Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We run a couple dozen different MySQL servers for our users. These use the free/Open Source version of MySQL, not the commercial version. Managing the Account Passwords on these servers is painful.

Are there any plugins which would allow us to use LDAP to help manage the MySQL privileges? At the very least, we would like to obtain some usernames and passwords from the LDAP servers.

We are using MySQL 5.1 and 5.5. We might be willing to upgrade to MySQL 5.6 if that is required to achieve this functionality.

We would prefer that any tools be CLI based and not require a GUI or web interface.

share|improve this question
up vote 9 down vote accepted

Enterprise MySQL (the version you pay Oracle to license) has a PAM module that allows for LDAP authentication:

MariaDB (a binary compatible version of MySQL developed by Monty) has an open source PAM module available for it:

I do not have hands on experience with either - I present them only as features I have heard of but not tested or used myself.

share|improve this answer

You can use the auth_ldap plugin provided by Infoscope Hellas L.P. under GPL.

It can be downloaded from sourceforge here.


The plugin is still a Beta and works only for UNIX installations.

share|improve this answer

A Mysql proxy can enable this for you using roles. More detail can be found here: and here:

share|improve this answer

MySQL has a PAM authentication plugin that will let you use any available PAM module to provide authentication services. There is a pam_ldap module that is relatively easy to configure that should allow you to do what you want.

The plugin documentation includes an example using LDAP.

share|improve this answer

I have published in my blog, an full example (with source code) of a LDAP Authentication plugin for MySQL.

share|improve this answer

You can migrate your instalations to Percona Server and use one of this two ways to connect MySQL to LDAP by PAM:

  • Full PAM plugin called auth_pam. This plugin uses It fully supports the PAM protocol with arbitrary communication between client and server.

  • Oracle-compatible PAM called auth_pam_compat. This plugin uses mysql_clear_password which is a part of Oracle MySQL client. It also has some limitations, such as, it supports only one password input. You must use “-p” option in order to pass the password to auth_pam_compat.

We are using auth_pam_compat but you have to remember that client has to support Cleartext Client-Side Authentication Plugin

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.