authentication_ldap_sasl for system variables with names of the form authentication_ldap_sasl_xxx

authentication_ldap_simple for system variables with names of the form authentication_ldap_simple_xxx

authentication_ldap_sasl_auth_method_name

For SASL LDAP authentication, the authentication method name. Communication between the authentication plugin and the LDAP server occurs according to this authentication method to ensure password security.

These authentication method values are permitted:

authentication_ldap_sasl_bind_base_dn

For SASL LDAP authentication, the base distinguished name (DN). This variable can be used to limit the scope of searches by anchoring them at a certain location (the “base”) within the search tree.

Suppose that members of one set of LDAP user entries each have this form:

uid=user_name,ou=People,dc=example,dc=com

And that members of another set of LDAP user entries each have this form:

uid=user_name,ou=Admin,dc=example,dc=com

Then searches work like this for different base DN values:

In general, more specific base DN values result in faster searches because they limit the search scope more.

authentication_ldap_sasl_bind_root_dn

For SASL LDAP authentication, the root distinguished name (DN). This variable is used in conjunction with authentication_ldap_sasl_bind_root_pwd as the credentials for authenticating to the LDAP server for the purpose of performing searches. Authentication uses either one or two LDAP bind operations, depending on whether the MySQL account names an LDAP user DN:

authentication_ldap_sasl_bind_root_pwd

For SASL LDAP authentication, the password for the root distinguished name. This variable is used in conjunction with authentication_ldap_sasl_bind_root_dn. See the description of that variable.

authentication_ldap_sasl_ca_path

For SASL LDAP authentication, the absolute path of the certificate authority file. Specify this file if it is desired that the authentication plugin perform verification of the LDAP server certificate.

authentication_ldap_sasl_group_search_attr

For SASL LDAP authentication, the name of the attribute that specifies group names in LDAP directory entries. If authentication_ldap_sasl_group_search_attr has its default value of cn, searches return the cn value as the group name. For example, if an LDAP entry with a uid value of user1 has a cn attribute of mygroup, searches for user1 return mygroup as the group name.

This variable should be the empty string if you want no group or proxy authentication.

As of MySQL 5.7.21, if the group search attribute is isMemberOf, LDAP authentication directly retrieves the user attribute isMemberOf value and assigns it as group information. If the group search attribute is not isMemberOf, LDAP authentication searches for all groups where the user is a member. (The latter is the default behavior.) This behavior is based on how LDAP group information can be stored two ways: 1) A group entry can have an attribute named memberUid or member with a value that is a user name; 2) A user entry can have an attribute named isMemberOf with values that are group names.

authentication_ldap_sasl_group_search_filter

For SASL LDAP authentication, the custom group search filter.

As of MySQL 5.7.22, the search filter value can contain {UA} and {UD} notation to represent the user name and the full user DN. For example, {UA} is replaced with a user name such as "admin", whereas {UD} is replaced with a use full DN such as "uid=admin,ou=People,dc=example,dc=com". The following value is the default, which supports both OpenLDAP and Active Directory:

(|(&(objectClass=posixGroup)(memberUid={UA}))
  (&(objectClass=group)(member={UD})))

Previously, if the group search attribute was isMemberOf or memberOf, it was treated as a user attribute that has group information. However, in some cases for the user scenario, memberOf was a simple user attribute that held no group information. For additional flexibility, an optional {GA} prefix now can be used with the group search attribute. (Previously, it was assumed that if the group search attribute is isMemberOf, it is treated differently. Now any group attribute with a {GA} prefix is treated as a user attribute having group names.) For example, with a value of {GA}MemberOf, if the group value is the DN, the first attribute value from the group DN is returned as the group name.

In MySQL 5.7.21, the search filter used %s notation, expanding it to the user name for OpenLDAP (&(objectClass=posixGroup)(memberUid=%s)) and to the full user DN for Active Directory (&(objectClass=group)(member=%s)).

authentication_ldap_sasl_init_pool_size

For SASL LDAP authentication, the initial size of the pool of connections to the LDAP server. Choose the value for this variable based on the average number of concurrent authentication requests to the LDAP server.

The plugin uses authentication_ldap_sasl_init_pool_size and authentication_ldap_sasl_max_pool_size together for connection-pool management:

Changes to plugin system variable settings may have no effect on connections already in the pool. For example, modifying the LDAP server host, port, or TLS settings does not affect existing connections. However, if the original variable values were invalid and the connection pool could not be initialized, the plugin attempts to reinitialize the pool for the next LDAP request. In this case, the new system variable values are used for the reinitialization attempt.

If authentication_ldap_sasl_max_pool_size=0 to disable pooling, each LDAP connection opened by the plugin uses the values the system variables have at that time.

authentication_ldap_sasl_log_status

For SASL LDAP authentication, the logging level for messages written to the error log. The following table shows the permitted level values and their meanings.

On the client side, messages can be logged to the standard output by setting the AUTHENTICATION_LDAP_CLIENT_LOG environment variable. The permitted and default values are the same as for authentication_ldap_sasl_log_status.

The AUTHENTICATION_LDAP_CLIENT_LOG environment variable applies only to SASL LDAP authentication. It has no effect for simple LDAP authentication because the client plugin in that case is mysql_clear_password, which knows nothing about LDAP operations.

authentication_ldap_sasl_max_pool_size

For SASL LDAP authentication, the maximum size of the pool of connections to the LDAP server. To disable connection pooling, set this variable to 0.

This variable is used in conjunction with authentication_ldap_sasl_init_pool_size. See the description of that variable.

authentication_ldap_sasl_server_host

For SASL LDAP authentication, the LDAP server host. The permitted values for this variable depend on the authentication method:

authentication_ldap_sasl_server_port

For SASL LDAP authentication, the LDAP server TCP/IP port number.

As of MySQL 5.7.25, if the LDAP port number is configured as 636 or 3269, the plugin uses LDAPS (LDAP over SSL) instead of LDAP. (LDAPS differs from startTLS.)

authentication_ldap_sasl_tls

For SASL LDAP authentication, whether connections by the plugin to the LDAP server are secure. If this variable is enabled, the plugin uses TLS to connect securely to the LDAP server. This variable can be set to override the default OpenLDAP TLS configuration; see LDAP Pluggable Authentication and ldap.conf If you enable this variable, you may also wish to set the authentication_ldap_sasl_ca_path variable.

MySQL LDAP plugins support the StartTLS method, which initializes TLS on top of a plain LDAP connection.

As of MySQL 5.7.25, LDAPS can be used by setting the authentication_ldap_sasl_server_port system variable.

authentication_ldap_sasl_user_search_attr

For SASL LDAP authentication, the name of the attribute that specifies user names in LDAP directory entries. If a user distinguished name is not provided, the authentication plugin searches for the name using this attribute. For example, if the authentication_ldap_sasl_user_search_attr value is uid, a search for the user name user1 finds entries with a uid value of user1.

authentication_ldap_simple_auth_method_name

For simple LDAP authentication, the authentication method name. Communication between the authentication plugin and the LDAP server occurs according to this authentication method.

These authentication method values are permitted:

authentication_ldap_simple_bind_base_dn

For simple LDAP authentication, the base distinguished name (DN). This variable can be used to limit the scope of searches by anchoring them at a certain location (the “base”) within the search tree.

Suppose that members of one set of LDAP user entries each have this form:

uid=user_name,ou=People,dc=example,dc=com

And that members of another set of LDAP user entries each have this form:

uid=user_name,ou=Admin,dc=example,dc=com

Then searches work like this for different base DN values:

In general, more specific base DN values result in faster searches because they limit the search scope more.

authentication_ldap_simple_bind_root_dn

For simple LDAP authentication, the root distinguished name (DN). This variable is used in conjunction with authentication_ldap_simple_bind_root_pwd as the credentials for authenticating to the LDAP server for the purpose of performing searches. Authentication uses either one or two LDAP bind operations, depending on whether the MySQL account names an LDAP user DN:

authentication_ldap_simple_bind_root_pwd

For simple LDAP authentication, the password for the root distinguished name. This variable is used in conjunction with authentication_ldap_simple_bind_root_dn. See the description of that variable.

authentication_ldap_simple_ca_path

For simple LDAP authentication, the absolute path of the certificate authority file. Specify this file if it is desired that the authentication plugin perform verification of the LDAP server certificate.

authentication_ldap_simple_group_search_attr

For simple LDAP authentication, the name of the attribute that specifies group names in LDAP directory entries. If authentication_ldap_simple_group_search_attr has its default value of cn, searches return the cn value as the group name. For example, if an LDAP entry with a uid value of user1 has a cn attribute of mygroup, searches for user1 return mygroup as the group name.

As of MySQL 5.7.21, if the group search attribute is isMemberOf, LDAP authentication directly retrieves the user attribute isMemberOf value and assigns it as group information. If the group search attribute is not isMemberOf, LDAP authentication searches for all groups where the user is a member. (The latter is the default behavior.) This behavior is based on how LDAP group information can be stored two ways: 1) A group entry can have an attribute named memberUid or member with a value that is a user name; 2) A user entry can have an attribute named isMemberOf with values that are group names.

authentication_ldap_simple_group_search_filter

For simple LDAP authentication, the custom group search filter.

As of MySQL 5.7.22, the search filter value can contain {UA} and {UD} notation to represent the user name and the full user DN. For example, {UA} is replaced with a user name such as "admin", whereas {UD} is replaced with a use full DN such as "uid=admin,ou=People,dc=example,dc=com". The following value is the default, which supports both OpenLDAP and Active Directory:

(|(&(objectClass=posixGroup)(memberUid={UA}))
  (&(objectClass=group)(member={UD})))

Previously, if the group search attribute was isMemberOf or memberOf, it was treated as a user attribute that has group information. However, in some cases for the user scenario, memberOf was a simple user attribute that held no group information. For additional flexibility, an optional {GA} prefix now can be used with the group search attribute. (Previously, it was assumed that if the group search attribute is isMemberOf, it is treated differently. Now any group attribute with a {GA} prefix is treated as a user attribute having group names.) For example, with a value of {GA}MemberOf, if the group value is the DN, the first attribute value from the group DN is returned as the group name.

In MySQL 5.7.21, the search filter used %s notation, expanding it to the user name for OpenLDAP (&(objectClass=posixGroup)(memberUid=%s)) and to the full user DN for Active Directory (&(objectClass=group)(member=%s)).

authentication_ldap_simple_init_pool_size

For simple LDAP authentication, the initial size of the pool of connections to the LDAP server. Choose the value for this variable based on the average number of concurrent authentication requests to the LDAP server.

The plugin uses authentication_ldap_simple_init_pool_size and authentication_ldap_simple_max_pool_size together for connection-pool management:

Changes to plugin system variable settings may have no effect on connections already in the pool. For example, modifying the LDAP server host, port, or TLS settings does not affect existing connections. However, if the original variable values were invalid and the connection pool could not be initialized, the plugin attempts to reinitialize the pool for the next LDAP request. In this case, the new system variable values are used for the reinitialization attempt.

If authentication_ldap_simple_max_pool_size=0 to disable pooling, each LDAP connection opened by the plugin uses the values the system variables have at that time.

authentication_ldap_simple_log_status

For simple LDAP authentication, the logging level for messages written to the error log. The following table shows the permitted level values and their meanings.

authentication_ldap_simple_max_pool_size

For simple LDAP authentication, the maximum size of the pool of connections to the LDAP server. To disable connection pooling, set this variable to 0.

This variable is used in conjunction with authentication_ldap_simple_init_pool_size. See the description of that variable.

authentication_ldap_simple_server_host

For simple LDAP authentication, the LDAP server host. The permitted values for this variable depend on the authentication method:

authentication_ldap_simple_server_port

For simple LDAP authentication, the LDAP server TCP/IP port number.

As of MySQL 5.7.25, if the LDAP port number is configured as 636 or 3269, the plugin uses LDAPS (LDAP over SSL) instead of LDAP. (LDAPS differs from startTLS.)

authentication_ldap_simple_tls

For simple LDAP authentication, whether connections by the plugin to the LDAP server are secure. If this variable is enabled, the plugin uses TLS to connect securely to the LDAP server. This variable can be set to override the default OpenLDAP TLS configuration; see LDAP Pluggable Authentication and ldap.conf If you enable this variable, you may also wish to set the authentication_ldap_simple_ca_path variable.

MySQL LDAP plugins support the StartTLS method, which initializes TLS on top of a plain LDAP connection.

As of MySQL 5.7.25, LDAPS can be used by setting the authentication_ldap_simple_server_port system variable.

authentication_ldap_simple_user_search_attr

For simple LDAP authentication, the name of the attribute that specifies user names in LDAP directory entries. If a user distinguished name is not provided, the authentication plugin searches for the name using this attribute. For example, if the authentication_ldap_simple_user_search_attr value is uid, a search for the user name user1 finds entries with a uid value of user1.