# Authentication plugin with ldap and proxy user

**URL:** <https://forums.percona.com/t/authentication-plugin-with-ldap-and-proxy-user/4528>\
**Category:** Other MySQL® Questions\
**Created:** [November 17, 2015, 7:54am UTC](https://forums.percona.com/t/authentication-plugin-with-ldap-and-proxy-user/4528 "2015-11-17T07:54:20Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![joep](https://avatars.discourse-cdn.com/v4/letter/j/87869e/32.png) [@joep](https://forums.percona.com/u/joep)\
**Post date:** [November 17, 2015, 7:54am UTC](https://forums.percona.com/t/authentication-plugin-with-ldap-and-proxy-user/4528/1 "2015-11-17T07:54:20Z")

</div>

Setting up authentication plugin for ldap which is working as I am about to login with ldap credentials but the accounts is not using the proxy user which means the grants are not working.  
Server version: 5.6.27-75.0-log Percona Server (GPL), Release 75.0, Revision 8bb53b6

[INDENT]created from database admin account

mysql\> CREATE USER ‘’@‘’ IDENTIFIED WITH auth\_pam AS ‘mysqld, mysqldba=dbauser’;  
Query OK, 0 rows affected (0.00 sec)

mysql\> grant all on _._ to ‘dbauser’@‘localhost’ identified by ‘xxx’ with grant option;  
Query OK, 0 rows affected (0.00 sec)

mysql\> grant proxy on ‘dbauser’@‘localhost’ to ‘’@‘’;  
Query OK, 0 rows affected (0.00 sec)

mysql\> select \* from mysql.proxies\_priv;  
±------------------------±----------±-------------±-------------±-----------±--------------------±--------------------+  
| Host | User | Proxied\_host | Proxied\_user | With\_grant | Grantor | Timestamp |  
±------------------------±----------±-------------±-------------±-----------±--------------------±--------------------+  
| localhost | root | | | 1 | | 2015-11-16 16:32:41 |  
| localhost | dba\_admin | | | 1 | root@localhost | 0000-00-00 00:00:00 |  
| | | localhost | dbauser | 0 | dba\_admin@localhost | 0000-00-00 00:00:00 |

Question #1- why ‘’@‘’ / dbauser@localhost not showing with\_grant?

* * *

login as ldap user

mysql\> show grants;  
±----------------------------------------------+  
| Grants for @ |  
±----------------------------------------------+  
| GRANT USAGE ON _._ TO ‘’@‘’ |  
| GRANT PROXY ON ‘dbauser’@‘localhost’ TO ‘’@‘’ |  
±----------------------------------------------+  
2 rows in set (0.00 sec)

mysql\> SELECT USER(), CURRENT\_USER();  
±---------------±---------------+  
| USER() | CURRENT\_USER() |  
±---------------±---------------+  
| joep@localhost | @ |  
±---------------±---------------+

Question #2 - why does it not proxy to dbauser@localhost?[/INDENT]  
cat /etc/pam.d/mysqld  
auth required pam\_warn.so  
auth required pam\_ldap.so  
account required pam\_ldap.so

mysql\> show grants for ‘’@‘’;  
±----------------------------------------------+  
| Grants for @ |  
±----------------------------------------------+  
| GRANT USAGE ON _._ TO ‘’@‘’ |  
| GRANT PROXY ON ‘dbauser’@‘localhost’ TO ‘’@‘’ |  
±----------------------------------------------+  
2 rows in set (0.00 sec)

mysql\> show grants for ‘dbauser’@‘localhost’;  
±------------------------------------------------------------------------------------------------------------------------------------------+  
| Grants for dbauser@localhost |  
±------------------------------------------------------------------------------------------------------------------------------------------+  
| GRANT ALL PRIVILEGES ON _._ TO ‘dbauser’@‘localhost’ IDENTIFIED BY PASSWORD ‘\*…’ WITH GRANT OPTION |  
±------------------------------------------------------------------------------------------------------------------------------------------+