content_image/825102.jpg
authentication_ldap_simple  plugin, invoke client programs with the --enable-cleartext- plugin  option to enable the client-side mysql_clear_password  plugin. 

The instructions here assume the following scenario: 

•MySQL users betsy  and boris  authenticate to the LDAP entries for betsy_ldap  and boris_ldap , respectively. (It is not necessary that the MySQL and LDAP user names differ. The use of different names in this discussion helps clarify whether an operation context is MySQL or LDAP.) 

•LDAP entries use the uid  attribute to specify user names. This may vary depending on LDAP server. Some LDAP servers use the cn  attribute for user names rather than uid . To change the attribute, modify the authentication_ldap_simple_user_search_attr  or authentication_ldap_sasl_user_search_attr  system variable appropriately. 

•These LDAP entries are available in the directory managed by the LDAP server, to provide distinguished name values that uniquely identify each user: 

uid=betsy_ldap,ou=People,dc=example,dc=com uid=boris_ldap,ou=People,dc=example,dc=com 

• CREATE USER  statements that create MySQL accounts name an LDAP user in the BY  clause, to indicate which LDAP entry the MySQL account authenticates against. 

The instructions for setting up an account that uses LDAP authentication depend on which server-side LDAP plugin is used. The following sections describe several usage scenarios. 

## Simple LDAP Authentication 

To configure a MySQL account for simple LDAP authentication, the CREATE USER  statement specifies the authentication_ldap_simple  plugin, and optionally names the LDAP user distinguished name (DN): 

CREATE USER user IDENTIFIED WITH authentication_ldap_simple [BY ’ LDAP user DN ’]; 

Suppose that MySQL user betsy  has this entry in the LDAP directory: 

uid=betsy_ldap,ou=People,dc=example,dc=com 

Then the statement to create the MySQL account for betsy  looks like this: 

CREATE USER ’betsy’@’localhost’ IDENTIFIED WITH authentication_ldap_simple AS ’uid=betsy_ldap,ou=People,dc=example,dc=com’; 

The authentication string specified in the BY  clause does not include the LDAP password. That must be provided by the client user at connect time. 

Clients connect to the MySQL server by providing the MySQL user name and LDAP password, and by enabling the client-side mysql_clear_password  plugin: 

shell> mysql --user=betsy --password --enable-cleartext-plugin Enter password: betsy_password (betsy_ldap LDAP password) 

<img src='content_image/825102.jpg'>

## Note 

The client-side mysql_clear_password  authentication plugin leaves the password untouched, so client programs send it to the MySQL server as cleartext. This enables the password to be passed as is to the LDAP server. A cleartext password is necessary to use the server-side LDAP library without SASL, but may be a security problem in some configurations. These measures minimize the risk: 

