content_image/839679.jpg content_image/839677.jpg
Another technique for debugging connection failures and determining what is happening during connection attempts is to configure PAM authentication to permit all connections, then check the system log files. This technique should be used only on a temporary  basis, and not on a production server. 

Configure a PAM service file named /etc/pam.d/mysql-any-password  with these contents (the format may differ on some systems): 

<img src='content_image/839679.jpg'>

Create an account that uses the PAM plugin and names the mysql-any-password  PAM service: 

CREATE USER ’testuser’@’localhost’ IDENTIFIED WITH authentication_pam AS ’mysql-any-password’; 

The mysql-any-password  service file causes any authentication attempt to return true, even for incorrect passwords. If an authentication attempt fails, that tells you the configuration problem is on the MySQL side. Otherwise, the problem is on the operating system/PAM side. To see what might be happening, check system log files such as /var/log/secure , /var/log/audit.log , /var/log/ syslog , or /var/log/messages . 

After determining what the problem is, remove the mysql-any-password  PAM service file to disable any-password access. 

## 6.4.1.6 Windows Pluggable Authentication 

<img src='content_image/839677.jpg'>

## Note 

Windows pluggable authentication is an extension included in MySQL Enterprise Edition, a commercial product. To learn more about commercial products, see https://www.mysql.com/products/. 

MySQL Enterprise Edition for Windows supports an authentication method that performs external authentication on Windows, enabling MySQL Server to use native Windows services to authenticate client connections. Users who have logged in to Windows can connect from MySQL client programs to the server based on the information in their environment without specifying an additional password. 

The client and server exchange data packets in the authentication handshake. As a result of this exchange, the server creates a security context object that represents the identity of the client in the Windows OS. This identity includes the name of the client account. Windows pluggable authentication uses the identity of the client to check whether it is a given account or a member of a group. By default, negotiation uses Kerberos to authenticate, then NTLM if Kerberos is unavailable. 

Windows pluggable authentication provides these capabilities: 

•External authentication: Windows authentication enables MySQL Server to accept connections from users defined outside the MySQL grant tables who have logged in to Windows. 

•Proxy user support: Windows authentication can return to MySQL a user name different from the external user name passed by the client program. This means that the plugin can return the MySQL user that defines the privileges the external Windows-authenticated user should have. For example, a Windows user named joe  can connect and have the privileges of a MySQL user named developer . 

The following table shows the plugin and library file names. The file must be located in the directory named by the plugin_dir  system variable. 

