content_image/746853.jpg
4. bredon@MYSQL.LOCAL  is treated as a proxy for proxied_krb_user , and the following query returns output as shown: 

mysql> SELECT USER(), CURRENT_USER(), @@proxy_user; 

<img src='content_image/746853.jpg'>

The USER()  value indicates the user name used for the client command ( bredon@MYSQL.LOCAL ) and the host from which the client connected ( localhost ). 

The CURRENT_USER()  value is the full name of the proxied user account, which consists of the proxied_krb_user  user part and the %  host part. 

The @@proxy_user  value indicates the full name of the account used to make the connection to the MySQL server, which consists of the bredon@MYSQL.LOCAL  user part and the %  host part. 

This demonstrates that proxying occurs through the bredon@MYSQL.LOCAL  proxy user account, and that bredon@MYSQL.LOCAL  assumes the privileges granted to the proxied_krb_user  proxied user account. 

A TGT once obtained is cached on the client side and can be used until it expires without specifying the password again. However the TGT is obtained, the client-side plugin uses it to acquire service tickets and communicate with the server-side plugin. 

When the client-side plugin itself obtains the TGT, the client user may not want the TGT to be reused. As described in /etc/krb5.conf Client Configuration Parameters, the local /etc/krb5.conf  file can be used to cause the client-side plugin to destroy the TGT when done with it. 

The server-side plugin has no access to the TGT itself or the Kerberos password used to obtain it. 

The LDAP authentication plugins have no control over the caching mechanism (storage in a local file, in memory, and so forth), but Kerberos utilities such as kswitch  may be available for this purpose. 

## /etc/krb5.conf Client Configuration Parameters 

The client-side SASL LDAP plugin reads the local /etc/krb5.conf  file. If this file is missing or inaccessible, an error occurs. Assuming that the file is accessible, the optional [appdefaults]  section can be used to provide information used by the plugin. Place such information within the MySQL  part of the section. For example: 

[appdefaults] MySQL = { ldap_server_host = "ldap_host.example.com" ldap_destroy_tgt = true } 

The client-side plugin recognizes these parameters in the MySQL  section: 

•The ldap_server_host  value specifies the LDAP server host and can be useful when that host differs from the KDC server host specified in the [realms]  section. By default, the plugin uses the KDC server host as the LDAP server host. 

•The ldap_destroy_tgt  value indicates whether the client-side plugin destroys the TGT after obtaining and using it. By default, ldap_destroy_tgt  is false , but can be set to true  to avoid TGT reuse. (This setting applies only to TGTs created by the client-side plugin, not TGTs created externally to MySQL.) 

