For example, if an account uses the mysql-unix  PAM service name and should map operating system users in the root  and users  PAM groups to the developer  and data_entry  MySQL users, respectively, use a statement like this: 

CREATE USER user IDENTIFIED WITH authentication_pam AS ’mysql-unix, root=developer, users=data_entry’; 

Authentication string syntax for the PAM authentication plugin follows these rules: 

•The string consists of a PAM service name, optionally followed by a PAM group mapping list consisting of one or more keyword/value pairs each specifying a PAM group name and a MySQL user name: 

pam_service_name [, pam_group_name = mysql_user_name ]... 

The plugin parses the authentication string for each connection attempt that uses the account. To minimize overhead, keep the string as short as possible. 

•Each pam_group_name = mysql_user_name  pair must be preceded by a comma. 

•Leading and trailing spaces not inside double quotation marks are ignored. 

•Unquoted pam_service_name , pam_group_name , and mysql_user_name  values can contain anything except equal sign, comma, or space. 

•If a pam_service_name , pam_group_name , or mysql_user_name  value is quoted with double quotation marks, everything between the quotation marks is part of the value. This is necessary, for example, if the value contains space characters. All characters are legal except double quotation mark and backslash ( \ ). To include either character, escape it with a backslash. 

If the plugin successfully authenticates the external user name (the name passed by the client), it looks for a PAM group mapping list in the authentication string and, if present, uses it to return a different MySQL user name to the MySQL server based on which PAM groups the external user is a member of: 

•If the authentication string contains no PAM group mapping list, the plugin returns the external name. 

•If the authentication string does contain a PAM group mapping list, the plugin examines each pam_group_name = mysql_user_name  pair in the list from left to right and tries to find a match for the pam_group_name  value in a non-MySQL directory of the groups assigned to the authenticated user and returns mysql_user_name  for the first match it finds. If the plugin finds no match for any PAM group, it returns the external name. If the plugin is not capable of looking up a group in a directory, it ignores the PAM group mapping list and returns the external name. 

The following sections describe how to set up several authentication scenarios that use the PAM authentication plugin: 

•No proxy users. This uses PAM only to check login names and passwords. Every external user permitted to connect to MySQL Server should have a matching MySQL account that is defined to use PAM authentication. (For a MySQL account of ’ user_name ’@’ host_name ’  to match the external user, user_name  must be the external user name and host_name  must match the host from which the client connects.) Authentication can be performed by various PAM-supported methods. Later discussion shows how to authenticate client credentials using traditional Unix passwords, and passwords in LDAP. 

PAM authentication, when not done through proxy users or PAM groups, requires the MySQL user name to be same as the operating system user name. MySQL user names are limited to 32 characters (see Section 6.2.3, “Grant Tables” ), which limits PAM nonproxy authentication to Unix accounts with names of at most 32 characters. 

