Documentation Home
MySQL Restrictions and Limitations
Related Documentation Download this Excerpt
PDF (US Ltr) - 275.9Kb
PDF (A4) - 275.3Kb


MySQL Restrictions and Limitations  /  Restrictions on Pluggable Authentication

Chapter 9 Restrictions on Pluggable Authentication

The first part of this section describes general restrictions on the applicability of the pluggable authentication framework described atPluggable Authentication. The second part describes how third-party connector developers can determine the extent to which a connector can take advantage of pluggable authentication capabilities and what steps to take to become more compliant.

The term“native authentication” used here refers to authentication against passwords stored in themysql.user system table. This is the same authentication method provided by older MySQL servers, before pluggable authentication was implemented.“Windows native authentication” refers to authentication using the credentials of a user who has already logged in to Windows, as implemented by the Windows Native Authentication plugin (“Windows plugin” for short).

General Pluggable Authentication Restrictions

  • Connector/C++: Clients that use this connector can connect to the server only through accounts that use native authentication.

    Exception: A connector supports pluggable authentication if it was built to link tolibmysqlclient dynamically (rather than statically) and it loads the current version oflibmysqlclient if that version is installed, or if the connector is recompiled from source to link against the currentlibmysqlclient.

    For information about writing connectors to handle information from the server about the default server-side authentication plugin, seeAuthentication Plugin Connector-Writing Considerations.

  • Connector/NET: Clients that use Connector/NET can connect to the server through accounts that use native authentication or Windows native authentication.

  • Connector/PHP: Clients that use this connector can connect to the server only through accounts that use native authentication, when compiled using the MySQL native driver for PHP (mysqlnd).

  • Windows native authentication: Connecting through an account that uses the Windows plugin requires Windows Domain setup. Without it, NTLM authentication is used and then only local connections are possible; that is, the client and server must run on the same computer.

  • Proxy users: Proxy user support is available to the extent that clients can connect through accounts authenticated with plugins that implement proxy user capability (that is, plugins that can return a user name different from that of the connecting user). For example, the PAM and Windows plugins support proxy users. Themysql_native_password andsha256_password authentication plugins do not support proxy users by default, but can be configured to do so; seeServer Support for Proxy User Mapping.

  • Replication: Replicas can not only employ replication user accounts using native authentication, but can also connect through replication user accounts that use nonnative authentication if the required client-side plugin is available. If the plugin is built intolibmysqlclient, it is available by default. Otherwise, the plugin must be installed on the replica side in the directory named by the replica'splugin_dir system variable.

  • FEDERATED tables: AFEDERATED table can access the remote table only through accounts on the remote server that use native authentication.

Pluggable Authentication and Third-Party Connectors

Third-party connector developers can use the following guidelines to determine readiness of a connector to take advantage of pluggable authentication capabilities and what steps to take to become more compliant:

  • An existing connector to which no changes have been made uses native authentication and clients that use the connector can connect to the server only through accounts that use native authentication.However, you should test the connector against a recent version of the server to verify that such connections still work without problem.

    Exception: A connector might work with pluggable authentication without any changes if it links tolibmysqlclient dynamically (rather than statically) and it loads the current version oflibmysqlclient if that version is installed.

  • To take advantage of pluggable authentication capabilities, a connector that islibmysqlclient-based should be relinked against the current version oflibmysqlclient. This enables the connector to support connections though accounts that require client-side plugins now built intolibmysqlclient (such as the cleartext plugin needed for PAM authentication and the Windows plugin needed for Windows native authentication). Linking with a currentlibmysqlclient also enables the connector to access client-side plugins installed in the default MySQL plugin directory (typically the directory named by the default value of the local server'splugin_dir system variable).

    If a connector links tolibmysqlclient dynamically, it must be ensured that the newer version oflibmysqlclient is installed on the client host and that the connector loads it at runtime.

  • Another way for a connector to support a given authentication method is to implement it directly in the client/server protocol. Connector/NET uses this approach to provide support for Windows native authentication.

  • If a connector should be able to load client-side plugins from a directory different from the default plugin directory, it must implement some means for client users to specify the directory. Possibilities for this include a command-line option or environment variable from which the connector can obtain the directory name. Standard MySQL client programs such asmysql andmysqladmin implement a--plugin-dir option. See alsoC API Client Plugin Interface.

  • Proxy user support by a connector depends, as described earlier in this section, on whether the authentication methods that it supports permit proxy users.