No password is required here. The authentication_windows  plugin uses the Windows security API to check which Windows user is connecting. If that user is named Rafal  or Tasha , or is a member of the Administrators  or Power Users  group, the server grants access and the client is authenticated as sql_admin  and has whatever privileges are granted to the sql_admin  account. Otherwise, the server denies access. 

Authentication string syntax for the Windows authentication plugin follows these rules: 

•The string consists of one or more user mappings separated by commas. 

•Each user mapping associates a Windows user or group name with a MySQL user name: 

win_user_or_group_name=mysql_user_name win_user_or_group_name 

For the latter syntax, with no mysql_user_name  value given, the implicit value is the MySQL user created by the CREATE USER  statement. Thus, these statements are equivalent: 

CREATE USER sql_admin IDENTIFIED WITH authentication_windows AS ’Rafal, Tasha, Administrators, "Power Users"’; CREATE USER sql_admin IDENTIFIED WITH authentication_windows AS ’Rafal=sql_admin, Tasha=sql_admin, Administrators=sql_admin, "Power Users"=sql_admin’; 

•Each backslash character ( \ ) in a value must be doubled because backslash is the escape character in MySQL strings. 

•Leading and trailing spaces not inside double quotation marks are ignored. 

•Unquoted win_user_or_group_name  and mysql_user_name  values can contain anything except equal sign, comma, or space. 

•If a win_user_or_group_name  and or mysql_user_name  value is quoted with double quotation marks, everything between the quotation marks is part of the value. This is necessary, for example, if the name contains space characters. All characters within double quotes are legal except double quotation mark and backslash. To include either character, escape it with a backslash. 

• win_user_or_group_name  values use conventional syntax for Windows principals, either local or in a domain. Examples (note the doubling of backslashes): 

domain\\user .\\user domain\\group .\\group BUILTIN\\WellKnownGroup 

When invoked by the server to authenticate a client, the plugin scans the authentication string left to right for a user or group match to the Windows user. If there is a match, the plugin returns the corresponding mysql_user_name  to the MySQL server. If there is no match, authentication fails. 

A user name match takes preference over a group name match. Suppose that the Windows user named win_user  is a member of win_group  and the authentication string looks like this: 

’win_group = sql_user1, win_user = sql_user2’ 

When win_user  connects to the MySQL server, there is a match both to win_group  and to win_user . The plugin authenticates the user as sql_user2  because the more-specific user match takes precedence over the group match, even though the group is listed first in the authentication string. 

