Authentication Plugins authentication_ldap_simple  plugin, invoke client programs with the  --enable-cleartext- plugin  option to enable the client-side  mysql_clear_password  plugin. The instructions here assume the following scenario: uid=betsy_ldap,ou=People,dc=example,dc=com uid=boris_ldap,ou=People,dc=example,dc=com The instructions for setting up an account that uses LDAP authentication depend on which server-side LDAP plugin is used. The following sections describe several usage scenarios. To configure a MySQL account for simple LDAP authentication, the  CREATE USER  statement specifies the authentication_ldap_simple  plugin, and optionally names the LDAP user distinguished name (DN): Suppose that MySQL user  betsy  has this entry in the LDAP directory: uid=betsy_ldap,ou=People,dc=example,dc=com Then the statement to create the MySQL account for  betsy  looks like this: The authentication string specified in the  BY  clause does not include the LDAP password. That must be provided by the client user at connect time. Clients connect to the MySQL server by providing the MySQL user name and LDAP password, and by enabling the client-side  mysql_clear_password  plugin: shell>  mysql --user=betsy --password --enable-cleartext-plugin Enter password:  betsy_password (betsy_ldap LDAP password) The client-side  mysql_clear_password  authentication plugin leaves the password untouched, so client programs send it to the MySQL server as cleartext. This enables the password to be passed as is to the LDAP server. A cleartext password is necessary to use the server-side LDAP library without SASL, but may be a security problem in some configurations. These measures minimize the risk: 1340 Note Simple LDAP Authentication •MySQL users  betsy  and  boris  authenticate to the LDAP entries for  betsy_ldap  and  boris_ldap , respectively. (It is not necessary that the MySQL and LDAP user names differ. The use of different names in this discussion helps clarify whether an operation context is MySQL or LDAP.) •LDAP entries use the  uid  attribute to specify user names. This may vary depending on LDAP server. Some LDAP servers use the  cn  attribute for user names rather than  uid . To change the attribute, modify the  authentication_ldap_simple_user_search_attr  or authentication_ldap_sasl_user_search_attr  system variable appropriately. •These LDAP entries are available in the directory managed by the LDAP server, to provide distinguished name values that uniquely identify each user: • CREATE USER  statements that create MySQL accounts name an LDAP user in the  BY  clause, to indicate which LDAP entry the MySQL account authenticates against. CREATE USER  user IDENTIFIED WITH authentication_ldap_simple [BY ’ LDAP user DN ’]; CREATE USER ’betsy’@’localhost’ IDENTIFIED WITH authentication_ldap_simple AS ’uid=betsy_ldap,ou=People,dc=example,dc=com’;