content_image/674881.jpg content_image/674882.jpg content_image/674883.jpg content_image/674884.jpg content_image/674880.jpg
GRANT PROXY ON local_dev TO win_proxy; GRANT PROXY ON local_admin TO win_proxy; 

Now the Windows users local_user  and MyDomain\domain_user  can connect to the MySQL server as win_proxy  and when authenticated have the privileges of the account given in the authentication string (in this case, local_wlad ). A user in the MyDomain\Developers  group who connects as win_proxy  has the privileges of the local_dev  account. A user in the BUILTIN\Administrators group has the privileges of the local_admin  account. 

To configure authentication so that all Windows users who do not have their own MySQL account go through a proxy account, substitute the default proxy account ( ’’@’’ ) for win_proxy  in the preceding instructions. For information about default proxy accounts, see Section 6.2.18, “Proxy Users” . 

<img src='content_image/674881.jpg'>

<img src='content_image/674882.jpg'>

## Note 

If your MySQL installation has anonymous users, they might conflict with the default proxy user. For more information about this issue, and ways of dealing with it, see Default Proxy User and Anonymous User Conflicts. 

To use the Windows authentication plugin with Connector/NET connection strings in Connector/NET 6.4.4 and higher, see Using the Windows Native Authentication Plugin. 

## 6.4.1.7 LDAP Pluggable Authentication 

<img src='content_image/674883.jpg'>

<img src='content_image/674884.jpg'>

## Note 

LDAP pluggable authentication is an extension included in MySQL Enterprise Edition, a commercial product. To learn more about commercial products, see https://www.mysql.com/products/. 

MySQL Enterprise Edition supports an authentication method that enables MySQL Server to use LDAP (Lightweight Directory Access Protocol) to authenticate MySQL users by accessing directory services such as X.500. MySQL uses LDAP to fetch user, credential, and group information. 

LDAP pluggable authentication provides these capabilities: 

•External authentication: LDAP authentication enables MySQL Server to accept connections from users defined outside the MySQL grant tables in LDAP directories. 

•Proxy user support: LDAP authentication can return to MySQL a user name different from the external user name passed by the client program, based on the LDAP groups the external user is a member of. This means that an LDAP plugin can return the MySQL user that defines the privileges the external LDAP-authenticated user should have. For example, an LDAP user named joe  can connect and have the privileges of a MySQL user named developer , if the LDAP group for joe  is developer . 

•Security: Using TLS, connections to the LDAP server can be secure. 

The following tables show the plugin and library file names for simple and SASL-based LDAP authentication. The file name suffix might differ on your system. The files must be located in the directory named by the plugin_dir  system variable. 

<img src='content_image/674880.jpg'>

