Authentication Plugins In Active Directory (which uses Kerberos as the default authentication method), creating a user creates both the Kerberos principal and the LDAP entry. Assuming that the Kerberos principal and LDAP entry have been registered by the appropriate service administrators, and that the MySQL server has been started using the  my.cnf  settings previously described, create a MySQL account that corresponds to the Kerberos principal name, including the domain name. The SASL LDAP plugin uses a constant user DN for Kerberos authentication and ignores any user DN configured from MySQL. This has certain implications: The following statements create a proxy user named  bredon@MYSQL.LOCAL  that assumes the privileges of the proxied user named  proxied_krb_usr . Other GSSAPI/Kerberos users that should have the same privileges can similarly be created as proxy users for the same proxied user. Observe closely the quoting for the proxy account name in the first  CREATE USER  statement and the GRANT PROXY  statement: •For most MySQL accounts, the user and host are separate parts of the account name, and thus are quoted separately as  ’ user_name ’@’ host_name ’ . •For Kerberos authentication, the user part of the account name includes the principal domain, so ’bredon@MYSQL.LOCAL’  is quoted as a single value. Because no host part is given, the full MySQL account name uses the default of  ’%’  as the host part:  ’bredon@MYSQL.LOCAL’@’%’ •For any MySQL account that uses GSSAPI/Kerberos authentication, the authentication string in  CREATE USER  or  ALTER USER  statements should contain no user DN because it has no effect. •Because the authentication string contains no user DN, it should contain group mapping information, to enable the user to be handled as a proxy user that is mapped onto the desired proxied user. For information about proxying with the LDAP authentication plugin, see LDAP Authentication with Proxying. •The MySQL DBA should create an account that has the Kerberos principal name as the user name, and that authenticates using the SASL LDAP plugin. Note Note 1350 -- create proxy account CREATE USER ’bredon@MYSQL.LOCAL’ IDENTIFIED WITH authentication_ldap_sasl BY ’#krb_grp=proxied_krb_user’; -- create proxied account and grant its privileges; -- use mysql_no_login plugin to prevent direct login CREATE USER ’proxied_krb_user’ IDENTIFIED WITH mysql_no_login; GRANT ALL ON krb_user_db.* TO ’proxied_krb_user’; -- grant to proxy account the -- PROXY privilege for proxied account GRANT PROXY ON ’proxied_krb_user’ TO ’bredon@MYSQL.LOCAL’;