IDENTIFIED WITH mysql_no_login; GRANT ALL PRIVILEGES ON mydevdb.* TO ’developer’@’localhost’; GRANT ALL PRIVILEGES ON mydb.* TO ’data_entry’@’localhost’; GRANT PROXY ON ’developer’@’localhost’ TO ’’@’’; GRANT PROXY ON ’data_entry’@’localhost’ TO ’’@’’; shell>  mysql --user=antonio --password --enable-cleartext-plugin Enter password:  antonio_password mysql>  SELECT USER(), CURRENT_USER(), @@proxy_user; +-------------------+---------------------+--------------+ | USER() | CURRENT_USER() | @@proxy_user | +-------------------+---------------------+--------------+ | antonio@localhost | developer@localhost | ’’@’’ | +-------------------+---------------------+--------------+ mysql>  SELECT USER(), CURRENT_USER(), @@proxy_user; +-------------------+----------------------+--------------+ | USER() | CURRENT_USER() | @@proxy_user | +-------------------+----------------------+--------------+ | antonio@localhost | data_entry@localhost | ’’@’’ | +-------------------+----------------------+--------------+ This demonstrates that the  antonio  operating system user is authenticated to have the privileges of the  data_entry  MySQL user, and that proxying occurs through the default proxy account. If  antonio  is not a member of the  root  PAM group but is a member of the  users  PAM group, a similar process occurs, but the plugin maps  user  PAM group membership to the  data_entry  MySQL user name and returns that name to the server: This demonstrates that the  antonio  operating system user is authenticated to have the privileges granted to the  developer  MySQL user, and that proxying occurs through the default proxy account. The server authenticates the connection using the default  ’’@’’  proxy account. The resulting privileges for  antonio  depend on which PAM groups  antonio  is a member of. If  antonio  is a member of the  root  PAM group, the PAM plugin maps  root  to the  developer  MySQL user name and returns that name to the server. The server verifies that  ’’@’’  has the  PROXY  privilege for developer  and permits the connection. The following query returns output as shown: 1326 The proxied accounts use the  mysql_no_login  authentication plugin to prevent clients from using the accounts to log in directly to the MySQL server. Instead, users who authenticate using PAM are expected to use the  developer  or  data_entry  account by proxy based on their PAM group. (This assumes that the plugin is installed. For instructions, see Section 6.4.1.8, “No-Login Pluggable Authentication” .) For alternative methods of protecting proxied accounts against direct use, see Preventing Direct Login to Proxied Accounts. 7. Use the  mysql  command-line client to connect to the MySQL server as  antonio . 6. Grant to the proxy account the  PROXY  privilege for each proxied account: Authentication Plugins