Authentication Plugins 4. bredon@MYSQL.LOCAL  is treated as a proxy for  proxied_krb_user , and the following query returns output as shown: mysql>  SELECT USER(), CURRENT_USER(), @@proxy_user; +------------------------------+--------------------+--------------------------+ | USER() | CURRENT_USER() | @@proxy_user | +------------------------------+--------------------+--------------------------+ | bredon@MYSQL.LOCAL@localhost | proxied_krb_user@% | ’bredon@MYSQL.LOCAL’@’%’ | +------------------------------+--------------------+--------------------------+ The  USER()  value indicates the user name used for the client command ( bredon@MYSQL.LOCAL ) and the host from which the client connected ( localhost ). The  CURRENT_USER()  value is the full name of the proxied user account, which consists of the proxied_krb_user  user part and the  %  host part. The  @@proxy_user  value indicates the full name of the account used to make the connection to the MySQL server, which consists of the  bredon@MYSQL.LOCAL  user part and the  %  host part. This demonstrates that proxying occurs through the  bredon@MYSQL.LOCAL  proxy user account, and that  bredon@MYSQL.LOCAL  assumes the privileges granted to the  proxied_krb_user  proxied user account. A TGT once obtained is cached on the client side and can be used until it expires without specifying the password again. However the TGT is obtained, the client-side plugin uses it to acquire service tickets and communicate with the server-side plugin. When the client-side plugin itself obtains the TGT, the client user may not want the TGT to be reused. As described in /etc/krb5.conf Client Configuration Parameters, the local  /etc/krb5.conf  file can be used to cause the client-side plugin to destroy the TGT when done with it. The server-side plugin has no access to the TGT itself or the Kerberos password used to obtain it. The LDAP authentication plugins have no control over the caching mechanism (storage in a local file, in memory, and so forth), but Kerberos utilities such as  kswitch  may be available for this purpose. The client-side SASL LDAP plugin reads the local  /etc/krb5.conf  file. If this file is missing or inaccessible, an error occurs. Assuming that the file is accessible, the optional  [appdefaults]  section can be used to provide information used by the plugin. Place such information within the  MySQL  part of the section. For example: The client-side plugin recognizes these parameters in the  MySQL  section: •The  ldap_server_host  value specifies the LDAP server host and can be useful when that host differs from the KDC server host specified in the  [realms]  section. By default, the plugin uses the KDC server host as the LDAP server host. •The  ldap_destroy_tgt  value indicates whether the client-side plugin destroys the TGT after obtaining and using it. By default,  ldap_destroy_tgt  is  false , but can be set to  true  to avoid TGT reuse. (This setting applies only to TGTs created by the client-side plugin, not TGTs created externally to MySQL.) /etc/krb5.conf Client Configuration Parameters [appdefaults] MySQL = { ldap_server_host = "ldap_host.example.com" ldap_destroy_tgt = true } 1352