# Does percona pam mondule for mysql support AD groups

**URL:** <https://forums.percona.com/t/does-percona-pam-mondule-for-mysql-support-ad-groups/4987>\
**Category:** Other MySQL® Questions\
**Created:** [July 21, 2016, 9:23am UTC](https://forums.percona.com/t/does-percona-pam-mondule-for-mysql-support-ad-groups/4987 "2016-07-21T09:23:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tharun](https://avatars.discourse-cdn.com/v4/letter/t/67e7ee/32.png) [@tharun](https://forums.percona.com/u/tharun)\
**Post date:** [July 21, 2016, 9:23am UTC](https://forums.percona.com/t/does-percona-pam-mondule-for-mysql-support-ad-groups/4987/1 "2016-07-21T09:23:19Z")

</div>

Have anyone tried using percona pam module to get to work with Microsoft AD to map groups ?  
I was able to do the authentication but the group / proxy mapping seems to not work.

---

<div class="post-metadata">

**Author:** ![jaimes](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/jaimes/32/20419_2.png) [@jaimes](https://forums.percona.com/u/jaimes)\
**Post date:** [May 5, 2026, 5:16am UTC](https://forums.percona.com/t/does-percona-pam-mondule-for-mysql-support-ad-groups/4987/2 "2026-05-05T05:16:58Z")

</div>

Yes. You can use Proxy users to emulate roles. In the example below, **support** and **dba** are the AD groups. When the AD user logs in and is a member of **support** or **dba** , that user will have the privileges assigned to **support\_users@‘%’** or **dba\_users@‘%’**.

`mysql> CREATE USER ‘’@‘’ IDENTIFIED WITH auth_pam as ‘mysqld,support=support_users,dba=dba_users’;`  
`Query OK, 0 rows affected (0.00 sec)`  
`mysql> CREATE USER support_users@‘%’ IDENTIFIED BY ‘some_password’;`  
`Query OK, 0 rows affected (0.00 sec)`  
`mysql> CREATE USER dba_users@‘%’ IDENTIFIED BY ‘some_password’;`  
`Query OK, 0 rows affected (0.00 sec)`  
`mysql> GRANT ALL PRIVILEGES ON support.* TO support_users@‘%’;`  
`Query OK, 0 rows affected (0.00 sec)`  
`mysql> GRANT ALL PRIVILEGES ON *.* TO dba_users@‘%’;`  
`Query OK, 0 rows affected (0.00 sec)`  
`mysql> GRANT PROXY ON support_users@‘%’ TO ‘’@‘’;`  
`Query OK, 0 rows affected (0.00 sec)`  
`mysql> GRANT PROXY ON dba_users@‘%’ TO ‘’@‘’;`  
`Query OK, 0 rows affected (0.00 sec)`  
`mysql> FLUSH PRIVILEGES;`  
`Query OK, 0 rows affected (0.00 sec)`