Authentication Plugins shell>  mysql --user=boris --password Enter password:  boris_password (boris_ldap LDAP password) CREATE USER ’’@’%’ IDENTIFIED WITH authentication_ldap_sasl; 1342 The proxy account definition has no  AS ’ auth_string ’  clause to name an LDAP user DN. Thus: Create the default proxy MySQL account: At connect time, the group attribute values become the authenticated user names, so they name the accounting  and  front_office  proxied accounts. The instructions here assume the following scenario: The proxying implementation described here is based on use of LDAP group attribute values to map connecting MySQL users who authenticate using LDAP onto other MySQL accounts that define different sets of privileges. Users do not connect directly through the accounts that define the privileges. Instead, they connect through a default proxy account authenticated with LDAP, such that all external logins are mapped to the proxied MySQL accounts that hold the privileges. Any user who connects using the proxy account is mapped to one of those proxied MySQL accounts, the privileges for which determine the database operations permitted to the external user. LDAP authentication plugins support proxying, enabling a user to connect to the MySQL server as one user but assume the privileges of a different user. This section describes basic LDAP plugin proxy support. The LDAP plugins also support specification of group preference and proxy user mapping; see LDAP Authentication Group Preference and Mapping Specification. The authentication process for  boris  is similar to that previously described for  betsy  with simple LDAP authentication, except that the client-side and server-side SASL LDAP plugins use SASL messages for secure transmission of credentials within the LDAP protocol, to avoid sending the cleartext password between the MySQL client and server. For the server-side  authentication_ldap_sasl  plugin, clients use the client-side authentication_ldap_sasl_client  plugin. If a client program does not find the client-side plugin, specify a  --plugin-dir  option that names the directory where the plugin library file is installed. LDAP Authentication with Proxying •The examples assume use of SASL LDAP authentication. Make the appropriate adjustments for simple LDAP authentication. •These LDAP entries are available in the directory managed by the LDAP server, to provide distinguished name values that uniquely identify each user: •For the  authentication_ldap_sasl  plugin: Set authentication_ldap_sasl_user_search_attr  and authentication_ldap_sasl_group_search_attr . •For the  authentication_ldap_simple  plugin: Set authentication_ldap_simple_user_search_attr  and authentication_ldap_simple_group_search_attr . •LDAP entries use the  uid  and  cn  attributes to specify user name and group values, respectively. To use different user and group attribute names, set the appropriate plugin-specific system variables: uid=basha,ou=People,dc=example,dc=com,cn=accounting uid=basil,ou=People,dc=example,dc=com,cn=front_office