Authentication Plugins If the library defaults or  ldap.conf  values do not yield appropriate option values, an LDAP authentication plugin may be able to set related variables to affect the LDAP configuration directly. For example, LDAP plugins can override  ldap.conf  for parameters such as these: For more information about  ldap.conf  consult the  ldap.conf(5)  man page. This section describes how to enable MySQL accounts to connect to the MySQL server using LDAP pluggable authentication. It is assumed that the server is running with the appropriate server-side plugins enabled, as described in Installing LDAP Pluggable Authentication, and that the appropriate client-side plugins are available on the client host. This section does not describe LDAP configuration or administration. You are assumed to be familiar with those topics. The two server-side LDAP plugins each work with a specific client-side plugin: Overall requirements for LDAP authentication of MySQL users: 1339 •Client programs connect using the connection method appropriate for the server-side authentication plugin the MySQL account uses. For LDAP authentication, connections require the MySQL user name and LDAP password. In addition, for accounts that use the server-side •There must be a MySQL user account that specifies a server-side LDAP authentication plugin and optionally names the associated LDAP user distinguished name (DN). (To associate an LDAP user DN with a MySQL account, include a  BY  clause in the  CREATE USER  statement that creates the account.) If an account names no LDAP string, LDAP authentication uses the user name specified by the client to find the LDAP entry. •There must be an LDAP directory entry for each user to be authenticated. •The server-side  authentication_ldap_sasl  plugin performs SASL-based LDAP authentication. For connections by accounts that use this plugin, client programs use the client-side authentication_ldap_sasl_client  plugin. The client-side and server-side SASL LDAP plugins use SASL messages for secure transmission of credentials within the LDAP protocol, to avoid sending the cleartext password between the MySQL client and server. •The server-side  authentication_ldap_simple  plugin performs simple LDAP authentication. For connections by accounts that use this plugin, client programs use the client-side mysql_clear_password  plugin, which sends the password to the server as cleartext. No password hashing or encryption is used, so a secure connection between the MySQL client and server is recommended to prevent password exposure. •TLS configuration: System variables are available to enable TLS and control CA configuration, such as  authentication_ldap_simple_tls  and  authentication_ldap_simple_ca_path for simple LDAP authentication, and  authentication_ldap_sasl_tls  and authentication_ldap_sasl_ca_path  for SASL LDAP authentication. •LDAP referral. See LDAP Search Referral. •OpenLDAP library built-in defaults. •Configuration specified in the  ldap.conf  file. To disable use of this file, set the  LDAPNOINIT environment variable. •Configuration specified by the LDAP client. Using LDAP Pluggable Authentication