To use LDAP pluggable authentication for MySQL, these prerequisites must be satisfied:要对MySQL使用LDAP可插拔身份验证，必须满足以下先决条件：

This section provides a general overview of how MySQL and LDAP work together to authenticate MySQL users. For examples showing how to set up MySQL accounts to use specific LDAP authentication plugins, see Using LDAP Pluggable Authentication. 本节概述了MySQL和LDAP如何协同工作以对MySQL用户进行身份验证。有关如何设置MySQL帐户以使用特定LDAP身份验证插件的示例，请参阅使用LDAP可插拔身份验证。For information about authentication methods available to the LDAP plugins, see LDAP Authentication Methods.有关LDAP插件可用的身份验证方法的信息，请参阅LDAP身份验证方法。

The client connects to the MySQL server, providing the MySQL client user name and a password:客户端连接到MySQL服务器，提供MySQL客户端用户名和密码：

If the client user name and host name match no MySQL account, the connection is rejected.如果客户端用户名和主机名与MySQL帐户不匹配，则拒绝连接。

If there is a matching MySQL account, authentication against LDAP occurs. The LDAP server looks for an entry matching the user and authenticates the entry against the LDAP password:如果有匹配的MySQL帐户，则会进行LDAP身份验证。LDAP服务器查找与用户匹配的条目，并根据LDAP密码对条目进行身份验证：

If the LDAP server finds no match or multiple matches, authentication fails and the client connection is rejected.如果LDAP服务器没有找到匹配项或找到多个匹配项，则身份验证失败，客户端连接被拒绝。

If the LDAP server finds a single match, LDAP authentication succeeds (assuming that the password is correct), the LDAP server returns the LDAP entry, and the authentication plugin determines the name of the authenticated user based on that entry:如果LDAP服务器找到一个匹配项，LDAP身份验证成功（假设密码正确），LDAP服务器返回LDAP条目，身份验证插件根据该条目确定经过身份验证的用户的名称：

The MySQL server compares the client user name with the authenticated user name to determine whether proxying occurs for the client session:MySQL服务器将客户端用户名与经过身份验证的用户名进行比较，以确定客户端会话是否发生代理：

This section describes how to install the LDAP authentication plugins. For general information about installing plugins, see Section 5.6.1, “Installing and Uninstalling Plugins”.本节介绍如何安装LDAP身份验证插件。有关安装插件的一般信息，请参阅第5.6.1节，“安装和卸载插件”。

To be usable by the server, the plugin library files must be located in the MySQL plugin directory (the directory named by the plugin_dir system variable). 为了让服务器使用，插件库文件必须位于MySQL插件目录（由plugin_dir系统变量命名的目录）中。If necessary, configure the plugin directory location by setting the value of plugin_dir at server startup.如有必要，在服务器启动时通过设置plugin_dir的值来配置插件目录位置。

The server-side plugin library file base names are authentication_ldap_simple and authentication_ldap_sasl. The file name suffix differs per platform (for example, .so for Unix and Unix-like systems, .dll for Windows).服务器端插件库文件库名为authentication_ldap_simple和authentication_ldap_sasl。文件名后缀因平台而异（例如，用于Unix和类Unix系统的.so，用于Windows的.dll）。

To load the plugins at server startup, use --plugin-load-add options to name the library files that contain them. With this plugin-loading method, the options must be given each time the server starts. 要在服务器启动时加载插件，请使用--plugin-load-add选项来命名包含它们的库文件。使用此插件加载方法，每次服务器启动时都必须给出选项。Also, specify values for any plugin-provided system variables you wish to configure.此外，为您要配置的任何插件提供的系统变量指定值。

Each server-side LDAP plugin exposes a set of system variables that enable its operation to be configured. Setting most of these is optional, but you must set the variables that specify the LDAP server host (so the plugin knows where to connect) and base distinguished name for LDAP bind operations (to limit the scope of searches and obtain faster searches). 每个服务器端LDAP插件都公开了一组系统变量，使其操作能够被配置。设置其中大部分是可选的，但您必须设置指定LDAP服务器主机（以便插件知道连接的位置）和LDAP绑定操作的基本可分辨名称（以限制搜索范围并获得更快的搜索）的变量。For details about all LDAP system variables, see Section 6.4.1.11, “Pluggable Authentication System Variables”.有关所有LDAP系统变量的详细信息，请参阅第6.4.1.11节，“可插拔身份验证系统变量”。

To load the plugins and set the LDAP server host and base distinguished name for LDAP bind operations, put lines such as these in your my.cnf file, adjusting the .so suffix for your platform as necessary:要加载插件并为LDAP绑定操作设置LDAP服务器主机和基本可分辨名称，请在mycnf文件中放入以下行，根据需要调整平台的.so后缀：

[mysqld]
plugin-load-add=authentication_ldap_simple.so
authentication_ldap_simple_server_host=127.0.0.1
authentication_ldap_simple_bind_base_dn="dc=example,dc=com"
plugin-load-add=authentication_ldap_sasl.so
authentication_ldap_sasl_server_host=127.0.0.1
authentication_ldap_sasl_bind_base_dn="dc=example,dc=com"

After modifying my.cnf, restart the server to cause the new settings to take effect.修改my.cnf后，重新启动服务器以使新设置生效。

Alternatively, to load the plugins at runtime, use these statements, adjusting the .so suffix for your platform as necessary:或者，要在运行时加载插件，请使用以下语句，根据需要调整您的平台的.so后缀：

INSTALL PLUGIN authentication_ldap_simple
  SONAME 'authentication_ldap_simple.so';
INSTALL PLUGIN authentication_ldap_sasl
  SONAME 'authentication_ldap_sasl.so';

INSTALL PLUGIN loads the plugin immediately, and also registers it in the mysql.plugins system table to cause the server to load it for each subsequent normal startup without the need for --plugin-load-add.INSTALL PLUGIN会立即加载插件，并将其注册到mysql.plugins系统表中，以便服务器在每次后续正常启动时加载它，而不需要--plugin-load-add。

After installing the plugins at runtime, their system variables become available and you can add settings for them to your my.cnf file to configure the plugins for subsequent restarts. For example:在运行时安装插件后，它们的系统变量变为可用，您可以将它们的设置添加到my.cnf文件中，以配置插件以便后续重新启动。例如：

[mysqld]
authentication_ldap_simple_server_host=127.0.0.1
authentication_ldap_simple_bind_base_dn="dc=example,dc=com"
authentication_ldap_sasl_server_host=127.0.0.1
authentication_ldap_sasl_bind_base_dn="dc=example,dc=com"

After modifying my.cnf, restart the server to cause the new settings to take effect.修改my.cnf后，重新启动服务器以使新设置生效。

Alternatively, to set and persist the values at runtime, use these statements:或者，要在运行时设置和持久化这些值，请使用以下语句：

SET PERSIST authentication_ldap_simple_server_host='127.0.0.1';
SET PERSIST authentication_ldap_simple_bind_base_dn='dc=example,dc=com';
SET PERSIST authentication_ldap_sasl_server_host='127.0.0.1';
SET PERSIST authentication_ldap_sasl_bind_base_dn='dc=example,dc=com';

SET PERSIST sets the value for the running MySQL instance. It also saves the value, causing it to carry over to subsequent server restarts. SET PERSIST设置正在运行的MySQL实例的值。它还保存了该值，使其延续到后续的服务器重启。To change a value for the running MySQL instance without having it carry over to subsequent restarts, use the GLOBAL keyword rather than PERSIST. 要更改正在运行的MySQL实例的值而不将其转移到后续重新启动，请使用GLOBAL关键字而不是PERSIST。See Section 13.7.6.1, “SET Syntax for Variable Assignment”.请参阅第13.7.6.1节，“变量赋值的SET语法”。

To verify plugin installation, examine the INFORMATION_SCHEMA.PLUGINS table or use the SHOW PLUGINS statement (see Section 5.6.2, “Obtaining Server Plugin Information”). For example:要验证插件安装，请检查INFORMATION_SCHEMALUGINS表或使用SHOW PLUGINS语句（请参阅第5.6.2节，“获取服务器插件信息”）。例如：

mysql> SELECT PLUGIN_NAME, PLUGIN_STATUS
FROM INFORMATION_SCHEMA.PLUGINS
WHERE PLUGIN_NAME LIKE '%ldap%';
+----------------------------+---------------+
| PLUGIN_NAME                | PLUGIN_STATUS |
+----------------------------+---------------+
| authentication_ldap_sasl   | ACTIVE        |
| authentication_ldap_simple | ACTIVE        |
+----------------------------+---------------+

If a plugin fails to initialize, check the server error log for diagnostic messages.如果插件初始化失败，请检查服务器错误日志中的诊断消息。

To associate MySQL accounts with an LDAP plugin, see Using LDAP Pluggable Authentication.要将MySQL帐户与LDAP插件相关联，请参阅使用LDAP可插拔身份验证。

The method used to uninstall the LDAP authentication plugins depends on how you installed them:用于卸载LDAP身份验证插件的方法取决于您的安装方式：

In addition, remove from your my.cnf file any startup options that set LDAP plugin-related system variables. 此外，从my.cnf文件中删除任何设置LDAP插件相关系统变量的启动选项。If you used SET PERSIST to persist LDAP system variables, use RESET PERSIST to remove the settings.如果使用SET PERSIST持久化LDAP系统变量，请使用RESET PERSIST删除设置。

For installations that use OpenLDAP, the ldap.conf file provides global defaults for LDAP clients. 对于使用OpenLDAP的安装，ldap.conf文件为LDAP客户端提供了全局默认值。Options can be set in this file to affect LDAP clients, including the LDAP authentication plugins. OpenLDAP uses configuration options in this order of precedence:可以在此文件中设置选项以影响LDAP客户端，包括LDAP身份验证插件。OpenLDAP按以下优先级顺序使用配置选项：

If the library defaults or ldap.conf values do not yield appropriate option values, an LDAP authentication plugin may be able to set related variables to affect the LDAP configuration directly. 如果库默认值或ldap.conf值没有产生适当的选项值，LDAP身份验证插件可能能够设置相关变量来直接影响LDAP配置。For example, LDAP plugins can override ldap.conf for parameters such as these:例如，LDAP插件可以覆盖ldap.conf的以下参数：

For more information about ldap.conf consult the ldap.conf(5) man page.有关ldap.conf的更多信息，请参阅ldap.conf(5)手册页。

This section describes how to enable MySQL accounts to connect to the MySQL server using LDAP pluggable authentication. 本节介绍如何使用LDAP可插拔身份验证使MySQL帐户连接到MySQL服务器。It is assumed that the server is running with the appropriate server-side plugins enabled, as described in Installing LDAP Pluggable Authentication, and that the appropriate client-side plugins are available on the client host.假设服务器在启用了适当的服务器端插件的情况下运行，如安装LDAP可插拔身份验证中所述，并且客户端主机上有适当的客户端插件可用。

This section does not describe LDAP configuration or administration. You are assumed to be familiar with those topics.本节不描述LDAP配置或管理。假设您熟悉这些主题。

The two server-side LDAP plugins each work with a specific client-side plugin:两个服务器端LDAP插件各自与一个特定的客户端插件配合使用：

Overall requirements for LDAP authentication of MySQL users:MySQL用户LDAP身份验证的总体要求：

The instructions here assume the following scenario:这里的说明假设了以下情况：

The instructions for setting up an account that uses LDAP authentication depend on which server-side LDAP plugin is used. The following sections describe several usage scenarios.设置使用LDAP身份验证的帐户的说明取决于使用的服务器端LDAP插件。以下部分描述了几个使用场景。

To configure a MySQL account for simple LDAP authentication, the CREATE USER statement specifies the authentication_ldap_simple plugin, and optionally names the LDAP user distinguished name (DN):要配置MySQL帐户进行简单的LDAP身份验证，CREATE USER语句指定authentication_LDAP_simple插件，并可选择命名LDAP用户可分辨名称（DN）：

CREATE USER user
  IDENTIFIED WITH authentication_ldap_simple
  [BY 'LDAP user DN'];

Suppose that MySQL user betsy has this entry in the LDAP directory:假设MySQL用户betsy在LDAP目录中有以下条目：

uid=betsy_ldap,ou=People,dc=example,dc=com

Then the statement to create the MySQL account for betsy looks like this:然后，为betsy创建MySQL帐户的语句如下：

CREATE USER 'betsy'@'localhost'
  IDENTIFIED WITH authentication_ldap_simple
  AS 'uid=betsy_ldap,ou=People,dc=example,dc=com';

The authentication string specified in the BY clause does not include the LDAP password. That must be provided by the client user at connect time.BY子句中指定的身份验证字符串不包括LDAP密码。这必须由客户端用户在连接时提供。

Clients connect to the MySQL server by providing the MySQL user name and LDAP password, and by enabling the client-side mysql_clear_password plugin:客户端通过提供MySQL用户名和LDAP密码，并启用客户端mysql_clear_password插件连接到MySQL服务器：

shell> mysql --user=betsy --password --enable-cleartext-plugin
Enter password: betsy_password (betsy_ldap LDAP password)

The authentication process occurs as follows:身份验证过程如下：

Had the matching LDAP entry contained a group attribute, that attribute value would have been the authenticated user name and, if the value differed from betsy, proxying would have occurred. 如果匹配的LDAP条目包含组属性，则该属性值将是经过身份验证的用户名，如果该值与betsy不同，则会发生代理。For examples that use the group attribute, see LDAP Authentication with Proxying.有关使用组属性的示例，请参阅LDAP代理身份验证。

Had the CREATE USER statement contained no BY clause to specify the betsy_ldap LDAP distinguished name, authentication attempts would use the user name provided by the client (in this case, betsy). 如果CREATE USER语句不包含用于指定betsy_ldap LDAP可分辨名称的BY子句，则身份验证尝试将使用客户端提供的用户名（在本例中为betsy）。In the absence of an LDAP entry for betsy, authentication would fail.如果betsy没有LDAP条目，身份验证将失败。

To configure a MySQL account for SASL LDAP authentication, the CREATE USER statement specifies the authentication_ldap_sasl plugin, and optionally names the LDAP user distinguished name (DN):要为SASL LDAP身份验证配置MySQL帐户，CREATE USER语句指定authentication_ldap_sasl插件，并可选择命名LDAP用户可分辨名称（DN）：

CREATE USER user
  IDENTIFIED WITH authentication_ldap_sasl
  [BY 'LDAP user DN'];

Suppose that MySQL user boris has this entry in the LDAP directory:假设MySQL用户boris在LDAP目录中有以下条目：

uid=boris_ldap,ou=People,dc=example,dc=com

Then the statement to create the MySQL account for boris looks like this:然后，为boris创建MySQL帐户的语句如下：

CREATE USER 'boris'@'localhost'
  IDENTIFIED WITH authentication_ldap_sasl
  AS 'uid=boris_ldap,ou=People,dc=example,dc=com';

The authentication string specified in the BY clause does not include the LDAP password. That must be provided by the client user at connect time.BY子句中指定的身份验证字符串不包括LDAP密码。这必须由客户端用户在连接时提供。

Clients connect to the MySQL server by providing the MySQL user name and LDAP password:客户端通过提供MySQL用户名和LDAP密码连接到MySQL服务器：

shell> mysql --user=boris --password
Enter password: boris_password (boris_ldap LDAP password)

For the server-side authentication_ldap_sasl plugin, clients use the client-side authentication_ldap_sasl_client plugin. If a client program does not find the client-side plugin, specify a --plugin-dir option that names the directory where the plugin library file is installed.对于服务器端authentication_ldap_sasl插件，客户端使用客户端authentication_ldap_sasl_client插件。如果客户端程序找不到客户端插件，请指定一个--plugin-dir选项，该选项命名安装插件库文件的目录。

The authentication process for boris is similar to that previously described for betsy with simple LDAP authentication, except that the client-side and server-side SASL LDAP plugins use SASL messages for secure transmission of credentials within the LDAP protocol, to avoid sending the cleartext password between the MySQL client and server.boris的身份验证过程类似于之前描述的betsy的简单LDAP身份验证过程，除了客户端和服务器端的SASL LDAP插件使用SASL消息在LDAP协议中安全传输凭据，以避免在MySQL客户端和服务器之间发送明文密码。

LDAP authentication plugins support proxying, enabling a user to connect to the MySQL server as one user but assume the privileges of a different user. This section describes basic LDAP plugin proxy support. LDAP身份验证插件支持代理，使用户能够以一个用户的身份连接到MySQL服务器，但承担其他用户的权限。本节介绍基本的LDAP插件代理支持。The LDAP plugins also support specification of group preference and proxy user mapping; see LDAP Authentication Group Preference and Mapping Specification.LDAP插件还支持组偏好和代理用户映射的规范；请参阅LDAP身份验证组首选项和映射规范。

The proxying implementation described here is based on use of LDAP group attribute values to map connecting MySQL users who authenticate using LDAP onto other MySQL accounts that define different sets of privileges. 这里描述的代理实现基于使用LDAP组属性值将使用LDAP进行身份验证的MySQL连接用户映射到定义不同权限集的其他MySQL帐户上。Users do not connect directly through the accounts that define the privileges. Instead, they connect through a default proxy account authenticated with LDAP, such that all external logins are mapped to the proxied MySQL accounts that hold the privileges. 用户不直接通过定义权限的帐户进行连接。相反，它们通过一个经过LDAP身份验证的默认代理帐户进行连接，这样所有外部登录都会映射到拥有特权的代理MySQL帐户。Any user who connects using the proxy account is mapped to one of those proxied MySQL accounts, the privileges for which determine the database operations permitted to the external user.任何使用代理帐户连接的用户都会映射到其中一个代理的MySQL帐户，其权限决定了允许外部用户进行的数据库操作。

The instructions here assume the following scenario:这里的说明假设了以下情况：

Create the default proxy MySQL account:创建默认代理MySQL帐户：

CREATE USER ''@'%'
  IDENTIFIED WITH authentication_ldap_sasl;

The proxy account definition has no AS 'auth_string' clause to name an LDAP user DN. Thus:代理帐户定义没有AS 'auth_string'子句来命名LDAP用户DN。因此：

Create the proxied accounts and grant to each one the privileges it should have:创建代理帐户并授予每个帐户应有的权限：

CREATE USER 'accounting'@'localhost'
  IDENTIFIED WITH mysql_no_login;
CREATE USER 'front_office'@'localhost'
  IDENTIFIED WITH mysql_no_login;

GRANT ALL PRIVILEGES
  ON accountingdb.*
  TO 'accounting'@'localhost';
GRANT ALL PRIVILEGES
  ON frontdb.*
  TO 'front_office'@'localhost';

The proxied accounts use the mysql_no_login authentication plugin to prevent clients from using the accounts to log in directly to the MySQL server. 代理帐户使用mysql_no_login身份验证插件来防止客户端使用帐户直接登录mysql服务器。Instead, users who authenticate using LDAP are expected to use the default ''@'%' proxy account. 相反，使用LDAP进行身份验证的用户应使用默认的''@'%'代理帐户。(This assumes that the mysql_no_login plugin is installed. （这假设已安装mysql_no_login插件。For instructions, see Section 6.4.1.8, “No-Login Pluggable Authentication”.) 有关说明，请参阅第6.4.1.8节，“无登录可插拔身份验证”。）For alternative methods of protecting proxied accounts against direct use, see Preventing Direct Login to Proxied Accounts.有关保护代理帐户免受直接使用的替代方法，请参阅防止直接登录代理帐户。

Grant to the proxy account the PROXY privilege for each proxied account:为每个代理帐户授予PROXY权限：

GRANT PROXY
  ON 'accounting'@'localhost'
  TO ''@'%';
GRANT PROXY
  ON 'front_office'@'localhost'
  TO ''@'%';

Use the mysql command-line client to connect to the MySQL server as basha.使用mysql命令行客户端以basha连接到mysql服务器。

shell> mysql --user=basha --password
Enter password: basha_password (basha LDAP password)

Authentication occurs as follows:身份验证过程如下：

This demonstrates that basha uses the privileges granted to the proxied accounting MySQL account, and that proxying occurs through the default proxy user account.这表明basha使用授予代理会计MySQL帐户的权限，并且代理是通过默认代理用户帐户进行的。

Now connect as basil instead:现在改用basil连接：

shell> mysql --user=basil --password
Enter password: basil_password (basil LDAP password)

The authentication process for basil is similar to that previously described for basha:basil的身份验证过程与之前描述的basha类似：

This demonstrates that basil uses the privileges granted to the proxied front_office MySQL account, and that proxying occurs through the default proxy user account.这表明basil使用授予代理的front_office MySQL帐户的权限，并且代理是通过默认代理用户帐户进行的。

As described in LDAP Authentication with Proxying, basic LDAP authentication proxying works by the principle that the plugin uses the first group name returned by the LDAP server as the MySQL proxied user account name. 如LDAP身份验证与代理中所述，基本LDAP身份验证代理的工作原理是插件使用LDAP服务器返回的第一个组名作为MySQL代理的用户帐户名。This simple capability does not enable specifying any preference about which group name to use if the LDAP server returns multiple group names, or specifying any name other than the group name as the proxied user name.如果LDAP服务器返回多个组名，则此简单功能无法指定要使用的组名的任何首选项，也无法指定组名以外的任何名称作为代理用户名。

As of MySQL 8.0.14, for MySQL accounts that use LDAP authentication, the authentication string can specify the following information to enable greater proxying flexibility:从MySQL 8.0.14开始，对于使用LDAP身份验证的MySQL帐户，身份验证字符串可以指定以下信息，以实现更大的代理灵活性：

Consider the following MySQL proxy account definition:考虑以下MySQL代理帐户定义：

CREATE USER ''@'%'
  IDENTIFIED WITH authentication_ldap_sasl
  AS '+ou=People,dc=example,dc=com#grp1=usera,grp2,grp3=userc';

The authentication string has a user DN suffix ou=People,dc=example,dc=com prefixed by the + character. 身份验证字符串具有用户DN后缀ou=People,dc=example,dc=com，前缀为+字符。Thus, as described in LDAP Authentication User DN Suffixes, the full user DN is constructed from the user DN suffix as specified, plus the client user name as the uid attribute.因此，如LDAP身份验证用户DN后缀中所述，完整用户DN是由指定的用户DN后缀加上客户端用户名作为uid属性构建的。

The remaining part of the authentication string begins with #, which signifies the beginning of group preference and mapping information. 身份验证字符串的其余部分以#开头，表示组首选项和映射信息的开始。This part of the authentication string lists group names in the order grp1, grp2, grp3. 这部分身份验证字符串按grp1、grp2、grp3的顺序列出组名。The LDAP plugin compares that list with the set of group names returned by the LDAP server, looking in list order for a match against the returned names. The plugin uses the first match, or if there is no match, authentication fails.LDAP插件将该列表与LDAP服务器返回的组名集进行比较，按列表顺序查找与返回名称的匹配。插件使用第一个匹配，或者如果没有匹配，则身份验证失败。

Suppose that the LDAP server returns groups grp3, grp2, and grp7. 假设LDAP服务器返回组grp3、grp2和grp7。The LDAP plugin uses grp2 because it is the first group in the authentication string that matches, even though it is not the first group returned by the LDAP server. LDAP插件使用grp2，因为它是身份验证字符串中第一个匹配的组，即使它不是LDAP服务器返回的第一个组。If the LDAP server returns grp4, grp2, and grp1, the plugin uses grp1 even though grp2 also matches. 如果LDAP服务器返回grp4、grp2和grp1，则插件将使用grp1，即使grp2也匹配。grp1 has a precedence higher than grp2 because it is listed earlier in the authentication string.grp1的优先级高于grp2，因为它在身份验证字符串中较早列出。

Assuming that the plugin finds a group name match, it performs mapping from that group name to the MySQL proxied user name, if there is one. For the example proxy account, mapping occurs as follows:假设插件找到一个组名匹配，它会执行从该组名到MySQL代理用户名的映射（如果有的话）。对于示例代理帐户，映射过程如下：

If the LDAP server returns a group in DN format, the LDAP plugin parses the group DN to extract the group name from it.如果LDAP服务器返回DN格式的组，LDAP插件将解析组DN以从中提取组名。

To specify LDAP group preference and mapping information, these principles apply:要指定LDAP组首选项和映射信息，请应用以下原则：

LDAP authentication plugins permit the authentication string that provides user DN information to begin with a + prefix character:LDAP身份验证插件允许提供用户DN信息的身份验证字符串以+前缀字符开头：

This account authentication string does not have + at the beginning, so it is taken as the full user DN:此帐户身份验证字符串开头没有+，因此将其视为完整用户DN：

CREATE USER 'baldwin'
  IDENTIFIED WITH authentication_ldap_simple
  AS 'uid=admin,ou=People,dc=example,dc=com';

The client connects with the user name specified in the account (baldwin). In this case, that name is not used because the authentication string has no prefix and thus fully specifies the user DN.客户端使用帐户中指定的用户名（baldwin）进行连接。在这种情况下，不使用该名称，因为身份验证字符串没有前缀，因此完全指定了用户DN。

This account authentication string does have + at the beginning, so it is taken as just part of the user DN:此帐户身份验证字符串的开头确实有+，因此它仅被视为用户DN的一部分：

CREATE USER 'accounting'
  IDENTIFIED WITH authentication_ldap_simple
  AS '+ou=People,dc=example,dc=com';

The client connects with the user name specified in the account (accounting), which in this case is used as the uid attribute together with the authentication string to construct the user DN: uid=accounting,ou=People,dc=example,dc=com客户端使用帐户（accounting）中指定的用户名连接，在这种情况下，该用户名与身份验证字符串一起用作uid属性，以构造用户DN：uid=accounting,ou=People,dc=example,dc=com

The accounts in the preceding examples have a nonempty user name, so the client always connects to the MySQL server using the same name as specified in the account definition. 前面示例中的帐户具有非空用户名，因此客户端始终使用帐户定义中指定的相同名称连接到MySQL服务器。If an account has an empty user name, such as the default anonymous ''@'%' proxy account described in LDAP Authentication with Proxying, clients might connect to the MySQL server with varying user names. 如果帐户的用户名为空，例如LDAP代理身份验证中描述的默认匿名''@'%'代理帐户，客户端可能会使用不同的用户名连接到MySQL服务器。But the principle is the same: If the authentication string begins with +, the plugin uses the user name sent by the client together with the authentication string to construct the user DN.但原理是一样的：如果身份验证字符串以+开头，插件将使用客户端发送的用户名和身份验证字符串来构造用户DN。

The LDAP authentication plugins use a configurable authentication method. The appropriate system variable and available method choices are plugin-specific:LDAP身份验证插件使用可配置的身份验证方法。适当的系统变量和可用的方法选择是特定于插件的：

See the system variable descriptions for information about each permitted method. Also, depending on the method, additional configuration may be needed, as described in the following sections.有关每种允许方法的信息，请参阅系统变量说明。此外，根据方法的不同，可能需要额外的配置，如以下部分所述。

Generic Security Service Application Program Interface (GSSAPI) is a security abstraction interface. 通用安全服务应用程序接口（GSSAPI）是一个安全抽象接口。Kerberos is an instance of a specific security protocol that can be used through that abstract interface. Using GSSAPI, applications authenticate to Kerberos to obtain service credentials, then use those credentials in turn to enable secure access to other services.Kerberos是可以通过该抽象接口使用的特定安全协议的实例。使用GSSAPI，应用程序向Kerberos进行身份验证以获取服务凭据，然后依次使用这些凭据来实现对其他服务的安全访问。

One such service is LDAP, which is used by the client-side and server-side SASL LDAP authentication plugins. 其中一种服务是LDAP，它由客户端和服务器端SASL LDAP身份验证插件使用。When the authentication_ldap_sasl_auth_method_name system variable is set to GSSAPI, these plugins use the GSSAPI/Kerberos authentication method. 当authentication_ldap_sasl_auth_method_name系统变量设置为GSSAPI时，这些插件使用GSSAPI/Kerberos身份验证方法。In this case, the plugins communicate securely using Kerberos without using LDAP messages directly. The server-side plugin then communicates with the LDAP server to interpret LDAP authentication messages and retrieve LDAP groups.在这种情况下，插件使用Kerberos进行安全通信，而不直接使用LDAP消息。然后，服务器端插件与LDAP服务器通信，以解释LDAP身份验证消息并检索LDAP组。

GSSAPI/Kerberos is supported as an authentication method for MySQL clients and servers only on Linux. It is useful in Linux environments where applications access LDAP using Microsoft Active Directory, which has Kerberos enabled by default.GSSAPI/Kerberos仅在Linux上支持作为MySQL客户端和服务器的身份验证方法。在Linux环境中，当应用程序使用默认启用Kerberos的Microsoft 活动目录访问LDAP时，它非常有用。

The following discussion provides information about the configuration requirements for using the GSSAPI method. Familiarity is assumed with Kerberos concepts and operation, such as these common Kerberos terms:以下讨论提供了有关使用GSSAPI方法的配置要求的信息。假设熟悉Kerberos概念和操作，例如这些常见的Kerberos术语：

Kerberos authentication requires both a KDC server and an LDAP server. This requirement can be satisfied in different ways:Kerberos身份验证需要KDC服务器和LDAP服务器。可以通过不同的方式满足这一要求：

Kerberos must also be available on the client host. A client contacts the AS using a password to obtain a TGT. The client then uses the TGT to obtain access from the TGS to other services, such as LDAP.Kerberos也必须在客户端主机上可用。客户端使用密码联系AS以获取TGT。然后，客户端使用TGT从TGS访问其他服务，如LDAP。

The following sections discuss the configuration steps to use GSSAPI/Kerberos for SASL LDAP authentication in MySQL:以下部分讨论了在MySQL中使用GSSAPI/Kerberos进行SASL LDAP身份验证的配置步骤：

Check the Kerberos Setup检查Kerberos安装程序

The following example shows how to test availability of Kerberos in Active Directory. The example makes these assumptions:以下示例显示了如何在活动目录中测试Kerberos的可用性。该示例做出了以下假设：

With those assumptions satisfied, follow this procedure:在满足这些假设的情况下，请遵循以下程序：

Configure the Server-Side SASL LDAP Authentication Plugin for GSSAPI/Kerberos为GSSAPI/Kerberos配置服务器端SASL LDAP身份验证插件

Assuming that the LDAP server is accessible through Kerberos as just described, configure the server-side SASL LDAP authentication plugin to use the GSSAPI/Kerberos authentication method. 假设LDAP服务器可以通过Kerberos访问，如上所述，配置服务器端SASL LDAP身份验证插件以使用GSSAPI/Kerberos身份验证方法。(For general LDAP plugin installation information, see Installing LDAP Pluggable Authentication.) （有关LDAP插件的一般安装信息，请参阅安装LDAP可插拔身份验证。）Here is an example of plugin-related settings the server my.cnf file might contain:以下是服务器my.cnf文件可能包含的插件相关设置示例：

[mysqld]
plugin-load-add=authentication_ldap_sasl.so
authentication_ldap_sasl_auth_method_name="GSSAPI"
authentication_ldap_sasl_server_host=198.51.100.10
authentication_ldap_sasl_server_port=389
authentication_ldap_sasl_bind_root_dn="cn=admin,cn=users,dc=MYSQL,dc=LOCAL"
authentication_ldap_sasl_bind_root_pwd="password"
authentication_ldap_sasl_bind_base_dn="cn=users,dc=MYSQL,dc=LOCAL"
authentication_ldap_sasl_user_search_attr="sAMAccountName"

Those option file settings configure the SASL LDAP plugin as follows:这些选项文件设置按如下方式配置SASL LDAP插件：

Create a MySQL Account That Uses GSSAPI/Kerberos创建一个使用GSSAPI/Kerberos的MySQL帐户

MySQL authentication using the SASL LDAP authentication plugin with the GSSAPI/Kerberos method is based on a user that is a Kerberos principal. 使用SASL LDAP身份验证插件和GSSAPI/Kerberos方法的MySQL身份验证基于Kerberos主体用户。The following discussion uses a principal named bredon@MYSQL.LOCAL as this user, which must be registered in several places:以下讨论使用了一个名为bredon@MYSQL.LOCAL作为该用户，必须在多个地方注册：

Assuming that the Kerberos principal and LDAP entry have been registered by the appropriate service administrators, and that the MySQL server has been started using the my.cnf settings previously described, create a MySQL account that corresponds to the Kerberos principal name, including the domain name.假设Kerberos主体和LDAP条目已由相应的服务管理员注册，并且MySQL服务器已使用前面描述的mycnf设置启动，则创建一个与Kerberos主体名称（包括域名）对应的MySQL帐户。

The following statements create a proxy user named bredon@MYSQL.LOCAL that assumes the privileges of the proxied user named proxied_krb_usr. Other GSSAPI/Kerberos users that should have the same privileges can similarly be created as proxy users for the same proxied user.以下语句创建了一个名为的代理用户bredon@MYSQL.LOCAL这假定了名为proxied.krb_usr的被代理用户的权限。其他应该具有相同权限的GSSAPI/Kerberos用户也可以类似地创建为同一代理用户的代理用户。

-- create proxy account
CREATE USER 'bredon@MYSQL.LOCAL'
  IDENTIFIED WITH authentication_ldap_sasl
  BY '#krb_grp=proxied_krb_user';

-- create proxied account and grant its privileges;
-- use mysql_no_login plugin to prevent direct login
CREATE USER 'proxied_krb_user'
  IDENTIFIED WITH mysql_no_login;
GRANT ALL
  ON krb_user_db.*
  TO 'proxied_krb_user';

-- grant to proxy account the
-- PROXY privilege for proxied account
GRANT PROXY
  ON 'proxied_krb_user'
  TO 'bredon@MYSQL.LOCAL';

Observe closely the quoting for the proxy account name in the first CREATE USER statement and the GRANT PROXY statement:仔细观察第一个CREATE USER语句和GRANT PROXY语句中代理帐户名称的引号：

The proxied account uses the mysql_no_login authentication plugin to prevent clients from using the account to log in directly to the MySQL server. 代理帐户使用mysql_no_login身份验证插件来防止客户端使用该帐户直接登录mysql服务器。Instead, it is expected that users who authenticate using LDAP use the bredon@MYSQL.LOCAL proxy account. (This assumes that the mysql_no_login plugin is installed. For instructions, see Section 6.4.1.8, “No-Login Pluggable Authentication”.) 相反，预计使用LDAP进行身份验证的用户会使用bredon@MYSQL.LOCAL代理帐户。（这假设已安装mysql_no_login插件。有关说明，请参阅第6.4.1.8节，“无登录可插拔身份验证”。）For alternative methods of protecting proxied accounts against direct use, see Preventing Direct Login to Proxied Accounts.有关保护代理帐户免受直接使用的替代方法，请参阅防止直接登录代理帐户。

Use the MySQL Account to Connect to the MySQL Server使用MySQL帐户连接到MySQL服务器

After a MySQL account that uses GSSAPI/Kerberos has been set up, clients can authenticate to Kerberos and use the account to connect to the MySQL server. Kerberos authentication can take place either prior to or at the time of MySQL client program invocation:在设置了使用GSSAPI/Kerberos的MySQL帐户后，客户端可以通过Kerberos进行身份验证，并使用该帐户连接到MySQL服务器。Kerberos身份验证可以在MySQL客户端程序调用之前或之时进行：

If you are uncertain whether a TGT exists, you can use klist to check.如果您不确定TGT是否存在，可以使用klist进行检查。

Authentication occurs as follows:身份验证过程如下：

A TGT once obtained is cached on the client side and can be used until it expires without specifying the password again. However the TGT is obtained, the client-side plugin uses it to acquire service tickets and communicate with the server-side plugin.一旦获得TGT，它就会在客户端缓存，并且可以在到期之前使用，而无需再次指定密码。无论如何获得TGT，客户端插件都会使用它来获取服务票并与服务器端插件通信。

When the client-side plugin itself obtains the TGT, the client user may not want the TGT to be reused. 当客户端插件本身获得TGT时，客户端用户可能不希望重用TGT。As described in /etc/krb5.conf Client Configuration Parameters, the local /etc/krb5.conf file can be used to cause the client-side plugin to destroy the TGT when done with it.如/etc/krb5.conf客户端配置参数中所述，本地/etc/krb5.conf文件可用于使客户端插件在完成TGT后销毁TGT。

The server-side plugin has no access to the TGT itself or the Kerberos password used to obtain it.服务器端插件无法访问TGT本身或用于获取TGT的Kerberos密码。

The LDAP authentication plugins have no control over the caching mechanism (storage in a local file, in memory, and so forth), but Kerberos utilities such as kswitch may be available for this purpose.LDAP身份验证插件无法控制缓存机制（存储在本地文件、内存等中），但kswitch等Kerberos实用程序可能可用于此目的。

/etc/krb5.conf Client Configuration Parameters客户端配置参数

The client-side SASL LDAP plugin reads the local /etc/krb5.conf file. 客户端SASL LDAP插件读取本地/etc/krb5.conf文件。If this file is missing or inaccessible, an error occurs. 如果此文件丢失或无法访问，则会发生错误。Assuming that the file is accessible, the optional [appdefaults] section can be used to provide information used by the plugin. 假设文件是可访问的，则可选的[appdefaults]部分可用于提供插件使用的信息。Place such information within the MySQL part of the section. For example:将此类信息放在该部分的MySQL部分。例如：

[appdefaults]
  MySQL = {
    ldap_server_host = "ldap_host.example.com"
    ldap_destroy_tgt = true
  }

The client-side plugin recognizes these parameters in the MySQL section:客户端插件在MySQL部分识别这些参数：

An LDAP server can be configured to delegate LDAP searches to another LDAP server, a functionality known as LDAP referral. LDAP服务器可以配置为将LDAP搜索委托给另一个LDAP服务器，这一功能称为LDAP引用。Suppose that the server a.example.com holds a "dc=example,dc=com" root DN and wishes to delegate searches to another server b.example.com. 假设服务器a.example.com拥有一个"dc=example,dc=com"根DN，并希望将搜索委托给另一个服务器b.example.com。To enable this, a.example.com would be configured with a named referral object having these attributes:为了实现这一点，a.example.com将配置一个具有以下属性的命名引用对象：

dn: dc=subtree,dc=example,dc=com
objectClass: referral
objectClass: extensibleObject
dc: subtree
ref: ldap://b.example.com/dc=subtree,dc=example,dc=com

An issue with enabling LDAP referral is that searches can fail with LDAP operation errors when the search base DN is the root DN, and referral objects are not set. 启用LDAP引用的一个问题是，当搜索基DN是根DN并且未设置引用对象时，搜索可能会因LDAP操作错误而失败。A MySQL DBA might wish to avoid such referral errors for the LDAP authentication plugins, even though LDAP referral might be set globally in the ldap.conf configuration file. MySQL DBA可能希望避免LDAP身份验证插件出现此类引用错误，即使LDAP引用可能在ldap.conf配置文件中全局设置。To configure on a plugin-specific basis whether the LDAP server should use LDAP referral when communicating with each plugin, set the authentication_ldap_simple_referral and authentication_ldap_sasl_referral system variables. 要在特定于插件的基础上配置LDAP服务器在与每个插件通信时是否应使用LDAP引用，请设置authentication_ldap_simple_referral和authentication_ldap_sasl_referral系统变量。Setting either variable to ON or OFF causes the corresponding LDAP authentication plugin to tell the LDAP server whether to use referral during MySQL authentication. 将变量设置为ON或OFF会导致相应的LDAP身份验证插件告诉LDAP服务器在MySQL身份验证期间是否使用引用。Each variable has a plugin-specific effect and does not affect other applications that communicate with the LDAP server. Both variables are OFF by default.每个变量都有特定于插件的效果，不会影响与LDAP服务器通信的其他应用程序。默认情况下，这两个变量都是OFF的。