The client program and the server communicate, with the client sending to the server the client user name (the operating system user name by default) and password:客户端程序和服务器通信，客户端向服务器发送客户端用户名（默认为操作系统用户名）和密码：

The server finds a matching MySQL account based on the external user name and the host from which the client connects. 服务器根据外部用户名和客户端连接的主机找到匹配的MySQL帐户。The PAM plugin uses the information passed to it by MySQL Server (such as user name, host name, password, and authentication string). When you define a MySQL account that authenticates using PAM, the authentication string contains:PAM插件使用MySQL服务器传递给它的信息（如用户名、主机名、密码和身份验证字符串）。当您定义一个使用PAM进行身份验证的MySQL帐户时，身份验证字符串包含：

The plugin uses the PAM service named in the authentication string to check the user credentials and returns 'Authentication succeeded, Username is user_name' or 'Authentication failed'. 该插件使用身份验证字符串中命名的PAM服务来检查用户凭据，并返回“身份验证成功，用户名为user_name”或“身份验证失败”。The password must be appropriate for the password store used by the PAM service. Examples:密码必须适合PAM服务使用的密码存储。示例：

If the credentials check fails, the server refuses the connection.如果凭据检查失败，服务器将拒绝连接。

Otherwise, the authentication string indicates whether proxying occurs. If the string contains no PAM group mapping, proxying does not occur. In this case, the MySQL user name is the same as the external user name.否则，身份验证字符串指示是否发生代理。如果字符串不包含PAM组映射，则不会发生代理。在这种情况下，MySQL用户名与外部用户名相同。

Otherwise, proxying is indicated based on the PAM group mapping, with the MySQL user name determined based on the first matching group in the mapping list. The meaning of “PAM group” depends on the PAM service. Examples:否则，根据PAM组映射指示代理，MySQL用户名根据映射列表中的第一个匹配组确定。“PAM组”的含义取决于PAM服务。示例：

If the proxy user (the external user) has the PROXY privilege for the proxied MySQL user name, proxying occurs, with the proxy user assuming the privileges of the proxied user.如果代理用户（外部用户）对被代理的MySQL用户名具有PROXY权限，则会发生代理，代理用户将承担被代理用户的权限。

Verify that Unix authentication permits logins to the operating system with the user name antonio and password antonio_password.验证Unix身份验证是否允许使用用户名antonio和密码antonio_password登录操作系统。

Set up PAM to authenticate MySQL connections using traditional Unix passwords by creating a mysql-unix PAM service file named /etc/pam.d/mysql-unix. 通过创建名为/etc/pam.d/mysql-unix的MySQL-unixPAM服务文件，设置PAM以使用传统Unix密码对MySQL连接进行身份验证。The file contents are system dependent, so check existing login-related files in the /etc/pam.d directory to see what they look like. On Linux, the mysql-unix file might look like this:文件内容取决于系统，因此请检查/etc/pam.d目录中现有的与登录相关的文件，看看它们是什么样子的。在Linux上，mysql-unix文件可能看起来像这样：

#%PAM-1.0
auth            include         password-auth
account         include         password-auth

For macOS, use login rather than password-auth.对于macOS，请使用登录而不是密码身份验证。

The PAM file format might differ on some systems. For example, on Ubuntu and other Debian-based systems, use these file contents instead:PAM文件格式在某些系统上可能不同。例如，在Ubuntu和其他基于Debian的系统上，请使用以下文件内容：

@include common-auth
@include common-account
@include common-session-noninteractive

Create a MySQL account with the same user name as the operating system user name and define it to authenticate using the PAM plugin and the mysql-unix PAM service:使用与操作系统用户名相同的用户名创建MySQL帐户，并将其定义为使用PAM插件和mysql-unixPAM服务进行身份验证：

CREATE USER 'antonio'@'localhost'
  IDENTIFIED WITH authentication_pam
  AS 'mysql-unix';
GRANT ALL PRIVILEGES
  ON mydb.*
  TO 'antonio'@'localhost';

Here, the authentication string contains only the PAM service name, mysql-unix, which authenticates Unix passwords.在这里，身份验证字符串仅包含PAM服务名称mysql-unix，用于验证unix密码。

Use the mysql command-line client to connect to the MySQL server as antonio. For example:使用mysql命令行客户端作为antonio连接到mysql服务器。例如：

shell> mysql --user=antonio --password --enable-cleartext-plugin
Enter password: antonio_password

The server should permit the connection and the following query returns output as shown:服务器应允许连接，以下查询返回输出，如图所示：

mysql> SELECT USER(), CURRENT_USER(), @@proxy_user;
+-------------------+-------------------+--------------+
| USER()            | CURRENT_USER()    | @@proxy_user |
+-------------------+-------------------+--------------+
| antonio@localhost | antonio@localhost | NULL         |
+-------------------+-------------------+--------------+

This demonstrates that the antonio operating system user is authenticated to have the privileges granted to the antonio MySQL user, and that no proxying has occurred.这表明antonio操作系统用户经过身份验证，具有授予antonio MySQL用户的权限，并且没有发生代理。

Verify that Unix authentication permits logins to the operating system with the user name antonio and password antonio_password.验证Unix身份验证是否允许使用用户名antonio和密码antonio_password登录操作系统。

Set up PAM to authenticate MySQL connections using LDAP by creating a mysql-ldap PAM service file named /etc/pam.d/mysql-ldap. 通过创建名为/etc/pam.d/mysql-ldap的mysql-ldapPAM服务文件，设置PAM以使用LDAP对MySQL连接进行身份验证。The file contents are system dependent, so check existing login-related files in the /etc/pam.d directory to see what they look like. On Linux, the mysql-ldap file might look like this:文件内容取决于系统，因此请检查/etc/pam.d目录中现有的与登录相关的文件，看看它们是什么样子的。在Linux上，mysql-ldap文件可能看起来像这样：

#%PAM-1.0
auth        required    pam_ldap.so
account     required    pam_ldap.so

If PAM object files have a suffix different from .so on your system, substitute the correct suffix.如果PAM对象文件的后缀与系统上的.so后缀不同，请替换为正确的后缀。

The PAM file format might differ on some systems.PAM文件格式在某些系统上可能不同。

Create a MySQL account with the same user name as the operating system user name and define it to authenticate using the PAM plugin and the mysql-ldap PAM service:使用与操作系统用户名相同的用户名创建MySQL帐户，并将其定义为使用PAM插件和mysql-ldap PAM服务进行身份验证：

CREATE USER 'antonio'@'localhost'
  IDENTIFIED WITH authentication_pam
  AS 'mysql-ldap';
GRANT ALL PRIVILEGES
  ON mydb.*
  TO 'antonio'@'localhost';

Here, the authentication string contains only the PAM service name, mysql-ldap, which authenticates using LDAP.在这里，身份验证字符串仅包含PAM服务名称mysql-ldap，它使用ldap进行身份验证。

Connecting to the server is the same as described in PAM Unix Password Authentication without Proxy Users.连接到服务器与无代理用户的PAM Unix密码身份验证中所述的相同。

Verify that Unix authentication permits logins to the operating system with the user name antonio and password antonio_password.验证Unix身份验证是否允许使用用户名antonio和密码antonio_password登录操作系统。

Verify that antonio is a member of the root or users PAM group.验证antonio是否是root或用户PAM组的成员。

Set up PAM to authenticate the mysql-unix PAM service through operating system users by creating a file named /etc/pam.d/mysql-unix. 通过创建名为/etc/pamd/mysql-unix的文件，设置PAM以通过操作系统用户对mysql-unixPAM服务进行身份验证。The file contents are system dependent, so check existing login-related files in the /etc/pam.d directory to see what they look like. 文件内容取决于系统，因此请检查/etc/pam.d目录中现有的与登录相关的文件，看看它们是什么样子的。On Linux, the mysql-unix file might look like this:在Linux上，mysql-unix文件可能看起来像这样：

#%PAM-1.0
auth            include         password-auth
account         include         password-auth

For macOS, use login rather than password-auth.对于macOS，请使用login而不是password-auth。

The PAM file format might differ on some systems. For example, on Ubuntu and other Debian-based systems, use these file contents instead:PAM文件格式在某些系统上可能不同。例如，在Ubuntu和其他基于Debian的系统上，请使用以下文件内容：

@include common-auth
@include common-account
@include common-session-noninteractive

Create a default proxy user (''@'') that maps external PAM users to the proxied accounts:创建一个默认代理用户（''@''），将外部PAM用户映射到代理帐户：

CREATE USER ''@''
  IDENTIFIED WITH authentication_pam
  AS 'mysql-unix, root=developer, users=data_entry';

Here, the authentication string contains the PAM service name, mysql-unix, which authenticates Unix passwords. 在这里，身份验证字符串包含PAM服务名称mysql-unix，用于验证unix密码。The authentication string also maps external users in the root and users PAM groups to the developer and data_entry MySQL user names, respectively.身份验证字符串还将root和用户PAM组中的外部用户分别映射到developer和data_entry MySQL用户名。

The PAM group mapping list following the PAM service name is required when you set up proxy users. Otherwise, the plugin cannot tell how to perform mapping from external user names to the proper proxied MySQL user names.设置代理用户时，需要PAM服务名称后面的PAM组映射列表。否则，插件无法告诉如何执行从外部用户名到正确代理的MySQL用户名的映射。

Create the proxied accounts and grant to each one the privileges it should have:创建代理帐户并授予每个帐户应有的权限：

CREATE USER 'developer'@'localhost'
  IDENTIFIED WITH mysql_no_login;
CREATE USER 'data_entry'@'localhost'
  IDENTIFIED WITH mysql_no_login;

GRANT ALL PRIVILEGES
  ON mydevdb.*
  TO 'developer'@'localhost';
GRANT ALL PRIVILEGES
  ON mydb.*
  TO 'data_entry'@'localhost';

The proxied accounts use the mysql_no_login authentication plugin to prevent clients from using the accounts to log in directly to the MySQL server. 代理帐户使用mysql_no_login身份验证插件来防止客户端使用帐户直接登录mysql服务器。Instead, users who authenticate using PAM are expected to use the developer or data_entry account by proxy based on their PAM group. 相反，使用PAM进行身份验证的用户应该根据他们的PAM组通过代理使用developer或data_entry帐户。(This assumes that the plugin is installed. For instructions, see Section 6.4.1.8, “No-Login Pluggable Authentication”.) （这假设插件已安装。有关说明，请参阅第6.4.1.8节，“无登录可插拔身份验证”。）For alternative methods of protecting proxied accounts against direct use, see Preventing Direct Login to Proxied Accounts.有关保护代理帐户免受直接使用的替代方法，请参阅防止直接登录代理帐户。

Grant to the proxy account the PROXY privilege for each proxied account:为每个代理账号授予PROXY权限：

GRANT PROXY
  ON 'developer'@'localhost'
  TO ''@'';
GRANT PROXY
  ON 'data_entry'@'localhost'
  TO ''@'';

Use the mysql command-line client to connect to the MySQL server as antonio.使用mysql命令行客户端作为antonio连接到mysql服务器。

shell> mysql --user=antonio --password --enable-cleartext-plugin
Enter password: antonio_password

The server authenticates the connection using the default ''@'' proxy account. The resulting privileges for antonio depend on which PAM groups antonio is a member of. 服务器使用默认的''@''代理帐户对连接进行身份验证。antonio的特权取决于antonio所属的PAM组。If antonio is a member of the root PAM group, the PAM plugin maps root to the developer MySQL user name and returns that name to the server. 如果antonio是rootPAM组的成员，PAM插件会将root映射到developerMySQL用户名，并将该名称返回给服务器。The server verifies that ''@'' has the PROXY privilege for developer and permits the connection. 服务器验证''@''是否具有developer的PROXY权限，并允许连接。The following query returns output as shown:以下查询返回如下输出：

mysql> SELECT USER(), CURRENT_USER(), @@proxy_user;
+-------------------+---------------------+--------------+
| USER()            | CURRENT_USER()      | @@proxy_user |
+-------------------+---------------------+--------------+
| antonio@localhost | developer@localhost | ''@''        |
+-------------------+---------------------+--------------+

This demonstrates that the antonio operating system user is authenticated to have the privileges granted to the developer MySQL user, and that proxying occurs through the default proxy account.这表明antonio操作系统用户经过身份验证，具有授予developerMySQL用户的权限，并且代理是通过默认代理帐户进行的。

If antonio is not a member of the root PAM group but is a member of the users PAM group, a similar process occurs, but the plugin maps user PAM group membership to the data_entry MySQL user name and returns that name to the server:如果antonio不是根PAM组的成员，但是用户PAM组的一员，则会发生类似的过程，但插件会将userPAM组成员身份映射到data_entry MySQL用户名，并将该名称返回给服务器：

mysql> SELECT USER(), CURRENT_USER(), @@proxy_user;
+-------------------+----------------------+--------------+
| USER()            | CURRENT_USER()       | @@proxy_user |
+-------------------+----------------------+--------------+
| antonio@localhost | data_entry@localhost | ''@''        |
+-------------------+----------------------+--------------+

This demonstrates that the antonio operating system user is authenticated to have the privileges of the data_entry MySQL user, and that proxying occurs through the default proxy account.这表明antonio操作系统用户经过身份验证，具有data_entry MySQL用户的权限，并且代理是通过默认代理帐户进行的。