Rechercher dans le manuel MySQL
6.5.1.11 Pluggable Authentication System Variables
These variables are unavailable unless the appropriate server-side plugin is installed:
authentication_ldap_sasl
for system variables with names of the formauthentication_ldap_sasl_
xxx
authentication_ldap_simple
for system variables with names of the formauthentication_ldap_simple_
xxx
Table 6.22 Authentication Plugin System Variable Summary
authentication_ldap_sasl_auth_method_name
Property Value Command-Line Format --authentication-ldap-sasl-auth-method-name=value
Introduced 8.0.11 System Variable authentication_ldap_sasl_auth_method_name
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String Default Value SCRAM-SHA-1
For SASL LDAP authentication, the authentication method name. Communication between the authentication plugin and the LDAP server occurs according to this authentication method. These authentication method values are permitted:
SCRAM-SHA-1
: Authentication uses a SASL challenge-response mechanism to ensure password security.The client-side
authentication_ldap_sasl_client
plugin communicates with the SASL server, using the password to create a challenge and obtain a SASL request buffer, then passes this buffer to the server-sideauthentication_ldap_sasl
plugin. The client-side and server-side SASL LDAP plugins use SASL messages for secure transmission of credentials within the LDAP protocol, to avoid sending the clear-text password between the MySQL client and server.
authentication_ldap_sasl_bind_base_dn
Property Value Command-Line Format --authentication-ldap-sasl-bind-base-dn=value
Introduced 8.0.11 System Variable authentication_ldap_sasl_bind_base_dn
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String Default Value NULL
For SASL LDAP authentication, the base distinguished name (DN). This variable can be used to limit the scope of searches by anchoring them at a certain location (the “base”) within the search tree.
Suppose that members of one set of LDAP user entries each have this form:
uid=user_name,pwd=user_password,ou=People,dc=example,dc=com
And that members of another set of LDAP user entries each have this form:
uid=user_name,pwd=user_password,ou=Admin,dc=example,dc=com
Then searches work like this for different base DN values:
If the base DN is
ou=People,dc=example,dc=com
: Searches find user entries only in the first set.If the base DN is
ou=Admin,dc=example,dc=com
: Searches find user entries only in the second set.If the base DN is
ou=dc=example,dc=com
: Searches find user entries in the first or second set.
In general, more specific base DN values result in faster searches because they limit the search scope more.
authentication_ldap_sasl_bind_root_dn
Property Value Command-Line Format --authentication-ldap-sasl-bind-root-dn=value
Introduced 8.0.11 System Variable authentication_ldap_sasl_bind_root_dn
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String Default Value NULL
For SASL LDAP authentication, the root distinguished name (DN). This variable is used in conjunction with
authentication_ldap_sasl_bind_root_pwd
as the credentials for authenticating to the LDAP server for the purpose of performing searches. Authentication uses either one or two LDAP bind operations, depending on whether the the MySQL account names an LDAP user DN:If the account does not name a user DN:
authentication_ldap_sasl
performs an initial LDAP binding usingauthentication_ldap_sasl_bind_root_dn
andauthentication_ldap_sasl_bind_root_pwd
. (These are both empty by default, so if they are not set, the LDAP server must permit anonymous connections.) The resulting bind LDAP handle is used to search for the user DN, based on the client user name.authentication_ldap_sasl
performs a second bind using the user DN and client-supplied password.If the account does name a user DN: The first bind operation is unnecessary in this case.
authentication_ldap_sasl
performs a single bind using the user DN and client-supplied password. This is faster than if the MySQL account does not specify an LDAP user DN.
authentication_ldap_sasl_bind_root_pwd
Property Value Command-Line Format --authentication-ldap-sasl-bind-root-pwd=value
Introduced 8.0.11 System Variable authentication_ldap_sasl_bind_root_pwd
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String Default Value NULL
For SASL LDAP authentication, the password for the root distinguished name. This variable is used in conjunction with
authentication_ldap_sasl_bind_root_dn
. See the description of that variable.authentication_ldap_sasl_ca_path
Property Value Command-Line Format --authentication-ldap-sasl-ca-path=value
Introduced 8.0.11 System Variable authentication_ldap_sasl_ca_path
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String Default Value NULL
For SASL LDAP authentication, the absolute path of the certificate authority file. Specify this file if it is desired that the authentication plugin perform verification of the LDAP server certificate.
NoteIn addition to setting the
authentication_ldap_sasl_ca_path
variable to the file name, you must add the appropriate certificate authority certificates to the file and enable theauthentication_ldap_sasl_tls
system variable.authentication_ldap_sasl_group_search_attr
Property Value Command-Line Format --authentication-ldap-sasl-group-search-attr=value
Introduced 8.0.11 System Variable authentication_ldap_sasl_group_search_attr
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String Default Value cn
For SASL LDAP authentication, the name of the attribute that specifies group names in LDAP directory entries. If
authentication_ldap_sasl_group_search_attr
has its default value ofcn
, searches return thecn
value as the group name. For example, if an LDAP entry with auid
value ofuser1
has acn
attribute ofmygroup
, searches foruser1
returnmygroup
as the group name.This variable should be the empty string if you want no group or proxy authentication.
If the group search attribute is
isMemberOf
, LDAP authentication directly retrieves the user attributeisMemberOf
value and assigns it as group information. If the group search attribute is notisMemberOf
, LDAP authentication searches for all groups where the user is a member. (The latter is the default behavior.) This behavior is based on how LDAP group information can be stored two ways: 1) A group entry can have an attribute namedmemberUid
ormember
with a value that is a user name; 2) A user entry can have an attribute namedisMemberOf
with values that are group names.authentication_ldap_sasl_group_search_filter
Property Value Command-Line Format --authentication-ldap-sasl-group-search-filter=value
Introduced 8.0.11 System Variable authentication_ldap_sasl_group_search_filter
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String Default Value (|(&(objectClass=posixGroup)(memberUid=%s))(&(objectClass=group)(member=%s)))
For SASL LDAP authentication, the custom group search filter.
The search filter value can contain
{UA}
and{UD}
notation to represent the user name and the full user DN. For example,{UA}
is replaced with a user name such as"admin"
, whereas{UD}
is replaced with a use full DN such as"uid=admin,ou=People,dc=example,dc=com"
. The following value is the default, which supports both OpenLDAP and Active Directory:(|(&(objectClass=posixGroup)(memberUid={UA})) (&(objectClass=group)(member={UD})))
In some cases for the user scenario,
memberOf
is a simple user attribute that holds no group information. For additional flexibility, an optional{GA}
prefix can be used with the group search attribute. Any group attribute with a {GA} prefix is treated as a user attribute having group names. For example, with a value of{GA}MemberOf
, if the group value is the DN, the first attribute value from the group DN is returned as the group name.authentication_ldap_sasl_init_pool_size
Property Value Command-Line Format --authentication-ldap-sasl-init-pool-size=value
Introduced 8.0.11 System Variable authentication_ldap_sasl_init_pool_size
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type Integer Default Value 10
Minimum Value 0
Maximum Value 32767
For SASL LDAP authentication, the initial size of the pool of connections to the LDAP server. Choose the value for this variable based on the average number of concurrent authentication requests to the LDAP server.
The plugin uses
authentication_ldap_sasl_init_pool_size
andauthentication_ldap_sasl_max_pool_size
together for connection-pool management:When the authentication plugin initializes, it creates
authentication_ldap_sasl_init_pool_size
connections, unlessauthentication_ldap_sasl_max_pool_size=0
to disable pooling.If the plugin receives an anthentication request when there are no free connections in the current connection pool, the plugin can create a new connection, up to the maximum connection pool size given by
authentication_ldap_sasl_max_pool_size
.If the plugin receives a request when the pool size is already at its maximum and there are no free connections, authentication fails.
When the plugin unloads, it closes all pooled connections.
Changes to plugin system variable settings may have no effect on connections already in the pool. For example, modifying the LDAP server host, port, or TLS settings does not affect existing connections. However, if the original variable values were invalid and the connection pool could not be initialized, the plugin attempts to reinitialize the pool for the next LDAP request. In this case, the new system variable values are used for the reinitialization attempt.
If
authentication_ldap_sasl_max_pool_size=0
to disable pooling, each LDAP connection opened by the plugin uses the values the system variables have at that time.authentication_ldap_sasl_log_status
Property Value Command-Line Format --authentication-ldap-sasl-log-status=value
Introduced 8.0.11 System Variable authentication_ldap_sasl_log_status
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type Integer Default Value 1
Minimum Value 1
Maximum Value 5
For SASL LDAP authentication, the logging level. The following table shows the permitted level values and their meanings.
Table 6.23 Log Levels for authentication_ldap_sasl_log_status
Option Value Types of Messages Logged 1
No messages 2
Error messages 3
Error and warning messages 4
Error, warning, and information messages 5
All messages On the client side, messages can be logged to the standard output by setting the
AUTHENTICATION_LDAP_CLIENT_LOG
environment variable. The permitted and default values are the same as forauthentication_ldap_sasl_log_status
.The
AUTHENTICATION_LDAP_CLIENT_LOG
environment variable applies only to SASL LDAP authentication. It has no effect for simple LDAP authentication because the client plugin in that case ismysql_clear_password
, which knows nothing about LDAP operations.authentication_ldap_sasl_max_pool_size
Property Value Command-Line Format --authentication-ldap-sasl-max-pool-size=value
Introduced 8.0.11 System Variable authentication_ldap_sasl_max_pool_size
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type Integer Default Value 1000
Minimum Value 0
Maximum Value 32767
For SASL LDAP authentication, the maximum size of the pool of connections to the LDAP server. To disable connection pooling, set this variable to 0.
This variable is used in conjunction with
authentication_ldap_sasl_init_pool_size
. See the description of that variable.authentication_ldap_sasl_server_host
Property Value Command-Line Format --authentication-ldap-sasl-server-host=value
Introduced 8.0.11 System Variable authentication_ldap_sasl_server_host
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String For SASL LDAP authentication, the LDAP server host. The permitted values for this variable depend on the authentication method:
For
authentication_ldap_sasl_auth_method_name=SCRAM-SHA-1
: The LDAP server host can be a host name or IP address.
authentication_ldap_sasl_server_port
Property Value Command-Line Format --authentication-ldap-sasl-server-port=value
Introduced 8.0.11 System Variable authentication_ldap_sasl_server_port
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type Integer Default Value 389
Minimum Value 1
Maximum Value 32376
For SASL LDAP authentication, the LDAP server TCP/IP port number.
As of MySQL 8.0.14, if the LDAP port number is configured as 636 or 3269, the plugin uses LDAPS (LDAP over SSL) instead of LDAP. (LDAPS differs from
startTLS
.)-
Property Value Command-Line Format --authentication-ldap-sasl-tls=value
Introduced 8.0.11 System Variable authentication_ldap_sasl_tls
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type Boolean Default Value OFF
For SASL LDAP authentication, whether connections by the plugin to the LDAP server are secure. If this variable is enabled, the plugin uses TLS to connect securely to the LDAP server. If you enable this variable, you may also wish to set the
authentication_ldap_sasl_ca_path
variable.MySQL LDAP plugins support the StartTLS method, which initializes TLS on top of a plain LDAP connection. The
ldaps
method is deprecated and MySQL does not support it. authentication_ldap_sasl_user_search_attr
Property Value Command-Line Format --authentication-ldap-sasl-user-search-attr=value
Introduced 8.0.11 System Variable authentication_ldap_sasl_user_search_attr
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String Default Value uid
For SASL LDAP authentication, the name of the attribute that specifies user names in LDAP directory entries. If a user distinguished name is not provided, the authentication plugin searches for the name using this attribute. For example, if the
authentication_ldap_sasl_user_search_attr
value isuid
, a search for the user nameuser1
finds entries with auid
value ofuser1
.authentication_ldap_simple_auth_method_name
Property Value Command-Line Format --authentication-ldap-simple-auth-method-name=value
Introduced 8.0.11 System Variable authentication_ldap_simple_auth_method_name
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String Default Value SIMPLE
For simple LDAP authentication, the authentication method name. Communication between the authentication plugin and the LDAP server occurs according to this authentication method. These authentication method values are permitted:
SIMPLE
: This authentication method uses either one or two LDAP bind operations, depending on whether the the MySQL account names an LDAP user distinguished name. See the description ofauthentication_ldap_simple_bind_root_dn
.AD-FOREST
:authentication_ldap_simple
searches all the domains in the Active Directory forest, performing an LDAP bind to each Active Directory domain until the user is found in some domain.
NoteFor simple LDAP authentication, it is recommended to also set TLS parameters to require that communication with the LDAP server take place over secure connections.
authentication_ldap_simple_bind_base_dn
Property Value Command-Line Format --authentication-ldap-simple-bind-base-dn=value
Introduced 8.0.11 System Variable authentication_ldap_simple_bind_base_dn
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String Default Value NULL
For simple LDAP authentication, the base distinguished name (DN). This variable can be used to limit the scope of searches by anchoring them at a certain location (the “base”) within the search tree.
Suppose that members of one set of LDAP user entries each have this form:
uid=user_name,pwd=user_password,ou=People,dc=example,dc=com
And that members of another set of LDAP user entries each have this form:
uid=user_name,pwd=user_password,ou=Admin,dc=example,dc=com
Then searches work like this for different base DN values:
If the base DN is
ou=People,dc=example,dc=com
: Searches find user entries only in the first set.If the base DN is
ou=Admin,dc=example,dc=com
: Searches find user entries only in the second set.If the base DN is
ou=dc=example,dc=com
: Searches find user entries in the first or second set.
In general, more specific base DN values result in faster searches because they limit the search scope more.
authentication_ldap_simple_bind_root_dn
Property Value Command-Line Format --authentication-ldap-simple-bind-root-dn=value
Introduced 8.0.11 System Variable authentication_ldap_simple_bind_root_dn
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String Default Value NULL
For simple LDAP authentication, the root distinguished name (DN). This variable is used in conjunction with
authentication_ldap_simple_bind_root_pwd
as the credentials for authenticating to the LDAP server for the purpose of performing searches. Authentication uses either one or two LDAP bind operations, depending on whether the the MySQL account names an LDAP user DN:If the account does not name a user DN:
authentication_ldap_simple
performs an initial LDAP binding usingauthentication_ldap_simple_bind_root_dn
andauthentication_ldap_simple_bind_root_pwd
. (These are both empty by default, so if they are not set, the LDAP server must permit anonymous connections.) The resulting bind LDAP handle is used to search for the user DN, based on the client user name.authentication_ldap_simple
performs a second bind using the user DN and client-supplied password.If the account does name a user DN: The first bind operation is unnecessary in this case.
authentication_ldap_simple
performs a single bind using the user DN and client-supplied password. This is faster than if the MySQL account does not specify an LDAP user DN.
authentication_ldap_simple_bind_root_pwd
Property Value Command-Line Format --authentication-ldap-simple-bind-root-pwd=value
Introduced 8.0.11 System Variable authentication_ldap_simple_bind_root_pwd
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String Default Value NULL
For simple LDAP authentication, the password for the root distinguished name. This variable is used in conjunction with
authentication_ldap_simple_bind_root_dn
. See the description of that variable.authentication_ldap_simple_ca_path
Property Value Command-Line Format --authentication-ldap-simple-ca-path=value
Introduced 8.0.11 System Variable authentication_ldap_simple_ca_path
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String Default Value NULL
For simple LDAP authentication, the absolute path of the certificate authority file. Specify this file if it is desired that the authentication plugin perform verification of the LDAP server certificate.
NoteIn addition to setting the
authentication_ldap_simple_ca_path
variable to the file name, you must add the appropriate certificate authority certificates to the file and enable theauthentication_ldap_simple_tls
system variable.authentication_ldap_simple_group_search_attr
Property Value Command-Line Format --authentication-ldap-simple-group-search-attr=value
Introduced 8.0.11 System Variable authentication_ldap_simple_group_search_attr
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String Default Value cn
For simple LDAP authentication, the name of the attribute that specifies group names in LDAP directory entries. If
authentication_ldap_simple_group_search_attr
has its default value ofcn
, searches return thecn
value as the group name. For example, if an LDAP entry with auid
value ofuser1
has acn
attribute ofmygroup
, searches foruser1
returnmygroup
as the group name.If the group search attribute is
isMemberOf
, LDAP authentication directly retrieves the user attributeisMemberOf
value and assigns it as group information. If the group search attribute is notisMemberOf
, LDAP authentication searches for all groups where the user is a member. (The latter is the default behavior.) This behavior is based on how LDAP group information can be stored two ways: 1) A group entry can have an attribute namedmemberUid
ormember
with a value that is a user name; 2) A user entry can have an attribute namedisMemberOf
with values that are group names.authentication_ldap_simple_group_search_filter
Property Value Command-Line Format --authentication-ldap-simple-group-search-filter=value
Introduced 8.0.11 System Variable authentication_ldap_simple_group_search_filter
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String Default Value (|(&(objectClass=posixGroup)(memberUid=%s))(&(objectClass=group)(member=%s)))
For simple LDAP authentication, the custom group search filter.
The search filter value can contain
{UA}
and{UD}
notation to represent the user name and the full user DN. For example,{UA}
is replaced with a user name such as"admin"
, whereas{UD}
is replaced with a use full DN such as"uid=admin,ou=People,dc=example,dc=com"
. The following value is the default, which supports both OpenLDAP and Active Directory:(|(&(objectClass=posixGroup)(memberUid={UA})) (&(objectClass=group)(member={UD})))
In some cases for the user scenario,
memberOf
is a simple user attribute that holds no group information. For additional flexibility, an optional{GA}
prefix can be used with the group search attribute. Any group attribute with a {GA} prefix is treated as a user attribute having group names. For example, with a value of{GA}MemberOf
, if the group value is the DN, the first attribute value from the group DN is returned as the group name.authentication_ldap_simple_init_pool_size
Property Value Command-Line Format --authentication-ldap-simple-init-pool-size=value
Introduced 8.0.11 System Variable authentication_ldap_simple_init_pool_size
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type Integer Default Value 10
Minimum Value 0
Maximum Value 32767
For simple LDAP authentication, the initial size of the pool of connections to the LDAP server. Choose the value for this variable based on the average number of concurrent authentication requests to the LDAP server.
The plugin uses
authentication_ldap_simple_init_pool_size
andauthentication_ldap_simple_max_pool_size
together for connection-pool management:When the authentication plugin initializes, it creates
authentication_ldap_simple_init_pool_size
connections, unlessauthentication_ldap_simple_max_pool_size=0
to disable pooling.If the plugin receives an anthentication request when there are no free connections in the current connection pool, the plugin can create a new connection, up to the maximum connection pool size given by
authentication_ldap_simple_max_pool_size
.If the plugin receives a request when the pool size is already at its maximum and there are no free connections, authentication fails.
When the plugin unloads, it closes all pooled connections.
Changes to plugin system variable settings may have no effect on connections already in the pool. For example, modifying the LDAP server host, port, or TLS settings does not affect existing connections. However, if the original variable values were invalid and the connection pool could not be initialized, the plugin attempts to reinitialize the pool for the next LDAP request. In this case, the new system variable values are used for the reinitialization attempt.
If
authentication_ldap_simple_max_pool_size=0
to disable pooling, each LDAP connection opened by the plugin uses the values the system variables have at that time.authentication_ldap_simple_log_status
Property Value Command-Line Format --authentication-ldap-simple-log-status=value
Introduced 8.0.11 System Variable authentication_ldap_simple_log_status
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type Integer Default Value 1
Minimum Value 1
Maximum Value 5
For simple LDAP authentication, the logging level. The following table shows the permitted level values and their meanings.
Table 6.24 Log Levels for authentication_ldap_simple_log_status
Option Value Types of Messages Logged 1
No messages 2
Error messages 3
Error and warning messages 4
Error, warning, and information messages 5
All messages authentication_ldap_simple_max_pool_size
Property Value Command-Line Format --authentication-ldap-simple-max-pool-size=value
Introduced 8.0.11 System Variable authentication_ldap_simple_max_pool_size
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type Integer Default Value 1000
Minimum Value 0
Maximum Value 32767
For simple LDAP authentication, the maximum size of the pool of connections to the LDAP server. To disable connection pooling, set this variable to 0.
This variable is used in conjunction with
authentication_ldap_simple_init_pool_size
. See the description of that variable.authentication_ldap_simple_server_host
Property Value Command-Line Format --authentication-ldap-simple-server-host=value
Introduced 8.0.11 System Variable authentication_ldap_simple_server_host
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String For simple LDAP authentication, the LDAP server host. The permitted values for this variable depend on the authentication method:
For
authentication_ldap_simple_auth_method_name=SIMPLE
: The LDAP server host can be a host name or IP address.For
authentication_ldap_simple_auth_method_name=AD-FOREST
. The LDAP server host can be an Active Directory domain name. For example, for an LDAP server URL ofldap://example.mem.local:389
, the server name can bemem.local
.An Active Directory forest setup can have multiple domains (LDAP server IPs), which can be discovered using DNS. On Unix and Unix-like systems, some additional setup may be required to configure your DNS server with SRV records that specify the LDAP servers for the Active Directory domain. Suppose that your configuration has these properties:
The name server that provides information about Active Directory domains has IP address
10.172.166.100
.The LDAP servers have names
ldap1.mem.local
throughldap3.mem.local
and IP addresses10.172.166.101
through10.172.166.103
.
You want the LDAP servers to be discoverable using SRV searches. For example, at the command line, a command like this should list the LDAP servers:
host -t SRV _ldap._tcp.mem.local
Perform the DNS configuration as follows:
Add a line to
/etc/resolv.conf
to specify the name server that provides information about Active Directory domains:nameserver 10.172.166.100
Configure the appropriate zone file for the name server with SRV records for the LDAP servers:
_ldap._tcp.mem.local. 86400 IN SRV 0 100 389 ldap1.mem.local. _ldap._tcp.mem.local. 86400 IN SRV 0 100 389 ldap2.mem.local. _ldap._tcp.mem.local. 86400 IN SRV 0 100 389 ldap3.mem.local.
It may also be necessary to specify the IP address for the LDAP servers in
/etc/hosts
if the server host cannot be resolved. For example, add lines like this to the file:10.172.166.101 ldap1.mem.local 10.172.166.102 ldap2.mem.local 10.172.166.103 ldap3.mem.local
With the DNS configured as just described, the server-side LDAP plugin can discover the LDAP servers and will try to authenticate in all domains until authentication succeeds or there are no more servers.
Windows needs no such settings as just described. Given the LDAP server host in the
authentication_ldap_simple_server_host
value, the Windows LDAP library searches all domains and attempts to authenticate.
authentication_ldap_simple_server_port
Property Value Command-Line Format --authentication-ldap-simple-server-port=value
Introduced 8.0.11 System Variable authentication_ldap_simple_server_port
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type Integer Default Value 389
Minimum Value 1
Maximum Value 32376
For simple LDAP authentication, the LDAP server TCP/IP port number.
As of MySQL 8.0.14, if the LDAP port number is configured as 636 or 3269, the plugin uses LDAPS (LDAP over SSL) instead of LDAP. (LDAPS differs from
startTLS
.)authentication_ldap_simple_tls
Property Value Command-Line Format --authentication-ldap-simple-tls=value
Introduced 8.0.11 System Variable authentication_ldap_simple_tls
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type Boolean Default Value OFF
For simple LDAP authentication, whether connections by the plugin to the LDAP server are secure. If this variable is enabled, the plugin uses TLS to connect securely to the LDAP server. If you enable this variable, you may also wish to set the
authentication_ldap_simple_ca_path
variable.MySQL LDAP plugins support the StartTLS method, which initializes TLS on top of a plain LDAP connection. The
ldaps
method is deprecated and MySQL does not support it.authentication_ldap_simple_user_search_attr
Property Value Command-Line Format --authentication-ldap-simple-user-search-attr=value
Introduced 8.0.11 System Variable authentication_ldap_simple_user_search_attr
Scope Global Dynamic Yes SET_VAR
Hint AppliesNo Type String Default Value uid
For simple LDAP authentication, the name of the attribute that specifies user names in LDAP directory entries. If a user distinguished name is not provided, the authentication plugin searches for the name using this attribute. For example, if the
authentication_ldap_simple_user_search_attr
value isuid
, a search for the user nameuser1
finds entries with auid
value ofuser1
.
Traduction non disponible
Le manuel MySQL n'est pas encore traduit en français sur l'infobrol. Seule la version anglaise est disponible pour l'instant.
Document créé le 26/06/2006, dernière modification le 26/10/2018
Source du document imprimé : https://www.gaudry.be/mysql-rf-pluggable-authentication-system-variables.html
L'infobrol est un site personnel dont le contenu n'engage que moi. Le texte est mis à disposition sous licence CreativeCommons(BY-NC-SA). Plus d'info sur les conditions d'utilisation et sur l'auteur.
Références
Ces références et liens indiquent des documents consultés lors de la rédaction de cette page, ou qui peuvent apporter un complément d'information, mais les auteurs de ces sources ne peuvent être tenus responsables du contenu de cette page.
L'auteur de ce site est seul responsable de la manière dont sont présentés ici les différents concepts, et des libertés qui sont prises avec les ouvrages de référence. N'oubliez pas que vous devez croiser les informations de sources multiples afin de diminuer les risques d'erreurs.