Authentication Plugins If your MySQL installation has anonymous users, they might conflict with the default proxy user. For more information about this issue, and ways of dealing with it, see Default Proxy User and Anonymous User Conflicts. Create the proxied accounts and grant to each one the privileges it should have: The proxied accounts use the  mysql_no_login  authentication plugin to prevent clients from using the accounts to log in directly to the MySQL server. Instead, users who authenticate using LDAP are expected to use the default  ’’@’%’  proxy account. (This assumes that the  mysql_no_login  plugin is installed. For instructions, see Section 6.4.1.8, “No-Login Pluggable Authentication” .) For alternative methods of protecting proxied accounts against direct use, see Preventing Direct Login to Proxied Accounts. Grant to the proxy account the  PROXY  privilege for each proxied account: Use the  mysql  command-line client to connect to the MySQL server as  basha . shell>  mysql --user=basha --password Enter password:  basha_password (basha LDAP password) Authentication occurs as follows: uid=basha,ou=People,dc=example,dc=com,cn=accounting mysql>  SELECT USER(), CURRENT_USER(), @@proxy_user; 1343 4. The authenticated user differs from the client user name  basha , with the result that  basha  is treated as a proxy for  accounting , and  basha  assumes the privileges of the proxied  accounting  account. The following query returns output as shown: 3. The matching LDAP entry has group attribute  cn=accounting , so  accounting  becomes the authenticated proxied user. 2. The matching LDAP entry is: 1. The server authenticates the connection using the default  ’’@’%’  proxy account, for client user basha . •The matching LDAP entry is expected to include a group attribute naming the proxied MySQL account that defines the privileges the client should have. •When a client connects, the client user name becomes the LDAP user name to search for. Note CREATE USER ’accounting’@’localhost’ IDENTIFIED WITH mysql_no_login; CREATE USER ’front_office’@’localhost’ IDENTIFIED WITH mysql_no_login; GRANT ALL PRIVILEGES ON accountingdb.* TO ’accounting’@’localhost’; GRANT ALL PRIVILEGES ON frontdb.* TO ’front_office’@’localhost’; GRANT PROXY ON ’accounting’@’localhost’ TO ’’@’%’; GRANT PROXY ON ’front_office’@’localhost’ TO ’’@’%’;