Authentication Plugins "my_group_name"=my_user_name "my_group_name"="my_user_name" LDAP Authentication User DN Suffixes LDAP Authentication Methods 1346 •To escape a character, precede it by a backslash ( \ ). This is useful particularly to include a literal double quote or backslash, which are otherwise not included literally. •A user DN need not be present in the authentication string, but if present, it must precede the group preference and mapping part. A user DN can be given as a full user DN, or as a user DN suffix with a  + prefix character. (See LDAP Authentication User DN Suffixes.) •In the absence of a  +  character, the authentication string value is treated as is without modification. •If the authentication string begins with  + , the plugin constructs the full user DN value from the user name sent by the client, together with the DN specified in the authentication string (with the  +  removed). In the constructed DN, the client user name becomes the value of the attribute that specifies LDAP user names. This is  uid  by default; to change the attribute, modify the appropriate system variable ( authentication_ldap_simple_user_search_attr  or authentication_ldap_sasl_user_search_attr ). The authentication string is stored as given in the  mysql.user  system table, with the full user DN constructed on the fly before authentication. •For the  authentication_ldap_simple  plugin: Set the authentication_ldap_simple_auth_method_name  system variable to configure the method. The permitted choices are  SIMPLE  and  AD-FOREST . The LDAP authentication plugins use a configurable authentication method. The appropriate system variable and available method choices are plugin-specific: The accounts in the preceding examples have a nonempty user name, so the client always connects to the MySQL server using the same name as specified in the account definition. If an account has an empty user name, such as the default anonymous  ’’@’%’  proxy account described in LDAP Authentication with Proxying, clients might connect to the MySQL server with varying user names. But the principle is the same: If the authentication string begins with  + , the plugin uses the user name sent by the client together with the authentication string to construct the user DN. The client connects with the user name specified in the account ( accounting ), which in this case is used as the  uid  attribute together with the authentication string to construct the user DN: uid=accounting,ou=People,dc=example,dc=com The client connects with the user name specified in the account ( baldwin ). In this case, that name is not used because the authentication string has no prefix and thus fully specifies the user DN. This account authentication string does have  +  at the beginning, so it is taken as just part of the user DN: This account authentication string does not have  +  at the beginning, so it is taken as the full user DN: LDAP authentication plugins permit the authentication string that provides user DN information to begin with a  +  prefix character: CREATE USER ’baldwin’ IDENTIFIED WITH authentication_ldap_simple AS ’uid=admin,ou=People,dc=example,dc=com’; CREATE USER ’accounting’ IDENTIFIED WITH authentication_ldap_simple AS ’+ou=People,dc=example,dc=com’;