IDENTIFIED WITH mysql_no_login; GRANT ALL PRIVILEGES ON mydevdb.* TO ’developer’@’localhost’; GRANT ALL PRIVILEGES ON mydb.* TO ’data_entry’@’localhost’; 

The proxied accounts use the mysql_no_login  authentication plugin to prevent clients from using the accounts to log in directly to the MySQL server. Instead, users who authenticate using PAM are expected to use the developer  or data_entry  account by proxy based on their PAM group. (This assumes that the plugin is installed. For instructions, see Section 6.4.1.8, “No-Login Pluggable Authentication” .) For alternative methods of protecting proxied accounts against direct use, see Preventing Direct Login to Proxied Accounts. 

6. Grant to the proxy account the PROXY  privilege for each proxied account: 

GRANT PROXY ON ’developer’@’localhost’ TO ’’@’’; GRANT PROXY ON ’data_entry’@’localhost’ TO ’’@’’; 

7. Use the mysql  command-line client to connect to the MySQL server as antonio . 

shell> mysql --user=antonio --password --enable-cleartext-plugin Enter password: antonio_password 

The server authenticates the connection using the default ’’@’’  proxy account. The resulting privileges for antonio  depend on which PAM groups antonio  is a member of. If antonio  is a member of the root  PAM group, the PAM plugin maps root  to the developer  MySQL user name and returns that name to the server. The server verifies that ’’@’’  has the PROXY  privilege for developer  and permits the connection. The following query returns output as shown: 

mysql> SELECT USER(), CURRENT_USER(), @@proxy_user; +-------------------+---------------------+--------------+ | USER() | CURRENT_USER() | @@proxy_user | +-------------------+---------------------+--------------+ | antonio@localhost | developer@localhost | ’’@’’ | +-------------------+---------------------+--------------+ 

This demonstrates that the antonio  operating system user is authenticated to have the privileges granted to the developer  MySQL user, and that proxying occurs through the default proxy account. 

If antonio  is not a member of the root  PAM group but is a member of the users  PAM group, a similar process occurs, but the plugin maps user  PAM group membership to the data_entry  MySQL user name and returns that name to the server: 

mysql> SELECT USER(), CURRENT_USER(), @@proxy_user; +-------------------+----------------------+--------------+ | USER() | CURRENT_USER() | @@proxy_user | +-------------------+----------------------+--------------+ | antonio@localhost | data_entry@localhost | ’’@’’ | +-------------------+----------------------+--------------+ 

This demonstrates that the antonio  operating system user is authenticated to have the privileges of the data_entry  MySQL user, and that proxying occurs through the default proxy account. 

