What is the best way to implement access control to production MySQL instances?
The aim is not ban the developers from accessing the MySQL but performing LDAP authentication and audit logging of MySQL modifications to the databases.
Is there a way the command line client mysql provides, LDAP auth and Audit logging?
There's no point putting access control on the command line client; anyone who wants to break your database can trivially avoid using the CLI.
MySQL does have the ability to log all queries along with the username who issued it, but it's not a particularly good idea to enable it on production systems as it does unpleasant things to performance (a lot of disk IO is generated by writing every query to disk).
Finally, as far as LDAP (or other external auth) goes, MySQL is heavily mired in it's own little world of authentication; it's something that used to bug the crap out of me, but I've come to accept it as just one of those things that databases do.
I just avoid letting people play on production databases without adult supervision. The amount of damage to production operation that a well-intentioned fool can do with a poorly-considered query is considerable. Yes, developers don't like it, and no, I don't care.
