Authentication Plugins • authentication_ldap_sasl_bind_root_dn Command-Line Format --authentication-ldap-sasl-bind-root- dn=value System Variable authentication_ldap_sasl_bind_root_dn Scope Global Dynamic Yes SET_VAR  Hint Applies No Type String Default Value NULL For SASL LDAP authentication, the root distinguished name (DN). This variable is used in conjunction with  authentication_ldap_sasl_bind_root_pwd  as the credentials for authenticating to the LDAP server for the purpose of performing searches. Authentication uses either one or two LDAP bind operations, depending on whether the MySQL account names an LDAP user DN: •If the account does not name a user DN:  authentication_ldap_sasl  performs an initial LDAP binding using  authentication_ldap_sasl_bind_root_dn  and authentication_ldap_sasl_bind_root_pwd . (These are both empty by default, so if they are not set, the LDAP server must permit anonymous connections.) The resulting bind LDAP handle is used to search for the user DN, based on the client user name.  authentication_ldap_sasl performs a second bind using the user DN and client-supplied password. •If the account does name a user DN: The first bind operation is unnecessary in this case. authentication_ldap_sasl  performs a single bind using the user DN and client-supplied password. This is faster than if the MySQL account does not specify an LDAP user DN. • authentication_ldap_sasl_bind_root_pwd Command-Line Format --authentication-ldap-sasl-bind-root- pwd=value System Variable authentication_ldap_sasl_bind_root_pwd Scope Global Dynamic Yes SET_VAR  Hint Applies No Type String Default Value NULL For SASL LDAP authentication, the password for the root distinguished name. This variable is used in conjunction with  authentication_ldap_sasl_bind_root_dn . See the description of that variable. • authentication_ldap_sasl_ca_path Command-Line Format --authentication-ldap-sasl-ca- path=value System Variable authentication_ldap_sasl_ca_path Scope Global Dynamic Yes 1363