•Configure the Server-Side SASL LDAP Authentication Plugin for GSSAPI/Kerberos 

## Check the Kerberos Setup 

•Create a MySQL Account That Uses GSSAPI/Kerberos 

•Use the MySQL Account to Connect to the MySQL Server 

•/etc/krb5.conf Client Configuration Parameters 

The following example shows how to test availability of Kerberos in Active Directory. The example makes these assumptions: 

•Active Directory is running on the host named ldap_auth.example.com  with IP address 198.51.100.10 . 

•MySQL-related Kerberos authentication and LDAP lookups use the MYSQL.LOCAL  domain. 

•A principal named bredon@MYSQL.LOCAL  is registered with the KDC. (In later discussion, this principal name is also used for the MySQL user that authenticates to the MySQL server using GSSAPI/Kerberos.) 

With those assumptions satisfied, follow this procedure: 

1. Verify that the Kerberos library is installed and configured correctly in the operating system. For example, to configure a MYSQL.LOCAL  domain for use during MySQL authentication, the /etc/ krb5.conf  Kerberos configuration file should contain something like this: 

[realms] MYSQL.LOCAL = { kdc = ldap_auth.example.com admin_server = ldap_auth.example.com default_domain = MYSQL.LOCAL } 

2. You may need to add an entry to /etc/hosts  for the server host: 

198.51.100.10 ldap_auth ldap_auth.example.com 

3. Check whether Kerberos authentication works correctly: 

a. Use kinit  to authenticate to Kerberos: 

kinit bredon@MYSQL.LOCAL 

The command authenticates for the Kerberos principal named bredon@MYSQL.LOCAL . Enter the principal’s password when the command prompts for it. The KDC returns a TGT that is cached on the client side for use by other Kerberos-aware applications. 

b. Use klist  to check whether the TGT was obtained correctly. The output should be similar to this: 

Ticket cache: FILE:/tmp/krb5cc_244306 Default principal: bredon@MYSQL.LOCAL Valid starting Expires Service principal 03/23/2020 08:18:33 03/23/2020 18:18:33 krbtgt/MYSQL.LOCAL@MYSQL.LOCAL 

4. Check whether ldapsearch  works with the Kerberos TGT using this command, which searches for users in the MYSQL.LOCAL  domain: 

ldapsearch -h 198.51.100.10 -Y GSSAPI -b "dc=MYSQL,dc=LOCAL" 

