Authentication Plugins IDENTIFIED WITH authentication_ldap_sasl AS ’+ou=People,dc=example,dc=com#grp1=usera,grp2,grp3=userc’; The authentication string has a user DN suffix  ou=People,dc=example,dc=com  prefixed by the  + character. Thus, as described in LDAP Authentication User DN Suffixes, the full user DN is constructed from the user DN suffix as specified, plus the client user name as the  uid  attribute. The remaining part of the authentication string begins with  # , which signifies the beginning of group preference and mapping information. This part of the authentication string lists group names in the order grp1 ,  grp2 ,  grp3 . The LDAP plugin compares that list with the set of group names returned by the LDAP server, looking in list order for a match against the returned names. The plugin uses the first match, or if there is no match, authentication fails. Suppose that the LDAP server returns groups  grp3 ,  grp2 , and  grp7 . The LDAP plugin uses  grp2 because it is the first group in the authentication string that matches, even though it is not the first group returned by the LDAP server. If the LDAP server returns  grp4 ,  grp2 , and  grp1 , the plugin uses  grp1 even though  grp2  also matches.  grp1  has a precedence higher than  grp2  because it is listed earlier in the authentication string. Assuming that the plugin finds a group name match, it performs mapping from that group name to the MySQL proxied user name, if there is one. For the example proxy account, mapping occurs as follows: If the LDAP server returns a group in DN format, the LDAP plugin parses the group DN to extract the group name from it. To specify LDAP group preference and mapping information, these principles apply: If an item has group and user names of  my_group_name  and  my_user_name  (which contain no special characters), it may but need not be written using quotes. Any of the following are valid: 1345 my_group_name=my_user_name my_group_name="my_user_name" "my group name"="my user name" •To quote a group or user name that contains special characters such as space, surround it by double quote ( " ) characters. For example, if an item has group and user names of  my group name  and  my user name , it must be written in a group mapping using quotes: •For an item specified as  group_name  (with no user name), the group name is used as the MySQL proxied user name. •For an item specified as  group_name = user_name  (with a user name), the group name maps to the user name, which is used as the MySQL proxied user name. •The group preference and mapping specification is a list of one or more items, separated by commas. Each item has the form  group_name = user_name  or  group_name . Items should be listed in group name preference order. For a group name selected by the plugin as a match from set of group names returned by the LDAP server, the two syntaxes differ in effect as follows: •Begin the group preference and mapping part of the authentication string with a  #  prefix character. •If the matching group name is  grp2 , there is no associated user name in the authentication string. The plugin uses  grp2  as the proxied user name. •If the matching group name is  grp1  or  grp3 , those are associated in the authentication string with user names  usera  and  userc , respectively. The plugin uses the corresponding associated user name as the proxied user name.