content_image/661558.jpg
To associate MySQL accounts with an LDAP plugin, see Using LDAP Pluggable Authentication. 

<img src='content_image/661558.jpg'>

## Additional Notes for SELinux 

On systems running EL6 or EL that have SELinux enabled, changes to the SELinux policy are required to enable the MySQL LDAP plugins to communicate with the LDAP service: 

1. Create a file mysqlldap.te  with these contents: 

module mysqlldap 1.0; require { type ldap_port_t; type mysqld_t; class tcp_socket name_connect; } #============= mysqld_t ============== allow mysqld_t ldap_port_t:tcp_socket name_connect; 

2. Compile the security policy module into a binary representation: 

checkmodule -M -m mysqlldap.te -o mysqlldap.mod 

3. Create an SELinux policy module package: 

semodule_package -m mysqlldap.mod -o mysqlldap.pp 

4. Install the module package: 

semodule -i mysqlldap.pp 

5. When the SELinux policy changes have been made, restart the MySQL server: 

## Uninstalling LDAP Pluggable Authentication 

service mysqld restart 

The method used to uninstall the LDAP authentication plugins depends on how you installed them: 

•If you installed the plugins at server startup using --plugin-load-add  options, restart the server without those options. 

•If you installed the plugins at runtime using INSTALL PLUGIN , they remain installed across server restarts. To uninstall them, use UNINSTALL PLUGIN : 

UNINSTALL PLUGIN authentication_ldap_simple; UNINSTALL PLUGIN authentication_ldap_sasl; 

In addition, remove from your my.cnf  file any startup options that set LDAP plugin-related system variables. If you used SET PERSIST  to persist LDAP system variables, use RESET PERSIST  to remove the settings. 

## LDAP Pluggable Authentication and ldap.conf 

For installations that use OpenLDAP, the ldap.conf  file provides global defaults for LDAP clients. Options can be set in this file to affect LDAP clients, including the LDAP authentication plugins. OpenLDAP uses configuration options in this order of precedence: 

