Authentication Plugins For simple LDAP authentication, the base distinguished name (DN). This variable can be used to limit the scope of searches by anchoring them at a certain location (the “base” ) within the search tree. Suppose that members of one set of LDAP user entries each have this form: And that members of another set of LDAP user entries each have this form: Then searches work like this for different base DN values: In general, more specific base DN values result in faster searches because they limit the search scope more. For simple LDAP authentication, the root distinguished name (DN). This variable is used in conjunction with  authentication_ldap_simple_bind_root_pwd  as the credentials for authenticating to the LDAP server for the purpose of performing searches. Authentication uses either one or two LDAP bind operations, depending on whether the MySQL account names an LDAP user DN: •If the base DN is  ou=People,dc=example,dc=com : Searches find user entries only in the first set. •If the base DN is  ou=Admin,dc=example,dc=com : Searches find user entries only in the second set. •If the base DN is  ou=dc=example,dc=com : Searches find user entries in the first or second set. • authentication_ldap_simple_bind_root_dn •If the account does not name a user DN:  authentication_ldap_simple  performs an initial LDAP binding using  authentication_ldap_simple_bind_root_dn  and authentication_ldap_simple_bind_root_pwd . (These are both empty by default, so if they are not set, the LDAP server must permit anonymous connections.) The resulting bind LDAP handle is used to search for the user DN, based on the client user name.  authentication_ldap_simple performs a second bind using the user DN and client-supplied password. •If the account does name a user DN: The first bind operation is unnecessary in this case. authentication_ldap_simple  performs a single bind using the user DN and client-supplied password. This is faster than if the MySQL account does not specify an LDAP user DN. uid= user_name ,ou=People,dc=example,dc=com uid= user_name ,ou=Admin,dc=example,dc=com Default Value NULL Command-Line Format --authentication-ldap-simple-bind- root-dn=value System Variable authentication_ldap_simple_bind_root_dn Scope Global Dynamic Yes SET_VAR  Hint Applies No Type String Default Value NULL 1371