Authentication Plugins •Configure the Server-Side SASL LDAP Authentication Plugin for GSSAPI/Kerberos •Create a MySQL Account That Uses GSSAPI/Kerberos •Use the MySQL Account to Connect to the MySQL Server •/etc/krb5.conf Client Configuration Parameters Check the Kerberos Setup The following example shows how to test availability of Kerberos in Active Directory. The example makes these assumptions: •Active Directory is running on the host named  ldap_auth.example.com  with IP address 198.51.100.10 . •MySQL-related Kerberos authentication and LDAP lookups use the  MYSQL.LOCAL  domain. •A principal named  bredon@MYSQL.LOCAL  is registered with the KDC. (In later discussion, this principal name is also used for the MySQL user that authenticates to the MySQL server using GSSAPI/Kerberos.) With those assumptions satisfied, follow this procedure: 1. Verify that the Kerberos library is installed and configured correctly in the operating system. For example, to configure a  MYSQL.LOCAL  domain for use during MySQL authentication, the  /etc/ krb5.conf  Kerberos configuration file should contain something like this: [realms] MYSQL.LOCAL = { kdc = ldap_auth.example.com admin_server = ldap_auth.example.com default_domain = MYSQL.LOCAL } 2. You may need to add an entry to  /etc/hosts  for the server host: 3. Check whether Kerberos authentication works correctly: 198.51.100.10 ldap_auth ldap_auth.example.com kinit bredon@MYSQL.LOCAL a. Use  kinit  to authenticate to Kerberos: The command authenticates for the Kerberos principal named  bredon@MYSQL.LOCAL . Enter the principal’s password when the command prompts for it. The KDC returns a TGT that is cached on the client side for use by other Kerberos-aware applications. b. Use  klist  to check whether the TGT was obtained correctly. The output should be similar to this: Ticket cache: FILE:/tmp/krb5cc_244306 Default principal: bredon@MYSQL.LOCAL Valid starting Expires Service principal 03/23/2020 08:18:33 03/23/2020 18:18:33 krbtgt/MYSQL.LOCAL@MYSQL.LOCAL 4. Check whether  ldapsearch  works with the Kerberos TGT using this command, which searches for users in the  MYSQL.LOCAL  domain: ldapsearch -h 198.51.100.10 -Y GSSAPI -b "dc=MYSQL,dc=LOCAL" 1348