authentication_ldap_sasl for system variables with names of the form authentication_ldap_sasl_xxxauthentication_ldap_sasl用于具有authentication_ldap_sasl_xxx格式名称的系统变量

authentication_ldap_simple for system variables with names of the form authentication_ldap_simple_xxxauthentication_ldap_simple用于具有authentication_ldap_simple_xxx格式名称的系统变量

authentication_ldap_sasl_auth_method_name

For SASL LDAP authentication, the authentication method name. Communication between the authentication plugin and the LDAP server occurs according to this authentication method to ensure password security.对于SASL LDAP身份验证，身份验证方法名称。身份验证插件和LDAP服务器之间的通信根据此身份验证方法进行，以确保密码安全。

These authentication method values are permitted:允许使用以下身份验证方法值：

authentication_ldap_sasl_bind_base_dn

For SASL LDAP authentication, the base distinguished name (DN). This variable can be used to limit the scope of searches by anchoring them at a certain location (the “base”) within the search tree.对于SASL LDAP身份验证，基本可分辨名称（DN）。此变量可用于通过将搜索锚定在搜索树中的某个位置（“基础”）来限制搜索范围。

Suppose that members of one set of LDAP user entries each have this form:假设一组LDAP用户条目的每个成员都有以下表单：

uid=user_name,ou=People,dc=example,dc=com

And that members of another set of LDAP user entries each have this form:另一组LDAP用户条目的成员均具有以下形式：

uid=user_name,ou=Admin,dc=example,dc=com

Then searches work like this for different base DN values:然后搜索不同的基本DN值：

In general, more specific base DN values result in faster searches because they limit the search scope more.一般来说，更具体的基DN值会导致更快的搜索，因为它们会更多地限制搜索范围。

authentication_ldap_sasl_bind_root_dn

For SASL LDAP authentication, the root distinguished name (DN). This variable is used in conjunction with authentication_ldap_sasl_bind_root_pwd as the credentials for authenticating to the LDAP server for the purpose of performing searches. 对于SASL LDAP身份验证，根可分辨名称（DN）。此变量与authentication_ldap_sasl_bind_root_pwd结合使用，作为向LDAP服务器进行身份验证的凭据，以执行搜索。Authentication uses either one or two LDAP bind operations, depending on whether the MySQL account names an LDAP user DN:身份验证使用一个或两个LDAP绑定操作，具体取决于MySQL帐户是否命名LDAP用户DN：

authentication_ldap_sasl_bind_root_pwd

For SASL LDAP authentication, the password for the root distinguished name. 对于SASL LDAP身份验证，根可分辨名称的密码。This variable is used in conjunction with authentication_ldap_sasl_bind_root_dn. 此变量与authentication_ldap_sasl_bind_root_dn结合使用。See the description of that variable.请参阅该变量的描述。

authentication_ldap_sasl_ca_path

For SASL LDAP authentication, the absolute path of the certificate authority file. Specify this file if it is desired that the authentication plugin perform verification of the LDAP server certificate.对于SASL LDAP身份验证，证书颁发机构文件的绝对路径。如果希望身份验证插件执行LDAP服务器证书的验证，请指定此文件。

authentication_ldap_sasl_group_search_attr

For SASL LDAP authentication, the name of the attribute that specifies group names in LDAP directory entries. 对于SASL LDAP身份验证，在LDAP目录条目中指定组名的属性的名称。If authentication_ldap_sasl_group_search_attr has its default value of cn, searches return the cn value as the group name. 如果authentication_ldap_sasl_group_search_attr的默认值为cn，则搜索将返回cn值作为组名。For example, if an LDAP entry with a uid value of user1 has a cn attribute of mygroup, searches for user1 return mygroup as the group name.例如，如果uid值为user1的LDAP条目具有mygroup的cn属性，则搜索user1会返回mygroup作为组名。

This variable should be the empty string if you want no group or proxy authentication.如果不希望进行组或代理身份验证，则此变量应为空字符串。

If the group search attribute is isMemberOf, LDAP authentication directly retrieves the user attribute isMemberOf value and assigns it as group information. 如果组搜索属性为isMemberOf，LDAP身份验证将直接检索用户属性isMemberOf值并将其分配为组信息。If the group search attribute is not isMemberOf, LDAP authentication searches for all groups where the user is a member. (The latter is the default behavior.) 如果组搜索属性不是isMemberOf，LDAP身份验证将搜索用户为成员的所有组。（后者是默认行为。）This behavior is based on how LDAP group information can be stored two ways: 1) A group entry can have an attribute named memberUid or member with a value that is a user name; 2) A user entry can have an attribute named isMemberOf with values that are group names.此行为基于LDAP组信息如何以两种方式存储：1）组条目可以具有名为memberUid的属性或具有用户名值的成员；2）用户条目可以有一个名为isMemberOf的属性，其值为组名。

authentication_ldap_sasl_group_search_filter

For SASL LDAP authentication, the custom group search filter.对于SASL LDAP身份验证，自定义组搜索筛选器。

The search filter value can contain {UA} and {UD} notation to represent the user name and the full user DN. 搜索筛选器值可以包含{UA}和{UD}表示法，以表示用户名和完整用户DN。For example, {UA} is replaced with a user name such as "admin", whereas {UD} is replaced with a use full DN such as "uid=admin,ou=People,dc=example,dc=com". 例如，{UA}被替换为用户名，如"admin"，而{UD}则被替换为使用完整DN，如"uid=admin,ou=People,dc=example,dc=com"。The following value is the default, which supports both OpenLDAP and Active Directory:以下值为默认值，同时支持OpenLDAP和活动目录：

(|(&(objectClass=posixGroup)(memberUid={UA}))
  (&(objectClass=group)(member={UD})))

In some cases for the user scenario, memberOf is a simple user attribute that holds no group information. 在某些用户场景中，memberOf是一个简单的用户属性，不包含任何组信息。For additional flexibility, an optional {GA} prefix can be used with the group search attribute. 为了增加灵活性，可以在组搜索属性中使用可选的{GA}前缀。Any group attribute with a {GA} prefix is treated as a user attribute having group names. 任何带有{GA}前缀的组属性都被视为具有组名的用户属性。For example, with a value of {GA}MemberOf, if the group value is the DN, the first attribute value from the group DN is returned as the group name.例如，如果值为{GA}MemberOf，如果组值是DN，则返回组DN中的第一个属性值作为组名。

authentication_ldap_sasl_init_pool_size

For SASL LDAP authentication, the initial size of the pool of connections to the LDAP server. Choose the value for this variable based on the average number of concurrent authentication requests to the LDAP server.对于SASL LDAP身份验证，LDAP服务器连接池的初始大小。根据对LDAP服务器的并发身份验证请求的平均数量选择此变量的值。

The plugin uses authentication_ldap_sasl_init_pool_size and authentication_ldap_sasl_max_pool_size together for connection-pool management:该插件同时使用authentication_ldap_sasl_init_pool_size和authentication_ldap_sasl_max_pool_size：

Changes to plugin system variable settings may have no effect on connections already in the pool. For example, modifying the LDAP server host, port, or TLS settings does not affect existing connections. 对插件系统变量设置的更改可能不会对池中已有的连接产生影响。例如，修改LDAP服务器主机、端口或TLS设置不会影响现有连接。However, if the original variable values were invalid and the connection pool could not be initialized, the plugin attempts to reinitialize the pool for the next LDAP request. 但是，如果原始变量值无效并且无法初始化连接池，则插件会尝试为下一个LDAP请求重新初始化池。In this case, the new system variable values are used for the reinitialization attempt.在这种情况下，新的系统变量值用于重新初始化尝试。

If authentication_ldap_sasl_max_pool_size=0 to disable pooling, each LDAP connection opened by the plugin uses the values the system variables have at that time.如果authentication_ldap_sasl_max_pool_size=0以禁用池化，则插件打开的每个ldap连接都使用系统变量当时的值。

authentication_ldap_sasl_log_status

For SASL LDAP authentication, the logging level for messages written to the error log. The following table shows the permitted level values and their meanings.对于SASL LDAP身份验证，写入错误日志的消息的日志级别。下表显示了允许的级别值及其含义。

Log level 6 is available as of MySQL 8.0.18.MySQL 8.0.18提供日志级别6。

On the client side, messages can be logged to the standard output by setting the AUTHENTICATION_LDAP_CLIENT_LOG environment variable. 在客户端，通过设置AUTHENTICATION_LDAP_CLIENT_LOG环境变量，可以将消息记录到标准输出中。The permitted and default values are the same as for authentication_ldap_sasl_log_status.允许值和默认值与authentication_ldap_sasl_log_status相同。

The AUTHENTICATION_LDAP_CLIENT_LOG environment variable applies only to SASL LDAP authentication. AUTHENTION_LDAP_CLIENT_LOG环境变量仅适用于SASL LDAP身份验证。It has no effect for simple LDAP authentication because the client plugin in that case is mysql_clear_password, which knows nothing about LDAP operations.它对简单的LDAP身份验证没有影响，因为在这种情况下，客户端插件是mysql_clear_password，它对LDAP操作一无所知。

authentication_ldap_sasl_max_pool_size

For SASL LDAP authentication, the maximum size of the pool of connections to the LDAP server. To disable connection pooling, set this variable to 0.对于SASL LDAP身份验证，指向LDAP服务器的连接池的最大大小。要禁用连接池，请将此变量设置为0。

This variable is used in conjunction with authentication_ldap_sasl_init_pool_size. See the description of that variable.此变量与authentication_ldap_sasl_init_pool_size结合使用。请参阅该变量的描述。

authentication_ldap_sasl_referral

For SASL LDAP authentication, whether to enable LDAP search referral. See LDAP Search Referral.对于SASL LDAP身份验证，是否启用LDAP搜索引用。请参阅LDAP搜索引用。

This variable can be set to override the default OpenLDAP referral configuration; see LDAP Pluggable Authentication and ldap.conf此变量可以设置为覆盖默认的OpenLDAP引用配置；请参阅LDAP可插拔身份验证和ldap.conf。

authentication_ldap_sasl_server_host

For SASL LDAP authentication, the LDAP server host. The permitted values for this variable depend on the authentication method:对于SASL LDAP身份验证，LDAP服务器主机。此变量的允许值取决于身份验证方法：

authentication_ldap_sasl_server_port

For SASL LDAP authentication, the LDAP server TCP/IP port number.对于SASL LDAP身份验证，LDAP服务器TCP/IP端口号。

As of MySQL 8.0.14, if the LDAP port number is configured as 636 or 3269, the plugin uses LDAPS (LDAP over SSL) instead of LDAP. (LDAPS differs from startTLS.)从MySQL 8.0.14开始，如果LDAP端口号配置为636或3269，则该插件使用LDAPS（基于SSL的LDAP）而不是LDAP。（LDAPS不同于startTLS。）

authentication_ldap_sasl_tls

For SASL LDAP authentication, whether connections by the plugin to the LDAP server are secure. If this variable is enabled, the plugin uses TLS to connect securely to the LDAP server. 对于SASL LDAP身份验证，插件与LDAP服务器的连接是否安全。如果启用此变量，插件将使用TLS安全地连接到LDAP服务器。This variable can be set to override the default OpenLDAP TLS configuration; see LDAP Pluggable Authentication and ldap.conf 此变量可以设置为覆盖默认的OpenLDAP TLS配置；请参阅LDAP可插拔身份验证和ldap.conf。If you enable this variable, you may also wish to set the authentication_ldap_sasl_ca_path variable.如果启用此变量，您可能还希望设置authentication_ldap_sasl_ca_path变量。

MySQL LDAP plugins support the StartTLS method, which initializes TLS on top of a plain LDAP connection.MySQL LDAP插件支持StartTLS方法，该方法在普通LDAP连接之上初始化TLS。

As of MySQL 8.0.14, LDAPS can be used by setting the authentication_ldap_sasl_server_port system variable.从MySQL 8.0.14开始，可以通过设置authentication_ldap_sasl_server_port系统变量来使用LDAPS。

authentication_ldap_sasl_user_search_attr

For SASL LDAP authentication, the name of the attribute that specifies user names in LDAP directory entries. 对于SASL LDAP身份验证，在LDAP目录条目中指定用户名的属性的名称。If a user distinguished name is not provided, the authentication plugin searches for the name using this attribute. 如果未提供用户可分辨名称，则身份验证插件将使用此属性搜索该名称。For example, if the authentication_ldap_sasl_user_search_attr value is uid, a search for the user name user1 finds entries with a uid value of user1.例如，如果authentication_ldap_sasl_user_search_attr值为uid，则搜索用户名user1会找到uid值为user1的条目。

authentication_ldap_simple_auth_method_name

For simple LDAP authentication, the authentication method name. Communication between the authentication plugin and the LDAP server occurs according to this authentication method.对于简单的LDAP身份验证，请提供身份验证方法名称。身份验证插件和LDAP服务器之间的通信根据此身份验证方法进行。

These authentication method values are permitted:允许使用以下身份验证方法值：

authentication_ldap_simple_bind_base_dn

For simple LDAP authentication, the base distinguished name (DN). This variable can be used to limit the scope of searches by anchoring them at a certain location (the “base”) within the search tree.对于简单的LDAP身份验证，使用基本可分辨名称（DN）。此变量可用于通过将搜索锚定在搜索树中的某个位置（“基础”）来限制搜索范围。

Suppose that members of one set of LDAP user entries each have this form:假设一组LDAP用户条目的每个成员都有以下表单：

uid=user_name,ou=People,dc=example,dc=com

And that members of another set of LDAP user entries each have this form:另一组LDAP用户条目的成员均具有以下形式：

uid=user_name,ou=Admin,dc=example,dc=com

Then searches work like this for different base DN values:然后搜索不同的基本DN值：

In general, more specific base DN values result in faster searches because they limit the search scope more.一般来说，更具体的基DN值会导致更快的搜索，因为它们会更多地限制搜索范围。

authentication_ldap_simple_bind_root_dn

For simple LDAP authentication, the root distinguished name (DN). This variable is used in conjunction with authentication_ldap_simple_bind_root_pwd as the credentials for authenticating to the LDAP server for the purpose of performing searches. 对于简单的LDAP身份验证，根可分辨名称（DN）。此变量与authentication_ldap_simple_bind_root_pwd结合使用，作为向ldap服务器进行身份验证的凭据，以执行搜索。Authentication uses either one or two LDAP bind operations, depending on whether the MySQL account names an LDAP user DN:身份验证使用一个或两个LDAP绑定操作，具体取决于MySQL帐户是否命名LDAP用户DN：

authentication_ldap_simple_bind_root_pwd

For simple LDAP authentication, the password for the root distinguished name. This variable is used in conjunction with authentication_ldap_simple_bind_root_dn. 对于简单的LDAP身份验证，根可分辨名称的密码。此变量与authentication_ldap_simple_bind_root_dn结合使用。See the description of that variable.请参阅该变量的描述。

authentication_ldap_simple_ca_path

For simple LDAP authentication, the absolute path of the certificate authority file. Specify this file if it is desired that the authentication plugin perform verification of the LDAP server certificate.对于简单的LDAP身份验证，证书颁发机构文件的绝对路径。如果希望身份验证插件执行LDAP服务器证书的验证，请指定此文件。

authentication_ldap_simple_group_search_attr

For simple LDAP authentication, the name of the attribute that specifies group names in LDAP directory entries. 对于简单的LDAP身份验证，在LDAP目录条目中指定组名的属性的名称。If authentication_ldap_simple_group_search_attr has its default value of cn, searches return the cn value as the group name. 如果authentication_ldap_simple_group_search_attr的默认值为cn，则搜索将返回cn值作为组名。For example, if an LDAP entry with a uid value of user1 has a cn attribute of mygroup, searches for user1 return mygroup as the group name.例如，如果uid值为user1的LDAP条目具有mygroup的cn属性，则搜索user1会返回mygroup作为组名。

If the group search attribute is isMemberOf, LDAP authentication directly retrieves the user attribute isMemberOf value and assigns it as group information. 如果组搜索属性为isMemberOf，LDAP身份验证将直接检索用户属性isMemberOf值并将其分配为组信息。If the group search attribute is not isMemberOf, LDAP authentication searches for all groups where the user is a member. 如果组搜索属性不是isMemberOf，LDAP身份验证将搜索用户为成员的所有组。(The latter is the default behavior.) （后者是默认行为。）This behavior is based on how LDAP group information can be stored two ways: 1) A group entry can have an attribute named memberUid or member with a value that is a user name; 2) A user entry can have an attribute named isMemberOf with values that are group names.此行为基于LDAP组信息如何以两种方式存储：1）组条目可以具有名为memberUid的属性或具有用户名值的成员；2）用户条目可以有一个名为isMemberOf的属性，其值为组名。

authentication_ldap_simple_group_search_filter

For simple LDAP authentication, the custom group search filter.对于简单的LDAP身份验证，使用自定义组搜索筛选器。

The search filter value can contain {UA} and {UD} notation to represent the user name and the full user DN. 搜索筛选器值可以包含{UA}和{UD}表示法，以表示用户名和完整用户DN。For example, {UA} is replaced with a user name such as "admin", whereas {UD} is replaced with a use full DN such as "uid=admin,ou=People,dc=example,dc=com". 例如，{UA}被替换为用户名，如"admin"，而{UD}则被替换为使用完整DN，如"uid=admin,ou=People,dc=example,dc=com"。The following value is the default, which supports both OpenLDAP and Active Directory:以下值为默认值，同时支持OpenLDAP和活动目录：

(|(&(objectClass=posixGroup)(memberUid={UA}))
  (&(objectClass=group)(member={UD})))

In some cases for the user scenario, memberOf is a simple user attribute that holds no group information. 在某些用户场景中，memberOf是一个简单的用户属性，不包含任何组信息。For additional flexibility, an optional {GA} prefix can be used with the group search attribute. 为了增加灵活性，可以在组搜索属性中使用可选的{GA}前缀。Any group attribute with a {GA} prefix is treated as a user attribute having group names. 任何带有{GA}前缀的组属性都被视为具有组名的用户属性。For example, with a value of {GA}MemberOf, if the group value is the DN, the first attribute value from the group DN is returned as the group name.例如，如果值为{GA}MemberOf，如果组值是DN，则返回组DN中的第一个属性值作为组名。

authentication_ldap_simple_init_pool_size

For simple LDAP authentication, the initial size of the pool of connections to the LDAP server. Choose the value for this variable based on the average number of concurrent authentication requests to the LDAP server.对于简单的LDAP身份验证，指向LDAP服务器的连接池的初始大小。根据对LDAP服务器的并发身份验证请求的平均数量选择此变量的值。

The plugin uses authentication_ldap_simple_init_pool_size and authentication_ldap_simple_max_pool_size together for connection-pool management:该插件同时使用authentication_ldap_simple_init_pool_size和authentication_ldap_simple_max_pool_size：

Changes to plugin system variable settings may have no effect on connections already in the pool. 对插件系统变量设置的更改可能不会对池中已有的连接产生影响。For example, modifying the LDAP server host, port, or TLS settings does not affect existing connections. 例如，修改LDAP服务器主机、端口或TLS设置不会影响现有连接。However, if the original variable values were invalid and the connection pool could not be initialized, the plugin attempts to reinitialize the pool for the next LDAP request. 但是，如果原始变量值无效并且无法初始化连接池，则插件会尝试为下一个LDAP请求重新初始化池。In this case, the new system variable values are used for the reinitialization attempt.在这种情况下，新的系统变量值用于重新初始化尝试。

If authentication_ldap_simple_max_pool_size=0 to disable pooling, each LDAP connection opened by the plugin uses the values the system variables have at that time.如果authentication_ldap_simple_max_pool_size=0以禁用池化，则插件打开的每个ldap连接都使用系统变量当时的值。

authentication_ldap_simple_log_status

For simple LDAP authentication, the logging level for messages written to the error log. The following table shows the permitted level values and their meanings.对于简单的LDAP身份验证，写入错误日志的消息的日志级别。下表显示了允许的级别值及其含义。

Log level 6 is available as of MySQL 8.0.18.MySQL 8.0.18提供日志级别6。

authentication_ldap_simple_max_pool_size

For simple LDAP authentication, the maximum size of the pool of connections to the LDAP server. To disable connection pooling, set this variable to 0.对于简单的LDAP身份验证，指向LDAP服务器的连接池的最大大小。要禁用连接池，请将此变量设置为0。

This variable is used in conjunction with authentication_ldap_simple_init_pool_size. See the description of that variable.此变量与authentication_ldap_simple_init_pool_size结合使用。请参阅该变量的描述。

authentication_ldap_simple_referral

For simple LDAP authentication, whether to enable LDAP search referral. See LDAP Search Referral.对于简单的LDAP身份验证，是否启用LDAP搜索引用。请参阅LDAP搜索引用。

authentication_ldap_simple_server_host

For simple LDAP authentication, the LDAP server host. The permitted values for this variable depend on the authentication method:对于简单的LDAP身份验证，LDAP服务器主机。此变量的允许值取决于身份验证方法：

authentication_ldap_simple_server_port

For simple LDAP authentication, the LDAP server TCP/IP port number.对于简单的LDAP身份验证，LDAP服务器TCP/IP端口号。

As of MySQL 8.0.14, if the LDAP port number is configured as 636 or 3269, the plugin uses LDAPS (LDAP over SSL) instead of LDAP. (LDAPS differs from startTLS.)从MySQL 8.0.14开始，如果LDAP端口号配置为636或3269，则该插件使用LDAPS（基于SSL的LDAP）而不是LDAP。（LDAPS不同于startTLS。）

authentication_ldap_simple_tls

For simple LDAP authentication, whether connections by the plugin to the LDAP server are secure. If this variable is enabled, the plugin uses TLS to connect securely to the LDAP server. 对于简单的LDAP身份验证，插件与LDAP服务器的连接是否安全。如果启用此变量，插件将使用TLS安全地连接到LDAP服务器。This variable can be set to override the default OpenLDAP TLS configuration; see LDAP Pluggable Authentication and ldap.conf If you enable this variable, you may also wish to set the authentication_ldap_simple_ca_path variable.此变量可以设置为覆盖默认的OpenLDAP TLS配置；请参阅LDAP可插拔身份验证和ldap.conf。如果启用此变量，您可能还希望设置Authentication_LDAP_simple_ca_path变量。

MySQL LDAP plugins support the StartTLS method, which initializes TLS on top of a plain LDAP connection.MySQL LDAP插件支持StartTLS方法，该方法在普通LDAP连接之上初始化TLS。

As of MySQL 8.0.14, LDAPS can be used by setting the authentication_ldap_simple_server_port system variable.从MySQL 8.0.14开始，可以通过设置authentication_ldap_simple_server_port系统变量来使用LDAPS。

authentication_ldap_simple_user_search_attr

For simple LDAP authentication, the name of the attribute that specifies user names in LDAP directory entries. 对于简单的LDAP身份验证，在LDAP目录条目中指定用户名的属性的名称。If a user distinguished name is not provided, the authentication plugin searches for the name using this attribute. 如果未提供用户可分辨名称，则身份验证插件将使用此属性搜索该名称。For example, if the authentication_ldap_simple_user_search_attr value is uid, a search for the user name user1 finds entries with a uid value of user1.例如，如果authentication_ldap_simple_user_search_attr值为uid，则搜索用户名user1会找到uid值为user1的条目。