Authentication Plugins PAM LDAP Authentication without Proxy Users Note PAM Unix Password Authentication with Proxy Users and Group Mapping 1324 This authentication scenario uses PAM to check external users defined in terms of operating system user names and LDAP passwords, without proxying. Every such external user permitted to connect to MySQL Server should have a matching MySQL account that is defined to use PAM authentication through LDAP. To use PAM LDAP pluggable authentication for MySQL, these prerequisites must be satisfied: Another way to use LDAP for MySQL user authentication is to use the LDAP-specific authentication plugins. See Section 6.4.1.7, “LDAP Pluggable Authentication” . •An LDAP server must be available for the PAM LDAP service to communicate with. •LDAP users to be authenticated by MySQL must be present in the directory managed by the LDAP server. Configure MySQL for PAM LDAP authentication as follows: If PAM object files have a suffix different from  .so  on your system, substitute the correct suffix. The PAM file format might differ on some systems. Here, the authentication string contains only the PAM service name,  mysql-ldap , which authenticates using LDAP. The authentication scheme described here uses proxying and PAM group mapping to map connecting MySQL users who authenticate using PAM onto other MySQL accounts that define different sets of privileges. Users do not connect directly through the accounts that define the privileges. Instead, they connect through a default proxy account authenticated using PAM, such that all the external users are mapped to the MySQL accounts that hold the privileges. Any user who connects using the proxy account 1. Verify that Unix authentication permits logins to the operating system with the user name  antonio  and password  antonio_password . 2. Set up PAM to authenticate MySQL connections using LDAP by creating a  mysql-ldap  PAM service file named  /etc/pam.d/mysql-ldap . The file contents are system dependent, so check existing login-related files in the  /etc/pam.d  directory to see what they look like. On Linux, the  mysql-ldap file might look like this: #%PAM-1.0 auth required pam_ldap.so account required pam_ldap.so CREATE USER ’antonio’@’localhost’ IDENTIFIED WITH authentication_pam AS ’mysql-ldap’; GRANT ALL PRIVILEGES ON mydb.* TO ’antonio’@’localhost’; 3. Create a MySQL account with the same user name as the operating system user name and define it to authenticate using the PAM plugin and the  mysql-ldap  PAM service: 4. Connecting to the server is the same as described in PAM Unix Password Authentication without Proxy Users.