named by the default value of the local server’s  plugin_dir  system variable). •An existing connector to which no changes have been made uses native authentication and clients that use the connector can connect to the server only through accounts that use native authentication. However, you should test the connector against a recent version of the server to verify that such connections still work without problem.