The first part of this section describes general restrictions on the applicability of the pluggable authentication framework described at Section 6.3.7, “Pluggable Authentication”. The second part describes how third-party connector developers can determine the extent to which a connector can take advantage of pluggable authentication capabilities and what steps to take to become more compliant.
The term “native authentication” used here refers to
authentication against passwords stored in the
Password column of the
mysql.user table. This is the same
authentication method provided by older MySQL servers, before
pluggable authentication was implemented. It remains the default
method, although now it is implemented using plugins.
“Windows native authentication” refers to
authentication using the credentials of a user who has already
logged in to Windows, as implemented by the Windows Native
Authentication plugin (“Windows plugin” for short).
Connector/C, Connector/C++: Clients that use these connectors can connect to the server only through accounts that use native authentication.
Exception: A connector supports pluggable authentication if it
was built to link to
dynamically (rather than statically) and it loads the current
libmysqlclient if that version
is installed, or if the connector is recompiled from source to
link against the current
Connector/J: Clients that use this connector can connect to the server only through accounts that use native authentication.
Connector/Net: Before Connector/Net 6.4.4, clients that use this connector can connect to the server only through accounts that use native authentication. As of 6.4.4, clients can also connect to the server through accounts that use the Windows plugin.
Connector/ODBC 3.51.29 and 5.1.9, clients that use this
connector can connect to the server only through accounts that
use native authentication. As of 3.51.29 and 5.1.9, clients
that use binary releases of this connector for Windows can
also connect to the server through accounts that use the PAM
or Windows plugins. (These capabilities result from linking
the Connector/ODBC binaries against the MySQL 5.5.16
libmysqlclient rather than the MySQL 5.1
libmysqlclient used previously. The newer
libmysqlclient includes the client-side
support needed for the server-side PAM and Windows
Connector/PHP: Clients that
use this connector can connect to the server only through
accounts that use native authentication, when compiled using
the MySQL native driver for PHP (
MySQL Proxy: Before MySQL Proxy 0.8.2, clients can connect to the server only through accounts that use native authentication. As of 0.8.2, clients can also connect to the server through accounts that use the PAM plugin. As of 0.8.3, clients can also connect to the server through accounts that use the Windows plugin.
MySQL Enterprise Backup: MySQL Enterprise Backup before version 3.6.1 supports connections to the server only through accounts that use native authentication. As of 3.6.1, MySQL Enterprise Backup can connect to the server through accounts that use nonnative authentication.
Windows native authentication: Connecting through an account that uses the Windows plugin requires Windows Domain setup. Without it, NTLM authentication is used and then only local connections are possible; that is, the client and server must run on the same computer.
Proxy users: Proxy user support is available to the extent that clients can connect through accounts authenticated with plugins that implement proxy user capability (that is, plugins that can return a user name different from that of the connecting user). For example, the native authentication plugins do not support proxy users, whereas the PAM and Windows plugins do.
slaves can employ not only master accounts using native
authentication, but can also connect through master accounts
that use nonnative authentication if the required client-side
plugin is available. If the plugin is built into
libmysqlclient, it is available by default.
Otherwise, the plugin must be installed on the slave side in
the directory named by the slave
plugin_dir system variable.
Third-party connector developers can use the following guidelines to determine readiness of a connector to take advantage of pluggable authentication capabilities and what steps to take to become more compliant:
An existing connector to which no changes have been made uses native authentication and clients that use the connector can connect to the server only through accounts that use native authentication. However, you should test the connector against a recent version of the server to verify that such connections still work without problem.
Exception: A connector might work with pluggable
authentication without any changes if it links to
libmysqlclient dynamically (rather than
statically) and it loads the current version of
libmysqlclient if that version is
To take advantage of pluggable authentication capabilities, a
connector that is
should be relinked against the current version of
libmysqlclient. This enables the connector
to support connections though accounts that require
client-side plugins now built into
libmysqlclient (such as the cleartext
plugin needed for PAM authentication and the Windows plugin
needed for Windows native authentication). Linking with a
libmysqlclient also enables the
connector to access client-side plugins installed in the
default MySQL plugin directory (typically the directory named
by the default value of the local server's
plugin_dir system variable).
If a connector links to
dynamically, it must be ensured that the newer version of
libmysqlclient is installed on the client
host and that the connector loads it at runtime.
Another way for a connector to support a given authentication method is to implement it directly in the client/server protocol. Connector/Net uses this approach to provide support for Windows native authentication.
If a connector should be able to load client-side plugins from
a directory different from the default plugin directory, it
must implement some means for client users to specify the
directory. Possibilities for this include a command-line
option or environment variable from which the connector can
obtain the directory name. Standard MySQL client programs such
as mysql and mysqladmin
--plugin-dir option. See also
Section 21.8.14, “C API Client Plugin Functions”.
Proxy user support by a connector depends, as described earlier in this section, on whether the authentication methods that it supports permit proxy users.