Authentication Plugins +-----------------+----------------------+--------------+ | USER() | CURRENT_USER() | @@proxy_user | +-----------------+----------------------+--------------+ | basha@localhost | accounting@localhost | ’’@’%’ | +-----------------+----------------------+--------------+ This demonstrates that  basha  uses the privileges granted to the proxied  accounting  MySQL account, and that proxying occurs through the default proxy user account. Now connect as  basil  instead: shell>  mysql --user=basil --password Enter password:  basil_password (basil LDAP password) The authentication process for  basil  is similar to that previously described for  basha : This demonstrates that  basil  uses the privileges granted to the proxied  front_office  MySQL account, and that proxying occurs through the default proxy user account. As described in LDAP Authentication with Proxying, basic LDAP authentication proxying works by the principle that the plugin uses the first group name returned by the LDAP server as the MySQL proxied user account name. This simple capability does not enable specifying any preference about which group name to use if the LDAP server returns multiple group names, or specifying any name other than the group name as the proxied user name. As of MySQL 8.0.14, for MySQL accounts that use LDAP authentication, the authentication string can specify the following information to enable greater proxying flexibility: Consider the following MySQL proxy account definition: 1. The server authenticates the connection using the default  ’’@’%’  proxy account, for client user basil . 2. The matching LDAP entry is: 3. The matching LDAP entry has group attribute  cn=front_office , so  front_office  becomes the authenticated proxied user. 4. The authenticated user differs from the client user name  basil , with the result that  basil  is treated as a proxy for  front_office , and  basil  assumes the privileges of the proxied  front_office account. The following query returns output as shown: uid=basil,ou=People,dc=example,dc=com,cn=front_office mysql>  SELECT USER(), CURRENT_USER(), @@proxy_user; +-----------------+------------------------+--------------+ | USER() | CURRENT_USER() | @@proxy_user | +-----------------+------------------------+--------------+ | basil@localhost | front_office@localhost | ’’@’%’ | +-----------------+------------------------+--------------+ •A list of groups in preference order, such that the plugin uses the first group name in the list that matches a group returned by the LDAP server. •A mapping from group names to proxied user names, such that a group name when matched can provide a specified name to use as the proxied user. This provides an alternative to using the group name as the proxied user. LDAP Authentication Group Preference and Mapping Specification CREATE USER ’’@’%’ 1344