content_image/730459.jpg content_image/730476.jpg content_image/730469.jpg
is mapped to one of those MySQL accounts, the privileges for which determine the database operations permitted to the external user. 

The procedure shown here uses Unix password authentication. To use LDAP instead, see the early steps of PAM LDAP Authentication without Proxy Users. 

<img src='content_image/730459.jpg'>

## Note 

Traditional Unix passwords are checked using the /etc/shadow  file. For information regarding possible issues related to this file, see PAM Authentication Access to Unix Password Store. 

1. Verify that Unix authentication permits logins to the operating system with the user name antonio  and password antonio_password . 

2. Verify that antonio  is a member of the root  or users  PAM group. 

3. Set up PAM to authenticate the mysql-unix  PAM service through operating system users by creating a file named /etc/pam.d/mysql-unix . The file contents are system dependent, so check existing login-related files in the /etc/pam.d  directory to see what they look like. On Linux, the mysql-unix file might look like this: 

<img src='content_image/730476.jpg'>

For macOS, use login  rather than password-auth . 

The PAM file format might differ on some systems. For example, on Ubuntu and other Debian-based systems, use these file contents instead: 

@include common-auth @include common-account @include common-session-noninteractive 

4. Create a default proxy user ( ’’@’’ ) that maps external PAM users to the proxied accounts: 

CREATE USER ’’@’’ IDENTIFIED WITH authentication_pam AS ’mysql-unix, root=developer, users=data_entry’; 

Here, the authentication string contains the PAM service name, mysql-unix , which authenticates Unix passwords. The authentication string also maps external users in the root  and users  PAM groups to the developer  and data_entry  MySQL user names, respectively. 

The PAM group mapping list following the PAM service name is required when you set up proxy users. Otherwise, the plugin cannot tell how to perform mapping from external user names to the proper proxied MySQL user names. 

<img src='content_image/730469.jpg'>

## Note 

If your MySQL installation has anonymous users, they might conflict with the default proxy user. For more information about this issue, and ways of dealing with it, see Default Proxy User and Anonymous User Conflicts. 

5. Create the proxied accounts and grant to each one the privileges it should have: 

CREATE USER ’developer’@’localhost’ IDENTIFIED WITH mysql_no_login; CREATE USER ’data_entry’@’localhost’ 

