Authentication Plugins Use the MySQL Account to Connect to the MySQL Server The proxied account uses the  mysql_no_login  authentication plugin to prevent clients from using the account to log in directly to the MySQL server. Instead, it is expected that users who authenticate using LDAP use the  bredon@MYSQL.LOCAL  proxy account. (This assumes that the  mysql_no_login  plugin is installed. For instructions, see Section 6.4.1.8, “No-Login Pluggable Authentication” .) For alternative methods of protecting proxied accounts against direct use, see Preventing Direct Login to Proxied Accounts. After a MySQL account that uses GSSAPI/Kerberos has been set up, clients can authenticate to Kerberos and use the account to connect to the MySQL server. Kerberos authentication can take place either prior to or at the time of MySQL client program invocation: If you are uncertain whether a TGT exists, you can use  klist  to check. Authentication occurs as follows: 1351 3. The group mapping information in the proxy account authentication string ( ’#krb_grp=proxied_krb_user’ ) indicates that the authenticated proxied user should be proxied_krb_user . 2. The server finds the LDAP entry for the principal and uses it to authenticate the connection for the bredon@MYSQL.LOCAL  MySQL proxy account. 1. The client uses the TGT to authenticate using Kerberos. •If the client command specifies no principal name as the user name and the client-side plugin finds the Kerberos cache empty because there is no TGT, authentication fails. •If there is no TGT, the client-side SASL LDAP authentication plugin itself can obtain the TGT from the KDC. In this case, to invoke the client, specify the name and password of the Kerberos principal associated with the MySQL account (enter the command on a single line, then enter the principal password at the prompt): •If the command includes a password, the password is ignored. Because authentication is based on the TGT, it can succeed  even if the user-provided password is incorrect . For this reason, the plugin produces a warning if a valid TGT is found that causes a password to be ignored. •If the command includes a user name, authentication fails if that name does not match the principal name in the TGT. If the MySQL client command does include credentials, they are handled as follows: •The client user can obtain a TGT independently of MySQL prior to invoking the MySQL client program. For example, the client user can use  kinit  to authenticate to Kerberos by providing a Kerberos principal name and the principal password. The TGT is cached and becomes available for use by other Kerberos-aware applications, such as the client-side SASL LDAP authentication plugin. In this case, the MySQL client program authenticates to the MySQL server using the TGT, so invoke the client without specifying a user name or password: shell>  kinit bredon@MYSQL.LOCAL Password for bredon@MYSQL.LOCAL:  (enter password here) shell>  mysql --default-auth=authentication_ldap_sasl_client shell>  mysql --default-auth=authentication_ldap_sasl_client --user=bredon@MYSQL.LOCAL --password Enter password:  (enter password here)