content_image/767593.jpg content_image/767591.jpg
plugin is used, which enables the client to send the password to the server as cleartext. There is no corresponding server-side plugin. Rather, mysql_clear_password  can be used on the client side in concert with any server-side plugin that needs a cleartext password. (Examples are the PAM and simple LDAP authentication plugins; see Section 6.4.1.5, “PAM Pluggable Authentication” , and Section 6.4.1.7, “LDAP Pluggable Authentication” .) 

The following discussion provides usage information specific to cleartext pluggable authentication. For general information about pluggable authentication in MySQL, see Section 6.2.17, “Pluggable Authentication” . 

<img src='content_image/767593.jpg'>

## Note 

Sending passwords as cleartext may be a security problem in some configurations. To avoid problems if there is any possibility that the password would be intercepted, clients should connect to MySQL Server using a method that protects the password. Possibilities include SSL (see Section 6.3, “Using Encrypted Connections” ), IPsec, or a private network. 

To make inadvertent use of the mysql_clear_password  plugin less likely, MySQL clients must explicitly enable it. This can be done in several ways: 

•Set the LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN  environment variable to a value that begins with 1 , Y , or y . This enables the plugin for all client connections. 

•The mysql , mysqladmin , mysqlcheck , mysqldump , mysqlshow , and mysqlslap  client programs support an --enable-cleartext-plugin  option that enables the plugin on a per-invocation basis. 

•The mysql_options() C API function supports a MYSQL_ENABLE_CLEARTEXT_PLUGIN  option that enables the plugin on a per-connection basis. Also, any program that uses libmysqlclient  and reads option files can enable the plugin by including an enable-cleartext-plugin  option in an option group read by the client library. 

## 6.4.1.5 PAM Pluggable Authentication 

<img src='content_image/767591.jpg'>

## Note 

PAM pluggable authentication is an extension included in MySQL Enterprise Edition, a commercial product. To learn more about commercial products, see https://www.mysql.com/products/. 

MySQL Enterprise Edition supports an authentication method that enables MySQL Server to use PAM (Pluggable Authentication Modules) to authenticate MySQL users. PAM enables a system to use a standard interface to access various kinds of authentication methods, such as traditional Unix passwords or an LDAP directory. 

PAM pluggable authentication provides these capabilities: 

•External authentication: PAM authentication enables MySQL Server to accept connections from users defined outside the MySQL grant tables and that authenticate using methods supported by PAM. 

•Proxy user support: PAM authentication can return to MySQL a user name different from the external user name passed by the client program, based on the PAM groups the external user is a member of and the authentication string provided. This means that the plugin can return the MySQL user that defines the privileges the external PAM-authenticated user should have. For example, an operating sytem user named joe  can connect and have the privileges of a MySQL user named developer . 

PAM pluggable authentication has been tested on Linux and macOS. 

