# LDAP authentication for Percona MySQL

**URL:** <https://forums.percona.com/t/ldap-authentication-for-percona-mysql/26925>\
**Category:** MySQL & MariaDB\
**Created:** [December 4, 2023, 8:13am UTC](https://forums.percona.com/t/ldap-authentication-for-percona-mysql/26925 "2023-12-04T08:13:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mirabraykova](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@mirabraykova](https://forums.percona.com/u/mirabraykova)\
**Post date:** [December 4, 2023, 8:13am UTC](https://forums.percona.com/t/ldap-authentication-for-percona-mysql/26925/1 "2023-12-04T08:13:50Z")

</div>

Hi there,

We want to implement ldap authentication for external users through openLDAP server in our Percona MySQL env, can you share a technical documentation for setting up LDAP authentication and how to setup a LDAP server and how to connect them.

Thank you.

---

<div class="post-metadata">

**Author:** ![CTutte](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/ctutte/32/1341_2.png) [@CTutte](https://forums.percona.com/u/CTutte)\
**Post date:** [December 4, 2023, 10:18am UTC](https://forums.percona.com/t/ldap-authentication-for-percona-mysql/26925/2 "2023-12-04T10:18:44Z")

</div>

Hi mirabraykova,

Please check the following online documentation: [Using LDAP authentication plugins - Percona Server for MySQL](https://docs.percona.com/percona-server/8.0/ldap-authentication.html)

This feature does require Percona Server 8.0.30 or newer

Regards

---

<div class="post-metadata">

**Author:** ![mirabraykova](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@mirabraykova](https://forums.percona.com/u/mirabraykova)\
**Post date:** [December 4, 2023, 12:56pm UTC](https://forums.percona.com/t/ldap-authentication-for-percona-mysql/26925/3 "2023-12-04T12:56:53Z")

</div>

Hi @CTutte, thank you for your answer, I have already checked this document and it is lacking the part for setting the LDAP server and connecting it to the MySQL server. Can you please share a documentation regarding this?  
Thank you.

---

<div class="post-metadata">

**Author:** ![yves.trudeau](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/yves.trudeau/32/2825_2.png) [@yves.trudeau](https://forums.percona.com/u/yves.trudeau)\
**Post date:** [December 18, 2023, 3:19pm UTC](https://forums.percona.com/t/ldap-authentication-for-percona-mysql/26925/4 "2023-12-18T15:19:11Z")

</div>

Hi @mirabraykova, Are you looking for instructions on how to install and configure and LDAP server? LDAP is a world in itself which is way beyond what is included in the plugin instructions. Here are a few starting points for LDAP:

- [OpenLDAP 2.2 Administrator's Guide: A Quick-Start Guide](https://www.openldap.org/doc/admin22/quickstart.html)
- [AD DS Deployment | Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-deployment)

Once you have a working LDAP service on your network, you tell MySQL where is the LDAP server with:

```auto
authentication_ldap_simple_server_host='127.0.0.1';
or
authentication_ldap_sasl_server_host='127.0.0.1';

```

Then, you need to create the users in LDAP before “enabling” them to access MySQL. Once you have users defined in your LDAP (with passwords), let’s say:

```auto
uid=yves,ou=testusers,dc=percona,dc=com

```

you can create a user in MySQL with:

```auto
CREATE USER 'yves'@'localhost' IDENTIFIED WITH authentication_ldap_simple BY 'uid=yves,ou=testusers,dc=percona,dc=com';

```

Essentially, this means, when user “yves” will try to connect to MySQL, validate the password by trying to connect to the LDAP server using the uid and provided password. Of course this means the server must have access to the actual password and not just the hash so the mysql client `--enable-cleartext-plugin` is required.

Regards,  
Yves

---

<div class="post-metadata">

**Author:** ![mirabraykova](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@mirabraykova](https://forums.percona.com/u/mirabraykova)\
**Post date:** [January 2, 2024, 1:04pm UTC](https://forums.percona.com/t/ldap-authentication-for-percona-mysql/26925/5 "2024-01-02T13:04:25Z")

</div>

Hi @yves.trudeau, thanks a lot for your input!