Authentication Plugins • SCRAM-SHA-256 : Use a SASL challenge-response mechanism. • GSSAPI : Use Kerberos, a passwordless and ticket-based protocol. • authentication_ldap_sasl_bind_base_dn •If the base DN is  ou=dc=example,dc=com : Searches find user entries in the first or second set. •If the base DN is  ou=Admin,dc=example,dc=com : Searches find user entries only in the second set. •If the base DN is  ou=People,dc=example,dc=com : Searches find user entries only in the first set. This method is similar to  SCRAM-SHA-1 , but is more secure. It is available in MySQL 8.0.23 and higher. It requires an OpenLDAP server built using Cyrus SASL 2.1.27 or higher. GSSAPI/Kerberos is supported as an authentication method for MySQL clients and servers only on Linux. It is useful in Linux environments where applications access LDAP using Microsoft Active Directory, which has Kerberos enabled by default. The client-side  authentication_ldap_sasl_client  plugin obtains a service ticket using the ticket-granting ticket (TGT) from Kerberos, but does not use LDAP services directly. The server-side authentication_ldap_sasl  plugin routes Kerberos messages between the client-side plugin and the LDAP server. Using the credentials thus obtained, the server-side plugin then communicates with the LDAP server to interpret LDAP authentication messages and retrieve LDAP groups. For SASL LDAP authentication, the base distinguished name (DN). This variable can be used to limit the scope of searches by anchoring them at a certain location (the “base” ) within the search tree. Suppose that members of one set of LDAP user entries each have this form: uid= user_name ,ou=People,dc=example,dc=com And that members of another set of LDAP user entries each have this form: uid= user_name ,ou=Admin,dc=example,dc=com Then searches work like this for different base DN values: In general, more specific base DN values result in faster searches because they limit the search scope more. 1362 Command-Line Format --authentication-ldap-sasl-bind-base- dn=value System Variable authentication_ldap_sasl_bind_base_dn Scope Global Dynamic Yes SET_VAR  Hint Applies No Type String Default Value NULL