Authentication Plugins Configure the Server-Side SASL LDAP Authentication Plugin for GSSAPI/Kerberos Assuming that the LDAP server is accessible through Kerberos as just described, configure the server- side SASL LDAP authentication plugin to use the GSSAPI/Kerberos authentication method. (For general LDAP plugin installation information, see Installing LDAP Pluggable Authentication.) Here is an example of plugin-related settings the server  my.cnf  file might contain: [mysqld] plugin-load-add=authentication_ldap_sasl.so authentication_ldap_sasl_auth_method_name="GSSAPI" authentication_ldap_sasl_server_host=198.51.100.10 authentication_ldap_sasl_server_port=389 authentication_ldap_sasl_bind_root_dn="cn=admin,cn=users,dc=MYSQL,dc=LOCAL" authentication_ldap_sasl_bind_root_pwd=" password " authentication_ldap_sasl_bind_base_dn="cn=users,dc=MYSQL,dc=LOCAL" authentication_ldap_sasl_user_search_attr="sAMAccountName" Those option file settings configure the SASL LDAP plugin as follows: •The  --plugin-load-add  option loads the plugin (adjust the  .so  suffix for your platform as necessary). If you loaded the plugin previously using an  INSTALL PLUGIN  statement, this option is unnecessary. • authentication_ldap_sasl_auth_method_name  must be set to  GSSAPI  to use GSSAPI/Kerberos as the SASL LDAP authentication method. • authentication_ldap_sasl_server_host  and  authentication_ldap_sasl_server_port indicate the IP address and port number of the Active Directory server host for authentication. • authentication_ldap_sasl_bind_root_dn  and authentication_ldap_sasl_bind_root_pwd  configure the root DN and password for group search capability. This capability is required, but users may not have privileges to search. In such cases, it is necessary to provide root DN information: •In the DN option value,  admin  should be the name of an administrative LDAP account that has privileges to perform user searches. •In the password option value,  password  should be the  admin  account password. • authentication_ldap_sasl_bind_base_dn  indicates the user DN base path, so that searches look for users in the  MYSQL.LOCAL  domain. • authentication_ldap_sasl_user_search_attr  specifies a standard Active Directory search attribute,  sAMAccountName . This attribute is used in searches to match logon names; attribute values are not the same as the user DN values. Create a MySQL Account That Uses GSSAPI/Kerberos MySQL authentication using the SASL LDAP authentication plugin with the GSSAPI/Kerberos method is based on a user that is a Kerberos principal. The following discussion uses a principal named bredon@MYSQL.LOCAL  as this user, which must be registered in several places: •The Kerberos admininistrator should register the user name as a Kerberos principal. This name should include a domain name. The principal name and password are used by clients to authenticate with Kerberos and obtain a TGT. •The LDAP administrator should register the user name in an LDAP entry. For example: uid=bredon,dc=MYSQL,dc=LOCAL 1349