1353 Authentication Plugins LDAP Search Referral 6.4.1.8 No-Login Pluggable Authentication dn: dc=subtree,dc=example,dc=com objectClass: referral objectClass: extensibleObject dc: subtree ref: ldap://b.example.com/dc=subtree,dc=example,dc=com An LDAP server can be configured to delegate LDAP searches to another LDAP server, a functionality known as LDAP referral. Suppose that the server  a.example.com  holds a  "dc=example,dc=com"  root DN and wishes to delegate searches to another server  b.example.com . To enable this,  a.example.com would be configured with a named referral object having these attributes: An issue with enabling LDAP referral is that searches can fail with LDAP operation errors when the search base DN is the root DN, and referral objects are not set. A MySQL DBA might wish to avoid such referral errors for the LDAP authentication plugins, even though LDAP referral might be set globally in the  ldap.conf  configuration file. To configure on a plugin-specific basis whether the LDAP server should use LDAP referral when communicating with each plugin, set the authentication_ldap_simple_referral  and  authentication_ldap_sasl_referral  system variables. Setting either variable to  ON  or  OFF  causes the corresponding LDAP authentication plugin to tell the LDAP server whether to use referral during MySQL authentication. Each variable has a plugin-specific effect and does not affect other applications that communicate with the LDAP server. Both variables are OFF  by default. The  mysql_no_login  server-side authentication plugin prevents all client connections to any account that uses it. Use cases for this plugin include: The following table shows the plugin and library file names. The file name suffix might differ on your system. The file must be located in the directory named by the  plugin_dir  system variable. The following sections provide installation and usage information specific to no-login pluggable authentication: For general information about pluggable authentication in MySQL, see Section 6.2.17, “Pluggable Authentication” . For proxy user information, see Section 6.2.18, “Proxy Users” . •Uninstalling No-Login Pluggable Authentication •Using No-Login Pluggable Authentication •Installing No-Login Pluggable Authentication Table 6.20 Plugin and Library Names for No-Login Authentication •Proxied accounts that should never permit direct login but are intended to be accessed only through proxy accounts. •Accounts that must be able to execute stored programs and views with elevated privileges without exposing those privileges to ordinary users. Plugin or File Plugin or File Name Server-side plugin mysql_no_login Client-side plugin None Library file mysql_no_login.so