Authentication Plugins user name, host name, password, and authentication string). When you define a MySQL account that authenticates using PAM, the authentication string contains: This section describes how to install the PAM authentication plugin. For general information about installing plugins, see Section 5.6.1, “Installing and Uninstalling Plugins” . To be usable by the server, the plugin library file must be located in the MySQL plugin directory (the directory named by the  plugin_dir  system variable). If necessary, configure the plugin directory location by setting the value of  plugin_dir  at server startup. The plugin library file base name is  authentication_pam . The file name suffix differs per platform (for example,  .so  for Unix and Unix-like systems,  .dll  for Windows). To load the plugin at server startup, use the  --plugin-load-add  option to name the library file that contains it. With this plugin-loading method, the option must be given each time the server starts. For example, put these lines in the server  my.cnf  file, adjusting the  .so  suffix for your platform as necessary: After modifying  my.cnf , restart the server to cause the new settings to take effect. [mysqld] plugin-load-add=authentication_pam.so 1319 •A PAM service name, which is a name that the system administrator can use to refer to an authentication method for a particular application. There can be multiple applications associated with a single database server instance, so the choice of service name is left to the SQL application developer. •Optionally, if proxying is to be used, a mapping from PAM groups to MySQL user names. 3. The plugin uses the PAM service named in the authentication string to check the user credentials and returns  ’Authentication succeeded, Username is  user_name ’  or  ’Authentication failed’ . The password must be appropriate for the password store used by the PAM service. Examples: •For traditional Unix passwords, the service looks up passwords stored in the  /etc/shadow  file. •For LDAP, the service looks up passwords stored in an LDAP directory. 4. Otherwise, the authentication string indicates whether proxying occurs. If the string contains no PAM group mapping, proxying does not occur. In this case, the MySQL user name is the same as the external user name. If the credentials check fails, the server refuses the connection. 5. Otherwise, proxying is indicated based on the PAM group mapping, with the MySQL user name determined based on the first matching group in the mapping list. The meaning of “PAM group” depends on the PAM service. Examples: •For traditional Unix passwords, groups are Unix groups defined in the  /etc/group  file, possibly supplemented with additional PAM information in a file such as  /etc/security/group.conf . •For LDAP, groups are LDAP groups defined in an LDAP directory. If the proxy user (the external user) has the  PROXY  privilege for the proxied MySQL user name, proxying occurs, with the proxy user assuming the privileges of the proxied user. Installing PAM Pluggable Authentication