<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="windows-pluggable-authentication">
      </a>
      8.4.1.6 Windows Pluggable Authentication
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045245574624">
  </a>
  <a class="indexterm" name="idm46045245573520">
  </a>
  <a class="indexterm" name="idm46045245572032">
  </a>
  <a class="indexterm" name="idm46045245570928">
  </a>
  <a class="indexterm" name="idm46045245569424">
  </a>
  <a class="indexterm" name="idm46045245567920">
  </a>
  <a class="indexterm" name="idm46045245566416">
  </a>
  <a class="indexterm" name="idm46045245565328">
  </a>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    Windows pluggable authentication is an extension included in
          MySQL Enterprise Edition, a commercial product. To learn more about commercial
          products, see
    <a class="ulink" href="https://www.mysql.com/products/" target="_blank">
     https://www.mysql.com/products/
    </a>
    .
   </p>
  </div>
  <p>
   MySQL Enterprise Edition for Windows supports an authentication method that
        performs external authentication on Windows, enabling MySQL
        Server to use native Windows services to authenticate client
        connections. Users who have logged in to Windows can connect
        from MySQL client programs to the server based on the
        information in their environment without specifying an
        additional password.
  </p>
  <p>
   The client and server exchange data packets in the
        authentication handshake. As a result of this exchange, the
        server creates a security context object that represents the
        identity of the client in the Windows OS. This identity includes
        the name of the client account. Windows pluggable authentication
        uses the identity of the client to check whether it is a given
        account or a member of a group. By default, negotiation uses
        Kerberos to authenticate, then NTLM if Kerberos is unavailable.
  </p>
  <p>
   Windows pluggable authentication provides these capabilities:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      External authentication: Windows authentication enables
            MySQL Server to accept connections from users defined
            outside the MySQL grant tables who have logged in to
            Windows.
     </p>
    </li>
    <li class="listitem">
     <p>
      Proxy user support: Windows authentication can return to
            MySQL a user name different from the external user name
            passed by the client program. This means that the plugin can
            return the MySQL user that defines the privileges the
            external Windows-authenticated user should have. For
            example, a Windows user named
      <code class="literal">
       joe
      </code>
      can
            connect and have the privileges of a MySQL user named
      <code class="literal">
       developer
      </code>
      .
     </p>
    </li>
   </ul>
  </div>
  <p>
   The following table shows the plugin and library file names. The
        file must be located in the directory named by the
   <a class="link" href="server-system-variables.html#sysvar_plugin_dir">
    <code class="literal">
     plugin_dir
    </code>
   </a>
   system variable.
  </p>
  <div class="table">
   <a name="idm46045245553776">
   </a>
   <p class="title">
    <b>
     Table 8.19 Plugin and Library Names for Windows Authentication
    </b>
   </p>
   <div class="table-contents">
    <table summary="Names for the plugins and library file used for Windows password authentication.">
     <colgroup>
      <col style="width: 30%"/>
      <col style="width: 70%"/>
     </colgroup>
     <thead>
      <tr>
       <th>
        Plugin or File
       </th>
       <th>
        Plugin or File Name
       </th>
      </tr>
     </thead>
     <tbody>
      <tr>
       <td>
        Server-side plugin
       </td>
       <td>
        <code class="literal">
         authentication_windows
        </code>
       </td>
      </tr>
      <tr>
       <td>
        Client-side plugin
       </td>
       <td>
        <code class="literal">
         authentication_windows_client
        </code>
       </td>
      </tr>
      <tr>
       <td>
        Library file
       </td>
       <td>
        <code class="filename">
         authentication_windows.dll
        </code>
       </td>
      </tr>
     </tbody>
    </table>
   </div>
  </div>
  <br class="table-break"/>
  <p>
   The library file includes only the server-side plugin. The
        client-side plugin is built into the
   <code class="literal">
    libmysqlclient
   </code>
   client library.
  </p>
  <p>
   The server-side Windows authentication plugin is included only
        in MySQL Enterprise Edition. It is not included in MySQL community distributions.
        The client-side plugin is included in all distributions,
        including community distributions. This enables clients from any
        distribution to connect to a server that has the server-side
        plugin loaded.
  </p>
  <p>
   The following sections provide installation and usage
        information specific to Windows pluggable authentication:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="windows-pluggable-authentication.html#windows-pluggable-authentication-installation" title="Installing Windows Pluggable Authentication">
       Installing Windows Pluggable Authentication
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="windows-pluggable-authentication.html#windows-pluggable-authentication-uninstallation" title="Uninstalling Windows Pluggable Authentication">
       Uninstalling Windows Pluggable Authentication
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="windows-pluggable-authentication.html#windows-pluggable-authentication-usage" title="Using Windows Pluggable Authentication">
       Using Windows Pluggable Authentication
      </a>
     </p>
    </li>
   </ul>
  </div>
  <p>
   For general information about pluggable authentication in MySQL,
        see
   <a class="xref" href="pluggable-authentication.html" title="8.2.17 Pluggable Authentication">
    Section 8.2.17, “Pluggable Authentication”
   </a>
   . For proxy user
        information, see
   <a class="xref" href="proxy-users.html" title="8.2.19 Proxy Users">
    Section 8.2.19, “Proxy Users”
   </a>
   .
  </p>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="windows-pluggable-authentication-installation">
       </a>
       Installing Windows Pluggable Authentication
      </h5>
     </div>
    </div>
   </div>
   <p>
    This section describes how to install the server-side Windows
          authentication plugin. For general information about
          installing plugins, see
    <a class="xref" href="plugin-loading.html" title="7.6.1 Installing and Uninstalling Plugins">
     Section 7.6.1, “Installing and Uninstalling Plugins”
    </a>
    .
   </p>
   <p>
    To be usable by the server, the plugin library file must be
          located in the MySQL plugin directory (the directory named by
          the
    <a class="link" href="server-system-variables.html#sysvar_plugin_dir">
     <code class="literal">
      plugin_dir
     </code>
    </a>
    system
          variable). If necessary, configure the plugin directory
          location by setting the value of
    <a class="link" href="server-system-variables.html#sysvar_plugin_dir">
     <code class="literal">
      plugin_dir
     </code>
    </a>
    at server startup.
   </p>
   <p>
    To load the plugin at server startup, use the
    <a class="link" href="server-options.html#option_mysqld_plugin-load-add">
     <code class="option">
      --plugin-load-add
     </code>
    </a>
    option to
          name the library file that contains it. With this
          plugin-loading method, the option must be given each time the
          server starts. For example, put these lines in the server
    <code class="filename">
     my.cnf
    </code>
    file:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa83972065"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">plugin-load-add</span><span class="token attr-value"><span class="token punctuation">=</span>authentication_windows.dll</span></code></pre>
   </div>
   <p>
    After modifying
    <code class="filename">
     my.cnf
    </code>
    , restart the
          server to cause the new settings to take effect.
   </p>
   <p>
    Alternatively, to load the plugin at runtime, use this
          statement:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa45653661"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">INSTALL</span> <span class="token keyword">PLUGIN</span> authentication_windows <span class="token keyword">SONAME</span> <span class="token string">'authentication_windows.dll'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    <a class="link" href="install-plugin.html" title="15.7.4.4 INSTALL PLUGIN Statement">
     <code class="literal">
      INSTALL PLUGIN
     </code>
    </a>
    loads the plugin
          immediately, and also registers it in the
    <code class="literal">
     mysql.plugins
    </code>
    system table to cause the
          server to load it for each subsequent normal startup without
          the need for
    <a class="link" href="server-options.html#option_mysqld_plugin-load-add">
     <code class="option">
      --plugin-load-add
     </code>
    </a>
    .
   </p>
   <p>
    To verify plugin installation, examine the Information Schema
    <a class="link" href="information-schema-plugins-table.html" title="28.3.22 The INFORMATION_SCHEMA PLUGINS Table">
     <code class="literal">
      PLUGINS
     </code>
    </a>
    table or use the
    <a class="link" href="show-plugins.html" title="15.7.7.27 SHOW PLUGINS Statement">
     <code class="literal">
      SHOW PLUGINS
     </code>
    </a>
    statement (see
    <a class="xref" href="obtaining-plugin-information.html" title="7.6.2 Obtaining Server Plugin Information">
     Section 7.6.2, “Obtaining Server Plugin Information”
    </a>
    ). For example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa53459838"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> PLUGIN_NAME<span class="token punctuation">,</span> PLUGIN_STATUS
       <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span><span class="token keyword">PLUGINS</span>
       <span class="token keyword">WHERE</span> PLUGIN_NAME <span class="token operator">LIKE</span> <span class="token string">'%windows%'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> PLUGIN_NAME            <span class="token punctuation">|</span> PLUGIN_STATUS <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> authentication_windows <span class="token punctuation">|</span> ACTIVE        <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
   </div>
   <p>
    If the plugin fails to initialize, check the server error log
          for diagnostic messages.
   </p>
   <p>
    To associate MySQL accounts with the Windows authentication
          plugin, see
    <a class="xref" href="windows-pluggable-authentication.html#windows-pluggable-authentication-usage" title="Using Windows Pluggable Authentication">
     Using Windows Pluggable Authentication
    </a>
    .
          Additional plugin control is provided by the
    <a class="link" href="server-system-variables.html#sysvar_authentication_windows_use_principal_name">
     <code class="literal">
      authentication_windows_use_principal_name
     </code>
    </a>
    and
    <a class="link" href="server-system-variables.html#sysvar_authentication_windows_log_level">
     <code class="literal">
      authentication_windows_log_level
     </code>
    </a>
    system variables. See
    <a class="xref" href="server-system-variables.html" title="7.1.8 Server System Variables">
     Section 7.1.8, “Server System Variables”
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="windows-pluggable-authentication-uninstallation">
       </a>
       Uninstalling Windows Pluggable Authentication
      </h5>
     </div>
    </div>
   </div>
   <p>
    The method used to uninstall the Windows authentication plugin
          depends on how you installed it:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       If you installed the plugin at server startup using a
       <a class="link" href="server-options.html#option_mysqld_plugin-load-add">
        <code class="option">
         --plugin-load-add
        </code>
       </a>
       option,
              restart the server without the option.
      </p>
     </li>
     <li class="listitem">
      <p>
       If you installed the plugin at runtime using an
       <a class="link" href="install-plugin.html" title="15.7.4.4 INSTALL PLUGIN Statement">
        <code class="literal">
         INSTALL PLUGIN
        </code>
       </a>
       statement,
              it remains installed across server restarts. To uninstall
              it, use
       <a class="link" href="uninstall-plugin.html" title="15.7.4.6 UNINSTALL PLUGIN Statement">
        <code class="literal">
         UNINSTALL PLUGIN
        </code>
       </a>
       :
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa1579213"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">UNINSTALL</span> <span class="token keyword">PLUGIN</span> authentication_windows<span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    In addition, remove any startup options that set Windows
          plugin-related system variables.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="windows-pluggable-authentication-usage">
       </a>
       Using Windows Pluggable Authentication
      </h5>
     </div>
    </div>
   </div>
   <p>
    The Windows authentication plugin supports the use of MySQL
          accounts such that users who have logged in to Windows can
          connect to the MySQL server without having to specify an
          additional password. It is assumed that the server is running
          with the server-side plugin enabled, as described in
    <a class="xref" href="windows-pluggable-authentication.html#windows-pluggable-authentication-installation" title="Installing Windows Pluggable Authentication">
     Installing Windows Pluggable Authentication
    </a>
    .
          Once the DBA has enabled the server-side plugin and set up
          accounts to use it, clients can connect using those accounts
          with no other setup required on their part.
   </p>
   <p>
    To refer to the Windows authentication plugin in the
    <code class="literal">
     IDENTIFIED WITH
    </code>
    clause of a
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    statement, use the
          name
    <code class="literal">
     authentication_windows
    </code>
    . Suppose that
          the Windows users
    <code class="literal">
     Rafal
    </code>
    and
    <code class="literal">
     Tasha
    </code>
    should be permitted to connect to
          MySQL, as well as any users in the
    <code class="literal">
     Administrators
    </code>
    or
    <code class="literal">
     Power
          Users
    </code>
    group. To set this up, create a MySQL account
          named
    <code class="literal">
     sql_admin
    </code>
    that uses the Windows
          plugin for authentication:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa92977302"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> sql_admin
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> authentication_windows
  <span class="token keyword">AS</span> <span class="token string">'Rafal, Tasha, Administrators, "Power Users"'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    The plugin name is
    <code class="literal">
     authentication_windows
    </code>
    .
          The string following the
    <code class="literal">
     AS
    </code>
    keyword is the
          authentication string. It specifies that the Windows users
          named
    <code class="literal">
     Rafal
    </code>
    or
    <code class="literal">
     Tasha
    </code>
    are
          permitted to authenticate to the server as the MySQL user
    <code class="literal">
     sql_admin
    </code>
    , as are any Windows users in the
    <code class="literal">
     Administrators
    </code>
    or
    <code class="literal">
     Power
          Users
    </code>
    group. The latter group name contains a space,
          so it must be quoted with double quote characters.
   </p>
   <p>
    After you create the
    <code class="literal">
     sql_admin
    </code>
    account, a
          user who has logged in to Windows can attempt to connect to
          the server using that account:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa58688516"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">C:\&gt;</span><span class="token command"> mysql</span> <span class="token constant">--user</span><span class="token attr-value"><span class="token punctuation">=</span>sql_admin</span></code></pre>
   </div>
   <p>
    No password is required here. The
    <code class="literal">
     authentication_windows
    </code>
    plugin uses the
          Windows security API to check which Windows user is
          connecting. If that user is named
    <code class="literal">
     Rafal
    </code>
    or
    <code class="literal">
     Tasha
    </code>
    , or is a member of the
    <code class="literal">
     Administrators
    </code>
    or
    <code class="literal">
     Power
          Users
    </code>
    group, the server grants access and the client
          is authenticated as
    <code class="literal">
     sql_admin
    </code>
    and has
          whatever privileges are granted to the
    <code class="literal">
     sql_admin
    </code>
    account. Otherwise, the server
          denies access.
   </p>
   <p>
    Authentication string syntax for the Windows authentication
          plugin follows these rules:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The string consists of one or more user mappings separated
              by commas.
      </p>
     </li>
     <li class="listitem">
      <p>
       Each user mapping associates a Windows user or group name
              with a MySQL user name:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-none"><div class="docs-select-all right" id="sa60209893"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none"><em class="replaceable">win_user_or_group_name=mysql_user_name</em>
<em class="replaceable">win_user_or_group_name</em></code></pre>
      </div>
      <p>
       For the latter syntax, with no
       <em class="replaceable">
        <code>
         mysql_user_name
        </code>
       </em>
       value given,
              the implicit value is the MySQL user created by the
       <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
        <code class="literal">
         CREATE USER
        </code>
       </a>
       statement.
              Thus, these statements are equivalent:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa91619157"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> sql_admin
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> authentication_windows
  <span class="token keyword">AS</span> <span class="token string">'Rafal, Tasha, Administrators, "Power Users"'</span><span class="token punctuation">;</span>

<span class="token keyword">CREATE</span> <span class="token keyword">USER</span> sql_admin
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> authentication_windows
  <span class="token keyword">AS</span> <span class="token string">'Rafal=sql_admin, Tasha=sql_admin, Administrators=sql_admin,
      "Power Users"=sql_admin'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Each backslash character (
       <code class="literal">
        \
       </code>
       ) in a value
              must be doubled because backslash is the escape character
              in MySQL strings.
      </p>
     </li>
     <li class="listitem">
      <p>
       Leading and trailing spaces not inside double quotation
              marks are ignored.
      </p>
     </li>
     <li class="listitem">
      <p>
       Unquoted
       <em class="replaceable">
        <code>
         win_user_or_group_name
        </code>
       </em>
       and
       <em class="replaceable">
        <code>
         mysql_user_name
        </code>
       </em>
       values can
              contain anything except equal sign, comma, or space.
      </p>
     </li>
     <li class="listitem">
      <p>
       If a
       <em class="replaceable">
        <code>
         win_user_or_group_name
        </code>
       </em>
       and
              or
       <em class="replaceable">
        <code>
         mysql_user_name
        </code>
       </em>
       value is
              quoted with double quotation marks, everything between the
              quotation marks is part of the value. This is necessary,
              for example, if the name contains space characters. All
              characters within double quotes are legal except double
              quotation mark and backslash. To include either character,
              escape it with a backslash.
      </p>
     </li>
     <li class="listitem">
      <p>
       <em class="replaceable">
        <code>
         win_user_or_group_name
        </code>
       </em>
       values
              use conventional syntax for Windows principals, either
              local or in a domain. Examples (note the doubling of
              backslashes):
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-none"><div class="docs-select-all right" id="sa30346814"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">domain\\user
.\\user
domain\\group
.\\group
BUILTIN\\WellKnownGroup</code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    When invoked by the server to authenticate a client, the
          plugin scans the authentication string left to right for a
          user or group match to the Windows user. If there is a match,
          the plugin returns the corresponding
    <em class="replaceable">
     <code>
      mysql_user_name
     </code>
    </em>
    to the MySQL
          server. If there is no match, authentication fails.
   </p>
   <p>
    A user name match takes preference over a group name match.
          Suppose that the Windows user named
    <code class="literal">
     win_user
    </code>
    is a member of
    <code class="literal">
     win_group
    </code>
    and the authentication string
          looks like this:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-none"><div class="docs-select-all right" id="sa54754236"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">'win_group = sql_user1, win_user = sql_user2'</code></pre>
   </div>
   <p>
    When
    <code class="literal">
     win_user
    </code>
    connects to the MySQL server,
          there is a match both to
    <code class="literal">
     win_group
    </code>
    and to
    <code class="literal">
     win_user
    </code>
    . The plugin authenticates the user
          as
    <code class="literal">
     sql_user2
    </code>
    because the more-specific user
          match takes precedence over the group match, even though the
          group is listed first in the authentication string.
   </p>
   <p>
    Windows authentication always works for connections from the
          same computer on which the server is running. For
          cross-computer connections, both computers must be registered
          with Microsoft Active Directory. If they are in the same
          Windows domain, it is unnecessary to specify a domain name. It
          is also possible to permit connections from a different
          domain, as in this example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa1346192"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> sql_accounting
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> authentication_windows
  <span class="token keyword">AS</span> <span class="token string">'SomeDomain\\Accounting'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Here
    <code class="literal">
     SomeDomain
    </code>
    is the name of the other
          domain. The backslash character is doubled because it is the
          MySQL escape character within strings.
   </p>
   <a class="indexterm" name="idm46045245443232">
   </a>
   <p>
    MySQL supports the concept of proxy users whereby a client can
          connect and authenticate to the MySQL server using one account
          but while connected has the privileges of another account (see
    <a class="xref" href="proxy-users.html" title="8.2.19 Proxy Users">
     Section 8.2.19, “Proxy Users”
    </a>
    ). Suppose that you want Windows
          users to connect using a single user name but be mapped based
          on their Windows user and group names onto specific MySQL
          accounts as follows:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The
       <code class="literal">
        local_user
       </code>
       and
       <code class="literal">
        MyDomain\domain_user
       </code>
       local and domain
              Windows users should map to the
       <code class="literal">
        local_wlad
       </code>
       MySQL account.
      </p>
     </li>
     <li class="listitem">
      <p>
       Users in the
       <code class="literal">
        MyDomain\Developers
       </code>
       domain
              group should map to the
       <code class="literal">
        local_dev
       </code>
       MySQL
              account.
      </p>
     </li>
     <li class="listitem">
      <p>
       Local machine administrators should map to the
       <code class="literal">
        local_admin
       </code>
       MySQL account.
      </p>
     </li>
    </ul>
   </div>
   <p>
    To set this up, create a proxy account for Windows users to
          connect to, and configure this account so that users and
          groups map to the appropriate MySQL accounts
          (
    <code class="literal">
     local_wlad
    </code>
    ,
    <code class="literal">
     local_dev
    </code>
    ,
    <code class="literal">
     local_admin
    </code>
    ). In addition, grant the MySQL
          accounts the privileges appropriate to the operations they
          need to perform. The following instructions use
    <code class="literal">
     win_proxy
    </code>
    as the proxy account, and
    <code class="literal">
     local_wlad
    </code>
    ,
    <code class="literal">
     local_dev
    </code>
    ,
          and
    <code class="literal">
     local_admin
    </code>
    as the proxied accounts.
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       Create the proxy MySQL account:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa2039857"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> win_proxy
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span>  authentication_windows
  <span class="token keyword">AS</span> <span class="token string">'local_user = local_wlad,
      MyDomain\\domain_user = local_wlad,
      MyDomain\\Developers = local_dev,
      BUILTIN\\Administrators = local_admin'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       For proxying to work, the proxied accounts must exist, so
              create them:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa12070801"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> local_wlad
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> mysql_no_login<span class="token punctuation">;</span>
<span class="token keyword">CREATE</span> <span class="token keyword">USER</span> local_dev
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> mysql_no_login<span class="token punctuation">;</span>
<span class="token keyword">CREATE</span> <span class="token keyword">USER</span> local_admin
  <span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> mysql_no_login<span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       The proxied accounts use the
       <code class="literal">
        mysql_no_login
       </code>
       authentication plugin to
              prevent clients from using the accounts to log in directly
              to the MySQL server. Instead, users who authenticate using
              Windows are expected to use the
       <code class="literal">
        win_proxy
       </code>
       proxy account. (This assumes
              that the plugin is installed. For instructions, see
       <a class="xref" href="no-login-pluggable-authentication.html" title="8.4.1.9 No-Login Pluggable Authentication">
        Section 8.4.1.9, “No-Login Pluggable Authentication”
       </a>
       .) For
              alternative methods of protecting proxied accounts against
              direct use, see
       <a class="xref" href="proxy-users.html#preventing-proxied-account-direct-login" title="Preventing Direct Login to Proxied Accounts">
        Preventing Direct Login to Proxied Accounts
       </a>
       .
      </p>
      <p>
       You should also execute
       <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
        <code class="literal">
         GRANT
        </code>
       </a>
       statements (not
              shown) that grant each proxied account the privileges
              required for MySQL access.
      </p>
     </li>
     <li class="listitem">
      <p>
       Grant to the proxy account the
       <a class="link" href="privileges-provided.html#priv_proxy">
        <code class="literal">
         PROXY
        </code>
       </a>
       privilege for each
              proxied account:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa17073479"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">GRANT</span> <span class="token keyword">PROXY</span> <span class="token keyword">ON</span> local_wlad <span class="token keyword">TO</span> win_proxy<span class="token punctuation">;</span>
<span class="token keyword">GRANT</span> <span class="token keyword">PROXY</span> <span class="token keyword">ON</span> local_dev <span class="token keyword">TO</span> win_proxy<span class="token punctuation">;</span>
<span class="token keyword">GRANT</span> <span class="token keyword">PROXY</span> <span class="token keyword">ON</span> local_admin <span class="token keyword">TO</span> win_proxy<span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ol>
   </div>
   <p>
    Now the Windows users
    <code class="literal">
     local_user
    </code>
    and
    <code class="literal">
     MyDomain\domain_user
    </code>
    can connect to the
          MySQL server as
    <code class="literal">
     win_proxy
    </code>
    and when
          authenticated have the privileges of the account given in the
          authentication string (in this case,
    <code class="literal">
     local_wlad
    </code>
    ). A user in the
    <code class="literal">
     MyDomain\Developers
    </code>
    group who connects as
    <code class="literal">
     win_proxy
    </code>
    has the privileges of the
    <code class="literal">
     local_dev
    </code>
    account. A user in the
    <code class="literal">
     BUILTIN\Administrators
    </code>
    group has the
          privileges of the
    <code class="literal">
     local_admin
    </code>
    account.
   </p>
   <p>
    To configure authentication so that all Windows users who do
          not have their own MySQL account go through a proxy account,
          substitute the default proxy account
          (
    <code class="literal">
     ''@''
    </code>
    ) for
    <code class="literal">
     win_proxy
    </code>
    in
          the preceding instructions. For information about default
          proxy accounts, see
    <a class="xref" href="proxy-users.html" title="8.2.19 Proxy Users">
     Section 8.2.19, “Proxy Users”
    </a>
    .
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     If your MySQL installation has anonymous users, they might
            conflict with the default proxy user. For more information
            about this issue, and ways of dealing with it, see
     <a class="xref" href="proxy-users.html#proxy-users-conflicts" title="Default Proxy User and Anonymous User Conflicts">
      Default Proxy User and Anonymous User Conflicts
     </a>
     .
    </p>
   </div>
   <p>
    To use the Windows authentication plugin with Connector/NET
          connection strings in Connector/NET 8.4 and higher, see
    <a class="ulink" href="/doc/connector-net/en/connector-net-authentication.html" target="_top">
     Connector/NET Authentication
    </a>
    .
   </p>
  </div>
 </div>
 <br/>
</div>
