•If the MySQL account names an LDAP user distinguished name (DN), LDAP authentication uses that value and the LDAP password provided by the client. (To associate an LDAP user DN with a MySQL account, include a BY  clause that specifies an authentication string in the CREATE USER  statement that creates the account.) 

•If the MySQL account names no LDAP user DN, LDAP authentication uses the user name and LDAP password provided by the client. In this case, the authentication plugin first binds to the LDAP server using the root DN and password as credentials to find the user DN based on the client user name, then authenticates that user DN against the LDAP password. This bind using the root credentials fails if the root DN and password are set to incorrect values, or are empty (not set) and the LDAP server does not permit anonymous connections. 

If the LDAP server finds no match or multiple matches, authentication fails and the client connection is rejected. 

If the LDAP server finds a single match, LDAP authentication succeeds (assuming that the password is correct), the LDAP server returns the LDAP entry, and the authentication plugin determines the name of the authenticated user based on that entry: 

•If the LDAP entry has a group attribute (by default, the cn  attribute), the plugin returns its value as the authenticated user name. 

•If the LDAP entry has no group attribute, the authentication plugin returns the client user name as the authenticated user name. 

The MySQL server compares the client user name with the authenticated user name to determine whether proxying occurs for the client session: 

•If the names are the same, no proxying occurs: The MySQL account matching the client user name is used for privilege checking. 

•If the names differ, proxying occurs: MySQL looks for an account matching the authenticated user name. That account becomes the proxied user, which is used for privilege checking. The MySQL account that matched the client user name is treated as the external proxy user. 

## Installing LDAP Pluggable Authentication 

This section describes how to install the LDAP authentication plugins. For general information about installing plugins, see Section 5.6.1, “Installing and Uninstalling Plugins” . 

To be usable by the server, the plugin library files must be located in the MySQL plugin directory (the directory named by the plugin_dir  system variable). If necessary, configure the plugin directory location by setting the value of plugin_dir  at server startup. 

The server-side plugin library file base names are authentication_ldap_simple  and authentication_ldap_sasl . The file name suffix differs per platform (for example, .so  for Unix and Unix-like systems, .dll  for Windows). 

To load the plugins at server startup, use --plugin-load-add  options to name the library files that contain them. With this plugin-loading method, the options must be given each time the server starts. Also, specify values for any plugin-provided system variables you wish to configure. 

Each server-side LDAP plugin exposes a set of system variables that enable its operation to be configured. Setting most of these is optional, but you must set the variables that specify the LDAP server host (so the plugin knows where to connect) and base distinguished name for LDAP bind operations (to limit the scope of searches and obtain faster searches). For details about all LDAP system variables, see Section 6.4.1.11, “Pluggable Authentication System Variables” . 

