<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="pluggable-authentication-system-variables">
      </a>
      8.4.1.13 Pluggable Authentication System Variables
     </h4>
    </div>
   </div>
  </div>
  <p>
   These variables are unavailable unless the appropriate
        server-side plugin is installed:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <code class="literal">
       authentication_ldap_sasl
      </code>
      for system
            variables with names of the form
      <code class="literal">
       authentication_ldap_sasl_
       <em class="replaceable">
        <code>
         xxx
        </code>
       </em>
      </code>
     </p>
    </li>
    <li class="listitem">
     <p>
      <code class="literal">
       authentication_ldap_simple
      </code>
      for system
            variables with names of the form
      <code class="literal">
       authentication_ldap_simple_
       <em class="replaceable">
        <code>
         xxx
        </code>
       </em>
      </code>
     </p>
    </li>
   </ul>
  </div>
  <div class="table">
   <a name="idm46045243764880">
   </a>
   <p class="title">
    <b>
     Table 8.28 Authentication Plugin System Variable
Summary
    </b>
   </p>
   <div class="table-contents">
    <table frame="box" rules="all" summary="Reference for authentication plugin system variables.">
     <colgroup>
      <col style="width: 20%"/>
      <col style="width: 15%"/>
      <col style="width: 15%"/>
      <col style="width: 15%"/>
      <col style="width: 15%"/>
      <col style="width: 15%"/>
      <col style="width: 15%"/>
     </colgroup>
     <thead>
      <tr>
       <th scope="col">
        Name
       </th>
       <th scope="col">
        Cmd-Line
       </th>
       <th scope="col">
        Option File
       </th>
       <th scope="col">
        System Var
       </th>
       <th scope="col">
        Status Var
       </th>
       <th scope="col">
        Var Scope
       </th>
       <th scope="col">
        Dynamic
       </th>
      </tr>
     </thead>
     <tbody>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_kerberos_service_key_tab">
         authentication_kerberos_service_key_tab
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        No
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_kerberos_service_principal">
         authentication_kerberos_service_principal
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_auth_method_name">
         authentication_ldap_sasl_auth_method_name
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_bind_base_dn">
         authentication_ldap_sasl_bind_base_dn
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_bind_root_dn">
         authentication_ldap_sasl_bind_root_dn
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_bind_root_pwd">
         authentication_ldap_sasl_bind_root_pwd
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_ca_path">
         authentication_ldap_sasl_ca_path
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_connect_timeout">
         authentication_ldap_sasl_connect_timeout
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_group_search_attr">
         authentication_ldap_sasl_group_search_attr
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_group_search_filter">
         authentication_ldap_sasl_group_search_filter
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_init_pool_size">
         authentication_ldap_sasl_init_pool_size
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_log_status">
         authentication_ldap_sasl_log_status
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_max_pool_size">
         authentication_ldap_sasl_max_pool_size
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_referral">
         authentication_ldap_sasl_referral
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_response_timeout">
         authentication_ldap_sasl_response_timeout
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_server_host">
         authentication_ldap_sasl_server_host
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_server_port">
         authentication_ldap_sasl_server_port
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_tls">
         authentication_ldap_sasl_tls
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_user_search_attr">
         authentication_ldap_sasl_user_search_attr
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_auth_method_name">
         authentication_ldap_simple_auth_method_name
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_bind_base_dn">
         authentication_ldap_simple_bind_base_dn
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_bind_root_dn">
         authentication_ldap_simple_bind_root_dn
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_bind_root_pwd">
         authentication_ldap_simple_bind_root_pwd
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_ca_path">
         authentication_ldap_simple_ca_path
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_connect_timeout">
         authentication_ldap_simple_connect_timeout
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_group_search_attr">
         authentication_ldap_simple_group_search_attr
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_group_search_filter">
         authentication_ldap_simple_group_search_filter
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_init_pool_size">
         authentication_ldap_simple_init_pool_size
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_log_status">
         authentication_ldap_simple_log_status
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_max_pool_size">
         authentication_ldap_simple_max_pool_size
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_referral">
         authentication_ldap_simple_referral
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_response_timeout">
         authentication_ldap_simple_response_timeout
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_server_host">
         authentication_ldap_simple_server_host
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_server_port">
         authentication_ldap_simple_server_port
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_tls">
         authentication_ldap_simple_tls
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_user_search_attr">
         authentication_ldap_simple_user_search_attr
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
         authentication_policy
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_webauthn_rp_id">
         authentication_webauthn_rp_id
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="server-system-variables.html#sysvar_authentication_windows_log_level">
         authentication_windows_log_level
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        No
       </td>
      </tr>
      <tr>
       <th scope="row">
        <a class="link" href="server-system-variables.html#sysvar_authentication_windows_use_principal_name">
         authentication_windows_use_principal_name
        </a>
       </th>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
        Yes
       </td>
       <td>
       </td>
       <td>
        Global
       </td>
       <td>
        No
       </td>
      </tr>
     </tbody>
    </table>
   </div>
   <div class="table-contents">
    <table cellpadding="0" cellspacing="0" style="position: fixed; top: 0px; display: none; left: 401px; width: 739px;">
     <thead>
      <tr>
       <th scope="col" style="width: 350.719px;">
        Name
       </th>
       <th scope="col" style="width: 57.0781px;">
        Cmd-Line
       </th>
       <th scope="col" style="width: 67px;">
        Option File
       </th>
       <th scope="col" style="width: 69.0469px;">
        System Var
       </th>
       <th scope="col" style="width: 63.9531px;">
        Status Var
       </th>
       <th scope="col" style="width: 60.875px;">
        Var Scope
       </th>
       <th scope="col" style="width: 69.3281px;">
        Dynamic
       </th>
      </tr>
     </thead>
    </table>
   </div>
  </div>
  <br class="table-break"/>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_kerberos_service_key_tab">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_kerberos_service_key_tab">
       <code class="literal">
        authentication_kerberos_service_key_tab
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045243463296">
     </a>
     <a class="indexterm" name="idm46045243462256">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_kerberos_service_key_tab">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-kerberos-service-key-tab=file_name
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_kerberos_service_key_tab">
            authentication_kerberos_service_key_tab
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          File name
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           datadir/mysql.keytab
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <a class="indexterm" name="idm46045243440432">
     </a>
     <p>
      The name of the server-side key-table
            (
      <span class="quote">
       “
       <span class="quote">
        keytab
       </span>
       ”
      </span>
      ) file containing Kerberos service
            keys to authenticate MySQL service tickets received from
            clients. The file name should be given as an absolute path
            name. If this variable is not set, the default is
      <code class="filename">
       mysql.keytab
      </code>
      in the data directory.
     </p>
     <p>
      The file must exist and contain a valid key for the service
            principal name (SPN) or authentication of clients will fail.
            (The SPN and same key also must be created in the Kerberos
            server.) The file may contain multiple service principal
            names and their respective key combinations.
     </p>
     <p>
      The file must be generated by the Kerberos server
            administrator and be copied to a location accessible by the
            MySQL server. The file can be validated to make sure that it
            is correct and was copied properly using this command:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa34839798"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">klist <span class="token property">-k</span> <em class="replaceable">file_name</em></code></pre>
     </div>
     <p>
      For information about keytab files, see
      <a class="ulink" href="https://web.mit.edu/kerberos/krb5-latest/doc/basic/keytab_def.html" target="_blank">
       https://web.mit.edu/kerberos/krb5-latest/doc/basic/keytab_def.html
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_kerberos_service_principal">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_kerberos_service_principal">
       <code class="literal">
        authentication_kerberos_service_principal
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045243430672">
     </a>
     <a class="indexterm" name="idm46045243429552">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_kerberos_service_principal">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-kerberos-service-principal=name
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_kerberos_service_principal">
            authentication_kerberos_service_principal
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           mysql/host_name@realm_name
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      The Kerberos service principal name (SPN) that the MySQL
            server sends to clients.
     </p>
     <p>
      The value is composed from the service name
            (
      <code class="literal">
       mysql
      </code>
      ), a host name, and a realm name.
            The default value is
      <code class="literal">
       mysql/
       <em class="replaceable">
        <code>
         host_name
        </code>
       </em>
       @
       <em class="replaceable">
        <code>
         realm_name
        </code>
       </em>
      </code>
      .
            The realm in the service principal name enables retrieving
            the exact service key.
     </p>
     <p>
      To use a nondefault value, set the value using the same
            format. For example, to use a host name of
      <code class="literal">
       krbauth.example.com
      </code>
      and a realm of
      <code class="literal">
       MYSQL.LOCAL
      </code>
      , set
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_kerberos_service_principal">
       <code class="literal">
        authentication_kerberos_service_principal
       </code>
      </a>
      to
      <code class="literal">
       mysql/krbauth.example.com@MYSQL.LOCAL
      </code>
      .
     </p>
     <p>
      The service principal name and service key must already be
            present in the database managed by the KDC server.
     </p>
     <p>
      There can be service principal names that differ only by
            realm name.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_sasl_auth_method_name">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_auth_method_name">
       <code class="literal">
        authentication_ldap_sasl_auth_method_name
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045243396768">
     </a>
     <a class="indexterm" name="idm46045243395648">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_sasl_auth_method_name">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-sasl-auth-method-name=value
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_auth_method_name">
            authentication_ldap_sasl_auth_method_name
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           SCRAM-SHA-1
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Valid Values
         </th>
         <td>
          <p class="valid-value">
           <code class="literal">
            SCRAM-SHA-1
           </code>
          </p>
          <p class="valid-value">
           <code class="literal">
            SCRAM-SHA-256
           </code>
          </p>
          <p class="valid-value">
           <code class="literal">
            GSSAPI
           </code>
          </p>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For SASL LDAP authentication, the authentication method
            name. Communication between the authentication plugin and
            the LDAP server occurs according to this authentication
            method to ensure password security.
     </p>
     <p>
      These authentication method values are permitted:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         <code class="literal">
          SCRAM-SHA-1
         </code>
         : Use a SASL
                challenge-response mechanism.
        </p>
        <p>
         The client-side
         <code class="literal">
          authentication_ldap_sasl_client
         </code>
         plugin communicates with the SASL server, using the
                password to create a challenge and obtain a SASL request
                buffer, then passes this buffer to the server-side
         <code class="literal">
          authentication_ldap_sasl
         </code>
         plugin. The
                client-side and server-side SASL LDAP plugins use SASL
                messages for secure transmission of credentials within
                the LDAP protocol, to avoid sending the cleartext
                password between the MySQL client and server.
        </p>
       </li>
       <li class="listitem">
        <p>
         <code class="literal">
          SCRAM-SHA-256
         </code>
         : Use a SASL
                challenge-response mechanism.
        </p>
        <p>
         This method is similar to
         <code class="literal">
          SCRAM-SHA-1
         </code>
         , but is more secure. It
                requires an OpenLDAP server built using Cyrus SASL
                2.1.27 or higher.
        </p>
       </li>
       <li class="listitem">
        <p>
         <code class="literal">
          GSSAPI
         </code>
         : Use Kerberos, a passwordless
                and ticket-based protocol.
        </p>
        <p>
         GSSAPI/Kerberos is supported as an authentication method
                for MySQL clients and servers only on Linux. It is
                useful in Linux environments where applications access
                LDAP using Microsoft Active Directory, which has
                Kerberos enabled by default.
        </p>
        <p>
         The client-side
         <code class="literal">
          authentication_ldap_sasl_client
         </code>
         plugin obtains a service ticket using the
                ticket-granting ticket (TGT) from Kerberos, but does not
                use LDAP services directly. The server-side
         <code class="literal">
          authentication_ldap_sasl
         </code>
         plugin
                routes Kerberos messages between the client-side plugin
                and the LDAP server. Using the credentials thus
                obtained, the server-side plugin then communicates with
                the LDAP server to interpret LDAP authentication
                messages and retrieve LDAP groups.
        </p>
       </li>
      </ul>
     </div>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_sasl_bind_base_dn">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_bind_base_dn">
       <code class="literal">
        authentication_ldap_sasl_bind_base_dn
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045243353344">
     </a>
     <a class="indexterm" name="idm46045243352304">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_sasl_bind_base_dn">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-sasl-bind-base-dn=value
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_bind_base_dn">
            authentication_ldap_sasl_bind_base_dn
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           NULL
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For SASL LDAP authentication, the base distinguished name
            (DN). This variable can be used to limit the scope of
            searches by anchoring them at a certain location (the
      <span class="quote">
       “
       <span class="quote">
        base
       </span>
       ”
      </span>
      ) within the search tree.
     </p>
     <p>
      Suppose that members of one set of LDAP user entries each
            have this form:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-ini"><div class="docs-select-all right" id="sa94594129"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token constant">uid</span><span class="token attr-value"><span class="token punctuation">=</span><em class="replaceable">user_name</em>,ou=People,dc=example,dc=com</span></code></pre>
     </div>
     <p>
      And that members of another set of LDAP user entries each
            have this form:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-ini"><div class="docs-select-all right" id="sa29762506"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token constant">uid</span><span class="token attr-value"><span class="token punctuation">=</span><em class="replaceable">user_name</em>,ou=Admin,dc=example,dc=com</span></code></pre>
     </div>
     <p>
      Then searches work like this for different base DN values:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         If the base DN is
         <code class="literal">
          ou=People,dc=example,dc=com
         </code>
         : Searches
                find user entries only in the first set.
        </p>
       </li>
       <li class="listitem">
        <p>
         If the base DN is
         <code class="literal">
          ou=Admin,dc=example,dc=com
         </code>
         : Searches
                find user entries only in the second set.
        </p>
       </li>
       <li class="listitem">
        <p>
         If the base DN is
         <code class="literal">
          ou=dc=example,dc=com
         </code>
         : Searches find
                user entries in the first or second set.
        </p>
       </li>
      </ul>
     </div>
     <p>
      In general, more specific base DN values result in faster
            searches because they limit the search scope more.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_sasl_bind_root_dn">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_bind_root_dn">
       <code class="literal">
        authentication_ldap_sasl_bind_root_dn
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045243316768">
     </a>
     <a class="indexterm" name="idm46045243315728">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_sasl_bind_root_dn">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-sasl-bind-root-dn=value
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_bind_root_dn">
            authentication_ldap_sasl_bind_root_dn
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           NULL
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For SASL LDAP authentication, the root distinguished name
            (DN). This variable is used in conjunction with
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_bind_root_pwd">
       <code class="literal">
        authentication_ldap_sasl_bind_root_pwd
       </code>
      </a>
      as the credentials for authenticating to the LDAP server for
            the purpose of performing searches. Authentication uses
            either one or two LDAP bind operations, depending on whether
            the MySQL account names an LDAP user DN:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         If the account does not name a user DN:
         <code class="literal">
          authentication_ldap_sasl
         </code>
         performs an
                initial LDAP binding using
         <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_bind_root_dn">
          <code class="literal">
           authentication_ldap_sasl_bind_root_dn
          </code>
         </a>
         and
         <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_bind_root_pwd">
          <code class="literal">
           authentication_ldap_sasl_bind_root_pwd
          </code>
         </a>
         .
                (These are both empty by default, so if they are not
                set, the LDAP server must permit anonymous connections.)
                The resulting bind LDAP handle is used to search for the
                user DN, based on the client user name.
         <code class="literal">
          authentication_ldap_sasl
         </code>
         performs a
                second bind using the user DN and client-supplied
                password.
        </p>
       </li>
       <li class="listitem">
        <p>
         If the account does name a user DN: The first bind
                operation is unnecessary in this case.
         <code class="literal">
          authentication_ldap_sasl
         </code>
         performs a
                single bind using the user DN and client-supplied
                password. This is faster than if the MySQL account does
                not specify an LDAP user DN.
        </p>
       </li>
      </ul>
     </div>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_sasl_bind_root_pwd">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_bind_root_pwd">
       <code class="literal">
        authentication_ldap_sasl_bind_root_pwd
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045243281664">
     </a>
     <a class="indexterm" name="idm46045243280624">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_sasl_bind_root_pwd">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-sasl-bind-root-pwd=value
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_bind_root_pwd">
            authentication_ldap_sasl_bind_root_pwd
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           NULL
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For SASL LDAP authentication, the password for the root
            distinguished name. This variable is used in conjunction
            with
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_bind_root_dn">
       <code class="literal">
        authentication_ldap_sasl_bind_root_dn
       </code>
      </a>
      .
            See the description of that variable.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_sasl_ca_path">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_ca_path">
       <code class="literal">
        authentication_ldap_sasl_ca_path
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045243254464">
     </a>
     <a class="indexterm" name="idm46045243253360">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_sasl_ca_path">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-sasl-ca-path=value
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_ca_path">
            authentication_ldap_sasl_ca_path
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           NULL
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For SASL LDAP authentication, the absolute path of the
            certificate authority file. Specify this file if it is
            desired that the authentication plugin perform verification
            of the LDAP server certificate.
     </p>
     <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
      <div class="admon-title">
       Note
      </div>
      <p>
       In addition to setting the
       <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_ca_path">
        <code class="literal">
         authentication_ldap_sasl_ca_path
        </code>
       </a>
       variable to the file name, you must add the appropriate
              certificate authority certificates to the file and enable
              the
       <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_tls">
        <code class="literal">
         authentication_ldap_sasl_tls
        </code>
       </a>
       system variable. These variables can be set to override
              the default OpenLDAP TLS configuration; see
       <a class="xref" href="ldap-pluggable-authentication.html#ldap-pluggable-authentication-ldap-conf" title="LDAP Pluggable Authentication and ldap.conf">
        LDAP Pluggable Authentication and ldap.conf
       </a>
      </p>
     </div>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_sasl_connect_timeout">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_connect_timeout">
       <code class="literal">
        authentication_ldap_sasl_connect_timeout
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045243224048">
     </a>
     <a class="indexterm" name="idm46045243222928">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_sasl_connect_timeout">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-sasl-connect-timeout=#
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_connect_timeout">
            authentication_ldap_sasl_connect_timeout
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          Integer
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           30
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Minimum Value
         </th>
         <td>
          <code class="literal">
           0
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Maximum Value
         </th>
         <td>
          <code class="literal">
           31536000
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Unit
         </th>
         <td>
          seconds
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      Specifies the time (in seconds) that MySQL server waits to
            connect to the LDAP server using TCP.
     </p>
     <p>
      When a MySQL account authenticates using LDAP, MySQL server
            attempts to establish a TCP connection with the LDAP server,
            which it uses to send an LDAP bind request over the
            connection. If the LDAP server does not respond to TCP
            handshake after a configured amount of time, MySQL abandons
            the TCP handshake attempt and emits an error message. If the
            timeout setting is zero, MySQL server ignores this system
            variable setting. For more information, see
      <a class="xref" href="ldap-pluggable-authentication.html#ldap-pluggable-authentication-timeouts" title="Setting Timeouts for LDAP Pluggable Authentication">
       Setting Timeouts for LDAP Pluggable Authentication
      </a>
      .
     </p>
     <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
      <div class="admon-title">
       Note
      </div>
      <p>
       If you set this variable to a timeout value that is
              greater than the host system's default value, the
              shorter system timeout is used.
      </p>
     </div>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_sasl_group_search_attr">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_group_search_attr">
       <code class="literal">
        authentication_ldap_sasl_group_search_attr
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045243188528">
     </a>
     <a class="indexterm" name="idm46045243187408">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_sasl_group_search_attr">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-sasl-group-search-attr=value
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_group_search_attr">
            authentication_ldap_sasl_group_search_attr
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           cn
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For SASL LDAP authentication, the name of the attribute that
            specifies group names in LDAP directory entries. If
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_group_search_attr">
       <code class="literal">
        authentication_ldap_sasl_group_search_attr
       </code>
      </a>
      has its default value of
      <code class="literal">
       cn
      </code>
      , searches
            return the
      <code class="literal">
       cn
      </code>
      value as the group name.
            For example, if an LDAP entry with a
      <code class="literal">
       uid
      </code>
      value of
      <code class="literal">
       user1
      </code>
      has a
      <code class="literal">
       cn
      </code>
      attribute of
      <code class="literal">
       mygroup
      </code>
      , searches for
      <code class="literal">
       user1
      </code>
      return
      <code class="literal">
       mygroup
      </code>
      as the group name.
     </p>
     <p>
      This variable should be the empty string if you want no
            group or proxy authentication.
     </p>
     <p>
      If the group search attribute is
      <code class="literal">
       isMemberOf
      </code>
      , LDAP authentication directly
            retrieves the user attribute
      <code class="literal">
       isMemberOf
      </code>
      value and assigns it as group information. If the group
            search attribute is not
      <code class="literal">
       isMemberOf
      </code>
      , LDAP
            authentication searches for all groups where the user is a
            member. (The latter is the default behavior.) This behavior
            is based on how LDAP group information can be stored two
            ways: 1) A group entry can have an attribute named
      <code class="literal">
       memberUid
      </code>
      or
      <code class="literal">
       member
      </code>
      with a value that is a user name; 2) A user entry can have
            an attribute named
      <code class="literal">
       isMemberOf
      </code>
      with values
            that are group names.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_sasl_group_search_filter">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_group_search_filter">
       <code class="literal">
        authentication_ldap_sasl_group_search_filter
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045243149536">
     </a>
     <a class="indexterm" name="idm46045243148416">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_sasl_group_search_filter">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-sasl-group-search-filter=value
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_group_search_filter">
            authentication_ldap_sasl_group_search_filter
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           (|(&amp;(objectClass=posixGroup)(memberUid=%s))(&amp;(objectClass=group)(member=%s)))
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For SASL LDAP authentication, the custom group search
            filter.
     </p>
     <p>
      The search filter value can contain
      <code class="literal">
       {UA}
      </code>
      and
      <code class="literal">
       {UD}
      </code>
      notation to represent the user
            name and the full user DN. For example,
      <code class="literal">
       {UA}
      </code>
      is replaced with a user name such as
      <code class="literal">
       "admin"
      </code>
      , whereas
      <code class="literal">
       {UD}
      </code>
      is replaced with a use full DN such as
      <code class="literal">
       "uid=admin,ou=People,dc=example,dc=com"
      </code>
      .
            The following value is the default, which supports both
            OpenLDAP and Active Directory:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-simple"><div class="docs-select-all right" id="sa47812841"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-simple"><span class="token punctuation">(</span><span class="token operator">|</span><span class="token punctuation">(</span><span class="token operator">&amp;</span><span class="token punctuation">(</span>objectClass<span class="token operator">=</span>posixGroup<span class="token punctuation">)</span><span class="token punctuation">(</span>memberUid<span class="token operator">=</span><span class="token punctuation">{</span>UA<span class="token punctuation">}</span><span class="token punctuation">)</span><span class="token punctuation">)</span>
  <span class="token punctuation">(</span><span class="token operator">&amp;</span><span class="token punctuation">(</span>objectClass<span class="token operator">=</span>group<span class="token punctuation">)</span><span class="token punctuation">(</span>member<span class="token operator">=</span><span class="token punctuation">{</span>UD<span class="token punctuation">}</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">)</span></code></pre>
     </div>
     <p>
      In some cases for the user scenario,
      <code class="literal">
       memberOf
      </code>
      is a simple user attribute that
            holds no group information. For additional flexibility, an
            optional
      <code class="literal">
       {GA}
      </code>
      prefix can be used with the
            group search attribute. Any group attribute with a {GA}
            prefix is treated as a user attribute having group names.
            For example, with a value of
      <code class="literal">
       {GA}MemberOf
      </code>
      , if the group value is the
            DN, the first attribute value from the group DN is returned
            as the group name.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_sasl_init_pool_size">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_init_pool_size">
       <code class="literal">
        authentication_ldap_sasl_init_pool_size
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045243114240">
     </a>
     <a class="indexterm" name="idm46045243113200">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_sasl_init_pool_size">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-sasl-init-pool-size=#
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_init_pool_size">
            authentication_ldap_sasl_init_pool_size
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          Integer
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           10
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Minimum Value
         </th>
         <td>
          <code class="literal">
           0
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Maximum Value
         </th>
         <td>
          <code class="literal">
           32767
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Unit
         </th>
         <td>
          connections
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For SASL LDAP authentication, the initial size of the pool
            of connections to the LDAP server. Choose the value for this
            variable based on the average number of concurrent
            authentication requests to the LDAP server.
     </p>
     <p>
      The plugin uses
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_init_pool_size">
       <code class="literal">
        authentication_ldap_sasl_init_pool_size
       </code>
      </a>
      and
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_max_pool_size">
       <code class="literal">
        authentication_ldap_sasl_max_pool_size
       </code>
      </a>
      together for connection-pool management:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         When the authentication plugin initializes, it creates
         <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_init_pool_size">
          <code class="literal">
           authentication_ldap_sasl_init_pool_size
          </code>
         </a>
         connections, unless
         <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_max_pool_size">
          <code class="literal">
           authentication_ldap_sasl_max_pool_size=0
          </code>
         </a>
         to disable pooling.
        </p>
       </li>
       <li class="listitem">
        <p>
         If the plugin receives an authentication request when
                there are no free connections in the current connection
                pool, the plugin can create a new connection, up to the
                maximum connection pool size given by
         <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_max_pool_size">
          <code class="literal">
           authentication_ldap_sasl_max_pool_size
          </code>
         </a>
         .
        </p>
       </li>
       <li class="listitem">
        <p>
         If the plugin receives a request when the pool size is
                already at its maximum and there are no free
                connections, authentication fails.
        </p>
       </li>
       <li class="listitem">
        <p>
         When the plugin unloads, it closes all pooled
                connections.
        </p>
       </li>
      </ul>
     </div>
     <p>
      Changes to plugin system variable settings may have no
            effect on connections already in the pool. For example,
            modifying the LDAP server host, port, or TLS settings does
            not affect existing connections. However, if the original
            variable values were invalid and the connection pool could
            not be initialized, the plugin attempts to reinitialize the
            pool for the next LDAP request. In this case, the new system
            variable values are used for the reinitialization attempt.
     </p>
     <p>
      If
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_max_pool_size">
       <code class="literal">
        authentication_ldap_sasl_max_pool_size=0
       </code>
      </a>
      to disable pooling, each LDAP connection opened by the
            plugin uses the values the system variables have at that
            time.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_sasl_log_status">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_log_status">
       <code class="literal">
        authentication_ldap_sasl_log_status
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045243067040">
     </a>
     <a class="indexterm" name="idm46045243066000">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_sasl_log_status">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-sasl-log-status=#
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_log_status">
            authentication_ldap_sasl_log_status
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          Integer
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           1
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Minimum Value
         </th>
         <td>
          <code class="literal">
           1
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Maximum Value
         </th>
         <td>
          <code class="literal">
           6
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <a class="indexterm" name="idm46045243039392">
     </a>
     <p>
      For SASL LDAP authentication, the logging level for messages
            written to the error log. The following table shows the
            permitted level values and their meanings.
     </p>
     <div class="table">
      <a name="idm46045243037296">
      </a>
      <p class="title">
       <b>
        Table 8.29 Log Levels for authentication_ldap_sasl_log_status
       </b>
      </p>
      <div class="table-contents">
       <table summary="authentication_ldap_sasl_log_status system variable option values and types of messages logged per value.">
        <colgroup>
         <col style="width: 30%"/>
         <col style="width: 70%"/>
        </colgroup>
        <thead>
         <tr>
          <th>
           Option Value
          </th>
          <th>
           Types of Messages Logged
          </th>
         </tr>
        </thead>
        <tbody>
         <tr>
          <td>
           <code class="literal">
            1
           </code>
          </td>
          <td>
           No messages
          </td>
         </tr>
         <tr>
          <td>
           <code class="literal">
            2
           </code>
          </td>
          <td>
           Error messages
          </td>
         </tr>
         <tr>
          <td>
           <code class="literal">
            3
           </code>
          </td>
          <td>
           Error and warning messages
          </td>
         </tr>
         <tr>
          <td>
           <code class="literal">
            4
           </code>
          </td>
          <td>
           Error, warning, and information messages
          </td>
         </tr>
         <tr>
          <td>
           <code class="literal">
            5
           </code>
          </td>
          <td>
           Same as previous level plus debugging messages from MySQL
          </td>
         </tr>
         <tr>
          <td>
           <code class="literal">
            6
           </code>
          </td>
          <td>
           Same as previous level plus debugging messages from LDAP library
          </td>
         </tr>
        </tbody>
       </table>
      </div>
     </div>
     <br class="table-break"/>
     <a class="indexterm" name="idm46045243016256">
     </a>
     <a class="indexterm" name="idm46045243014768">
     </a>
     <a class="indexterm" name="idm46045243013664">
     </a>
     <p>
      On the client side, messages can be logged to the standard
            output by setting the
      <code class="literal">
       AUTHENTICATION_LDAP_CLIENT_LOG
      </code>
      environment variable. The permitted and default values are
            the same as for
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_log_status">
       <code class="literal">
        authentication_ldap_sasl_log_status
       </code>
      </a>
      .
     </p>
     <p>
      The
      <code class="literal">
       AUTHENTICATION_LDAP_CLIENT_LOG
      </code>
      environment variable applies only to SASL LDAP
            authentication. It has no effect for simple LDAP
            authentication because the client plugin in that case is
      <code class="literal">
       mysql_clear_password
      </code>
      , which knows nothing
            about LDAP operations.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_sasl_max_pool_size">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_max_pool_size">
       <code class="literal">
        authentication_ldap_sasl_max_pool_size
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045243004784">
     </a>
     <a class="indexterm" name="idm46045243003744">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_sasl_max_pool_size">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-sasl-max-pool-size=#
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_max_pool_size">
            authentication_ldap_sasl_max_pool_size
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          Integer
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           1000
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Minimum Value
         </th>
         <td>
          <code class="literal">
           0
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Maximum Value
         </th>
         <td>
          <code class="literal">
           32767
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Unit
         </th>
         <td>
          connections
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For SASL LDAP authentication, the maximum size of the pool
            of connections to the LDAP server. To disable connection
            pooling, set this variable to 0.
     </p>
     <p>
      This variable is used in conjunction with
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_init_pool_size">
       <code class="literal">
        authentication_ldap_sasl_init_pool_size
       </code>
      </a>
      .
            See the description of that variable.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_sasl_referral">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_referral">
       <code class="literal">
        authentication_ldap_sasl_referral
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242970048">
     </a>
     <a class="indexterm" name="idm46045242969008">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_sasl_referral">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-sasl-referral[={OFF|ON}]
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_referral">
            authentication_ldap_sasl_referral
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          Boolean
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           OFF
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For SASL LDAP authentication, whether to enable LDAP search
            referral. See
      <a class="xref" href="ldap-pluggable-authentication.html#ldap-pluggable-authentication-ldap-referral" title="LDAP Search Referral">
       LDAP Search Referral
      </a>
      .
     </p>
     <p>
      This variable can be set to override the default OpenLDAP
            referral configuration; see
      <a class="xref" href="ldap-pluggable-authentication.html#ldap-pluggable-authentication-ldap-conf" title="LDAP Pluggable Authentication and ldap.conf">
       LDAP Pluggable Authentication and ldap.conf
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_sasl_response_timeout">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_response_timeout">
       <code class="literal">
        authentication_ldap_sasl_response_timeout
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242942272">
     </a>
     <a class="indexterm" name="idm46045242941152">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_sasl_response_timeout">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-sasl-response-timeout=#
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_response_timeout">
            authentication_ldap_sasl_response_timeout
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          Integer
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           30
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Minimum Value
         </th>
         <td>
          <code class="literal">
           0
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Maximum Value
         </th>
         <td>
          <code class="literal">
           31536000
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Unit
         </th>
         <td>
          seconds
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      Specifies the time (in seconds) that MySQL server waits for
            the LDAP server to response to an LDAP bind request.
     </p>
     <p>
      When a MySQL account authenticates using LDAP, MySQL server
            sends an LDAP bind request to the LDAP server. If the LDAP
            server does not respond to the request after a configured
            amount of time, MySQL abandons the request and emits an
            error message. If the timeout setting is zero, MySQL server
            ignores this system variable setting. For more information,
            see
      <a class="xref" href="ldap-pluggable-authentication.html#ldap-pluggable-authentication-timeouts" title="Setting Timeouts for LDAP Pluggable Authentication">
       Setting Timeouts for LDAP Pluggable Authentication
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_sasl_server_host">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_server_host">
       <code class="literal">
        authentication_ldap_sasl_server_host
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242907760">
     </a>
     <a class="indexterm" name="idm46045242906720">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_sasl_server_host">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-sasl-server-host=host_name
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_server_host">
            authentication_ldap_sasl_server_host
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For SASL LDAP authentication, the LDAP server host. The
            permitted values for this variable depend on the
            authentication method:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         For
         <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_auth_method_name">
          <code class="literal">
           authentication_ldap_sasl_auth_method_name=SCRAM-SHA-1
          </code>
         </a>
         :
                The LDAP server host can be a host name or IP address.
        </p>
       </li>
       <li class="listitem">
        <p>
         For
         <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_auth_method_name">
          <code class="literal">
           authentication_ldap_sasl_auth_method_name=SCRAM-SHA-256
          </code>
         </a>
         :
                The LDAP server host can be a host name or IP address.
        </p>
       </li>
      </ul>
     </div>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_sasl_server_port">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_server_port">
       <code class="literal">
        authentication_ldap_sasl_server_port
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242879488">
     </a>
     <a class="indexterm" name="idm46045242878448">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_sasl_server_port">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-sasl-server-port=port_num
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_server_port">
            authentication_ldap_sasl_server_port
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          Integer
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           389
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Minimum Value
         </th>
         <td>
          <code class="literal">
           1
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Maximum Value
         </th>
         <td>
          <code class="literal">
           32376
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For SASL LDAP authentication, the LDAP server TCP/IP port
            number.
     </p>
     <p>
      If the LDAP port number is configured as 636 or 3269, the
            plugin uses LDAPS (LDAP over SSL) instead of LDAP. (LDAPS
            differs from
      <code class="literal">
       startTLS
      </code>
      .)
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_sasl_tls">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_tls">
       <code class="literal">
        authentication_ldap_sasl_tls
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242847552">
     </a>
     <a class="indexterm" name="idm46045242846448">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_sasl_tls">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-sasl-tls[={OFF|ON}]
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_tls">
            authentication_ldap_sasl_tls
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          Boolean
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           OFF
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For SASL LDAP authentication, whether connections by the
            plugin to the LDAP server are secure. If this variable is
            enabled, the plugin uses TLS to connect securely to the LDAP
            server. This variable can be set to override the default
            OpenLDAP TLS configuration; see
      <a class="xref" href="ldap-pluggable-authentication.html#ldap-pluggable-authentication-ldap-conf" title="LDAP Pluggable Authentication and ldap.conf">
       LDAP Pluggable Authentication and ldap.conf
      </a>
      If
            you enable this variable, you may also wish to set the
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_ca_path">
       <code class="literal">
        authentication_ldap_sasl_ca_path
       </code>
      </a>
      variable.
     </p>
     <p>
      MySQL LDAP plugins support the StartTLS method, which
            initializes TLS on top of a plain LDAP connection.
     </p>
     <p>
      LDAPS can be used by setting the
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_server_port">
       <code class="literal">
        authentication_ldap_sasl_server_port
       </code>
      </a>
      system variable.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_sasl_user_search_attr">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_user_search_attr">
       <code class="literal">
        authentication_ldap_sasl_user_search_attr
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242817040">
     </a>
     <a class="indexterm" name="idm46045242815920">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_sasl_user_search_attr">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-sasl-user-search-attr=value
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_user_search_attr">
            authentication_ldap_sasl_user_search_attr
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           uid
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For SASL LDAP authentication, the name of the attribute that
            specifies user names in LDAP directory entries. If a user
            distinguished name is not provided, the authentication
            plugin searches for the name using this attribute. For
            example, if the
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_sasl_user_search_attr">
       <code class="literal">
        authentication_ldap_sasl_user_search_attr
       </code>
      </a>
      value is
      <code class="literal">
       uid
      </code>
      , a search for the user name
      <code class="literal">
       user1
      </code>
      finds entries with a
      <code class="literal">
       uid
      </code>
      value of
      <code class="literal">
       user1
      </code>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_simple_auth_method_name">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_auth_method_name">
       <code class="literal">
        authentication_ldap_simple_auth_method_name
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242786736">
     </a>
     <a class="indexterm" name="idm46045242785616">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_simple_auth_method_name">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-simple-auth-method-name=value
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_auth_method_name">
            authentication_ldap_simple_auth_method_name
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           SIMPLE
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Valid Values
         </th>
         <td>
          <p class="valid-value">
           <code class="literal">
            SIMPLE
           </code>
          </p>
          <p class="valid-value">
           <code class="literal">
            AD-FOREST
           </code>
          </p>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For simple LDAP authentication, the authentication method
            name. Communication between the authentication plugin and
            the LDAP server occurs according to this authentication
            method.
     </p>
     <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
      <div class="admon-title">
       Note
      </div>
      <p>
       For all simple LDAP authentication methods, it is
              recommended to also set TLS parameters to require that
              communication with the LDAP server take place over secure
              connections.
      </p>
     </div>
     <p>
      These authentication method values are permitted:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         <code class="literal">
          SIMPLE
         </code>
         : Use simple LDAP
                authentication. This method uses either one or two LDAP
                bind operations, depending on whether the MySQL account
                names an LDAP user distinguished name. See the
                description of
         <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_bind_root_dn">
          <code class="literal">
           authentication_ldap_simple_bind_root_dn
          </code>
         </a>
         .
        </p>
       </li>
       <li class="listitem">
        <p>
         <code class="literal">
          AD-FOREST
         </code>
         : A variation on
         <code class="literal">
          SIMPLE
         </code>
         , such that authentication
                searches all domains in the Active Directory forest,
                performing an LDAP bind to each Active Directory domain
                until the user is found in some domain.
        </p>
       </li>
      </ul>
     </div>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_simple_bind_base_dn">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_bind_base_dn">
       <code class="literal">
        authentication_ldap_simple_bind_base_dn
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242749360">
     </a>
     <a class="indexterm" name="idm46045242748320">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_simple_bind_base_dn">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-simple-bind-base-dn=value
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_bind_base_dn">
            authentication_ldap_simple_bind_base_dn
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           NULL
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For simple LDAP authentication, the base distinguished name
            (DN). This variable can be used to limit the scope of
            searches by anchoring them at a certain location (the
      <span class="quote">
       “
       <span class="quote">
        base
       </span>
       ”
      </span>
      ) within the search tree.
     </p>
     <p>
      Suppose that members of one set of LDAP user entries each
            have this form:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-ini"><div class="docs-select-all right" id="sa61943277"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token constant">uid</span><span class="token attr-value"><span class="token punctuation">=</span><em class="replaceable">user_name</em>,ou=People,dc=example,dc=com</span></code></pre>
     </div>
     <p>
      And that members of another set of LDAP user entries each
            have this form:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-ini"><div class="docs-select-all right" id="sa31753311"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token constant">uid</span><span class="token attr-value"><span class="token punctuation">=</span><em class="replaceable">user_name</em>,ou=Admin,dc=example,dc=com</span></code></pre>
     </div>
     <p>
      Then searches work like this for different base DN values:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         If the base DN is
         <code class="literal">
          ou=People,dc=example,dc=com
         </code>
         : Searches
                find user entries only in the first set.
        </p>
       </li>
       <li class="listitem">
        <p>
         If the base DN is
         <code class="literal">
          ou=Admin,dc=example,dc=com
         </code>
         : Searches
                find user entries only in the second set.
        </p>
       </li>
       <li class="listitem">
        <p>
         If the base DN is
         <code class="literal">
          ou=dc=example,dc=com
         </code>
         : Searches find
                user entries in the first or second set.
        </p>
       </li>
      </ul>
     </div>
     <p>
      In general, more specific base DN values result in faster
            searches because they limit the search scope more.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_simple_bind_root_dn">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_bind_root_dn">
       <code class="literal">
        authentication_ldap_simple_bind_root_dn
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242712768">
     </a>
     <a class="indexterm" name="idm46045242711728">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_simple_bind_root_dn">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-simple-bind-root-dn=value
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_bind_root_dn">
            authentication_ldap_simple_bind_root_dn
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           NULL
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For simple LDAP authentication, the root distinguished name
            (DN). This variable is used in conjunction with
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_bind_root_pwd">
       <code class="literal">
        authentication_ldap_simple_bind_root_pwd
       </code>
      </a>
      as the credentials for authenticating to the LDAP server for
            the purpose of performing searches. Authentication uses
            either one or two LDAP bind operations, depending on whether
            the MySQL account names an LDAP user DN:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         If the account does not name a user DN:
         <code class="literal">
          authentication_ldap_simple
         </code>
         performs
                an initial LDAP binding using
         <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_bind_root_dn">
          <code class="literal">
           authentication_ldap_simple_bind_root_dn
          </code>
         </a>
         and
         <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_bind_root_pwd">
          <code class="literal">
           authentication_ldap_simple_bind_root_pwd
          </code>
         </a>
         .
                (These are both empty by default, so if they are not
                set, the LDAP server must permit anonymous connections.)
                The resulting bind LDAP handle is used to search for the
                user DN, based on the client user name.
         <code class="literal">
          authentication_ldap_simple
         </code>
         performs a
                second bind using the user DN and client-supplied
                password.
        </p>
       </li>
       <li class="listitem">
        <p>
         If the account does name a user DN: The first bind
                operation is unnecessary in this case.
         <code class="literal">
          authentication_ldap_simple
         </code>
         performs a
                single bind using the user DN and client-supplied
                password. This is faster than if the MySQL account does
                not specify an LDAP user DN.
        </p>
       </li>
      </ul>
     </div>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_simple_bind_root_pwd">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_bind_root_pwd">
       <code class="literal">
        authentication_ldap_simple_bind_root_pwd
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242677616">
     </a>
     <a class="indexterm" name="idm46045242676496">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_simple_bind_root_pwd">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-simple-bind-root-pwd=value
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_bind_root_pwd">
            authentication_ldap_simple_bind_root_pwd
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           NULL
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For simple LDAP authentication, the password for the root
            distinguished name. This variable is used in conjunction
            with
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_bind_root_dn">
       <code class="literal">
        authentication_ldap_simple_bind_root_dn
       </code>
      </a>
      .
            See the description of that variable.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_simple_ca_path">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_ca_path">
       <code class="literal">
        authentication_ldap_simple_ca_path
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242650160">
     </a>
     <a class="indexterm" name="idm46045242649120">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_simple_ca_path">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-simple-ca-path=value
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_ca_path">
            authentication_ldap_simple_ca_path
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           NULL
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For simple LDAP authentication, the absolute path of the
            certificate authority file. Specify this file if it is
            desired that the authentication plugin perform verification
            of the LDAP server certificate.
     </p>
     <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
      <div class="admon-title">
       Note
      </div>
      <p>
       In addition to setting the
       <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_ca_path">
        <code class="literal">
         authentication_ldap_simple_ca_path
        </code>
       </a>
       variable to the file name, you must add the appropriate
              certificate authority certificates to the file and enable
              the
       <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_tls">
        <code class="literal">
         authentication_ldap_simple_tls
        </code>
       </a>
       system variable. These variables can be set to override
              the default OpenLDAP TLS configuration; see
       <a class="xref" href="ldap-pluggable-authentication.html#ldap-pluggable-authentication-ldap-conf" title="LDAP Pluggable Authentication and ldap.conf">
        LDAP Pluggable Authentication and ldap.conf
       </a>
      </p>
     </div>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_simple_connect_timeout">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_connect_timeout">
       <code class="literal">
        authentication_ldap_simple_connect_timeout
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242619744">
     </a>
     <a class="indexterm" name="idm46045242618624">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_simple_connect_timeout">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-simple-connect-timeout=#
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_connect_timeout">
            authentication_ldap_simple_connect_timeout
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          Integer
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           30
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Minimum Value
         </th>
         <td>
          <code class="literal">
           0
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Maximum Value
         </th>
         <td>
          <code class="literal">
           31536000
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Unit
         </th>
         <td>
          seconds
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      Specifies the time (in seconds) that MySQL server waits to
            connect to the LDAP server using TCP.
     </p>
     <p>
      When a MySQL account authenticates using LDAP, MySQL server
            attempts to establish a TCP connection with the LDAP server,
            which it uses to send an LDAP bind request over the
            connection. If the LDAP server does not respond to TCP
            handshake after a configured amount of time, MySQL abandons
            the TCP handshake attempt and emits an error message. If the
            timeout setting is zero, MySQL server ignores this system
            variable setting. For more information, see
      <a class="xref" href="ldap-pluggable-authentication.html#ldap-pluggable-authentication-timeouts" title="Setting Timeouts for LDAP Pluggable Authentication">
       Setting Timeouts for LDAP Pluggable Authentication
      </a>
      .
     </p>
     <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
      <div class="admon-title">
       Note
      </div>
      <p>
       If you set this variable to a timeout value that is
              greater than the host system's default value, the
              shorter system timeout is used.
      </p>
     </div>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_simple_group_search_attr">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_group_search_attr">
       <code class="literal">
        authentication_ldap_simple_group_search_attr
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242584208">
     </a>
     <a class="indexterm" name="idm46045242583088">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_simple_group_search_attr">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-simple-group-search-attr=value
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_group_search_attr">
            authentication_ldap_simple_group_search_attr
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           cn
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For simple LDAP authentication, the name of the attribute
            that specifies group names in LDAP directory entries. If
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_group_search_attr">
       <code class="literal">
        authentication_ldap_simple_group_search_attr
       </code>
      </a>
      has its default value of
      <code class="literal">
       cn
      </code>
      , searches
            return the
      <code class="literal">
       cn
      </code>
      value as the group name.
            For example, if an LDAP entry with a
      <code class="literal">
       uid
      </code>
      value of
      <code class="literal">
       user1
      </code>
      has a
      <code class="literal">
       cn
      </code>
      attribute of
      <code class="literal">
       mygroup
      </code>
      , searches for
      <code class="literal">
       user1
      </code>
      return
      <code class="literal">
       mygroup
      </code>
      as the group name.
     </p>
     <p>
      If the group search attribute is
      <code class="literal">
       isMemberOf
      </code>
      , LDAP authentication directly
            retrieves the user attribute
      <code class="literal">
       isMemberOf
      </code>
      value and assigns it as group information. If the group
            search attribute is not
      <code class="literal">
       isMemberOf
      </code>
      , LDAP
            authentication searches for all groups where the user is a
            member. (The latter is the default behavior.) This behavior
            is based on how LDAP group information can be stored two
            ways: 1) A group entry can have an attribute named
      <code class="literal">
       memberUid
      </code>
      or
      <code class="literal">
       member
      </code>
      with a value that is a user name; 2) A user entry can have
            an attribute named
      <code class="literal">
       isMemberOf
      </code>
      with values
            that are group names.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_simple_group_search_filter">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_group_search_filter">
       <code class="literal">
        authentication_ldap_simple_group_search_filter
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242545728">
     </a>
     <a class="indexterm" name="idm46045242544608">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_simple_group_search_filter">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-simple-group-search-filter=value
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_group_search_filter">
            authentication_ldap_simple_group_search_filter
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           (|(&amp;(objectClass=posixGroup)(memberUid=%s))(&amp;(objectClass=group)(member=%s)))
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For simple LDAP authentication, the custom group search
            filter.
     </p>
     <p>
      The search filter value can contain
      <code class="literal">
       {UA}
      </code>
      and
      <code class="literal">
       {UD}
      </code>
      notation to represent the user
            name and the full user DN. For example,
      <code class="literal">
       {UA}
      </code>
      is replaced with a user name such as
      <code class="literal">
       "admin"
      </code>
      , whereas
      <code class="literal">
       {UD}
      </code>
      is replaced with a use full DN such as
      <code class="literal">
       "uid=admin,ou=People,dc=example,dc=com"
      </code>
      .
            The following value is the default, which supports both
            OpenLDAP and Active Directory:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-simple"><div class="docs-select-all right" id="sa14010286"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-simple"><span class="token punctuation">(</span><span class="token operator">|</span><span class="token punctuation">(</span><span class="token operator">&amp;</span><span class="token punctuation">(</span>objectClass<span class="token operator">=</span>posixGroup<span class="token punctuation">)</span><span class="token punctuation">(</span>memberUid<span class="token operator">=</span><span class="token punctuation">{</span>UA<span class="token punctuation">}</span><span class="token punctuation">)</span><span class="token punctuation">)</span>
  <span class="token punctuation">(</span><span class="token operator">&amp;</span><span class="token punctuation">(</span>objectClass<span class="token operator">=</span>group<span class="token punctuation">)</span><span class="token punctuation">(</span>member<span class="token operator">=</span><span class="token punctuation">{</span>UD<span class="token punctuation">}</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">)</span></code></pre>
     </div>
     <p>
      In some cases for the user scenario,
      <code class="literal">
       memberOf
      </code>
      is a simple user attribute that
            holds no group information. For additional flexibility, an
            optional
      <code class="literal">
       {GA}
      </code>
      prefix can be used with the
            group search attribute. Any group attribute with a {GA}
            prefix is treated as a user attribute having group names.
            For example, with a value of
      <code class="literal">
       {GA}MemberOf
      </code>
      , if the group value is the
            DN, the first attribute value from the group DN is returned
            as the group name.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_simple_init_pool_size">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_init_pool_size">
       <code class="literal">
        authentication_ldap_simple_init_pool_size
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242510480">
     </a>
     <a class="indexterm" name="idm46045242509360">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_simple_init_pool_size">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-simple-init-pool-size=#
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_init_pool_size">
            authentication_ldap_simple_init_pool_size
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          Integer
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           10
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Minimum Value
         </th>
         <td>
          <code class="literal">
           0
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Maximum Value
         </th>
         <td>
          <code class="literal">
           32767
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Unit
         </th>
         <td>
          connections
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For simple LDAP authentication, the initial size of the pool
            of connections to the LDAP server. Choose the value for this
            variable based on the average number of concurrent
            authentication requests to the LDAP server.
     </p>
     <p>
      The plugin uses
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_init_pool_size">
       <code class="literal">
        authentication_ldap_simple_init_pool_size
       </code>
      </a>
      and
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_max_pool_size">
       <code class="literal">
        authentication_ldap_simple_max_pool_size
       </code>
      </a>
      together for connection-pool management:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         When the authentication plugin initializes, it creates
         <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_init_pool_size">
          <code class="literal">
           authentication_ldap_simple_init_pool_size
          </code>
         </a>
         connections, unless
         <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_max_pool_size">
          <code class="literal">
           authentication_ldap_simple_max_pool_size=0
          </code>
         </a>
         to disable pooling.
        </p>
       </li>
       <li class="listitem">
        <p>
         If the plugin receives an authentication request when
                there are no free connections in the current connection
                pool, the plugin can create a new connection, up to the
                maximum connection pool size given by
         <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_max_pool_size">
          <code class="literal">
           authentication_ldap_simple_max_pool_size
          </code>
         </a>
         .
        </p>
       </li>
       <li class="listitem">
        <p>
         If the plugin receives a request when the pool size is
                already at its maximum and there are no free
                connections, authentication fails.
        </p>
       </li>
       <li class="listitem">
        <p>
         When the plugin unloads, it closes all pooled
                connections.
        </p>
       </li>
      </ul>
     </div>
     <p>
      Changes to plugin system variable settings may have no
            effect on connections already in the pool. For example,
            modifying the LDAP server host, port, or TLS settings does
            not affect existing connections. However, if the original
            variable values were invalid and the connection pool could
            not be initialized, the plugin attempts to reinitialize the
            pool for the next LDAP request. In this case, the new system
            variable values are used for the reinitialization attempt.
     </p>
     <p>
      If
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_max_pool_size">
       <code class="literal">
        authentication_ldap_simple_max_pool_size=0
       </code>
      </a>
      to disable pooling, each LDAP connection opened by the
            plugin uses the values the system variables have at that
            time.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_simple_log_status">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_log_status">
       <code class="literal">
        authentication_ldap_simple_log_status
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242463088">
     </a>
     <a class="indexterm" name="idm46045242462048">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_simple_log_status">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-simple-log-status=#
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_log_status">
            authentication_ldap_simple_log_status
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          Integer
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           1
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Minimum Value
         </th>
         <td>
          <code class="literal">
           1
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Maximum Value
         </th>
         <td>
          <code class="literal">
           6
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <a class="indexterm" name="idm46045242435424">
     </a>
     <p>
      For simple LDAP authentication, the logging level for
            messages written to the error log. The following table shows
            the permitted level values and their meanings.
     </p>
     <div class="table">
      <a name="idm46045242433328">
      </a>
      <p class="title">
       <b>
        Table 8.30 Log Levels for authentication_ldap_simple_log_status
       </b>
      </p>
      <div class="table-contents">
       <table summary="authentication_ldap_simple_log_status system variable option values and types of messages logged per value.">
        <colgroup>
         <col style="width: 30%"/>
         <col style="width: 70%"/>
        </colgroup>
        <thead>
         <tr>
          <th>
           Option Value
          </th>
          <th>
           Types of Messages Logged
          </th>
         </tr>
        </thead>
        <tbody>
         <tr>
          <td>
           <code class="literal">
            1
           </code>
          </td>
          <td>
           No messages
          </td>
         </tr>
         <tr>
          <td>
           <code class="literal">
            2
           </code>
          </td>
          <td>
           Error messages
          </td>
         </tr>
         <tr>
          <td>
           <code class="literal">
            3
           </code>
          </td>
          <td>
           Error and warning messages
          </td>
         </tr>
         <tr>
          <td>
           <code class="literal">
            4
           </code>
          </td>
          <td>
           Error, warning, and information messages
          </td>
         </tr>
         <tr>
          <td>
           <code class="literal">
            5
           </code>
          </td>
          <td>
           Same as previous level plus debugging messages from MySQL
          </td>
         </tr>
         <tr>
          <td>
           <code class="literal">
            6
           </code>
          </td>
          <td>
           Same as previous level plus debugging messages from LDAP library
          </td>
         </tr>
        </tbody>
       </table>
      </div>
     </div>
     <br class="table-break"/>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_simple_max_pool_size">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_max_pool_size">
       <code class="literal">
        authentication_ldap_simple_max_pool_size
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242409728">
     </a>
     <a class="indexterm" name="idm46045242408608">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_simple_max_pool_size">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-simple-max-pool-size=#
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_max_pool_size">
            authentication_ldap_simple_max_pool_size
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          Integer
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           1000
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Minimum Value
         </th>
         <td>
          <code class="literal">
           0
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Maximum Value
         </th>
         <td>
          <code class="literal">
           32767
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Unit
         </th>
         <td>
          connections
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For simple LDAP authentication, the maximum size of the pool
            of connections to the LDAP server. To disable connection
            pooling, set this variable to 0.
     </p>
     <p>
      This variable is used in conjunction with
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_init_pool_size">
       <code class="literal">
        authentication_ldap_simple_init_pool_size
       </code>
      </a>
      .
            See the description of that variable.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_simple_referral">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_referral">
       <code class="literal">
        authentication_ldap_simple_referral
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242374864">
     </a>
     <a class="indexterm" name="idm46045242373824">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_simple_referral">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-simple-referral[={OFF|ON}]
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_referral">
            authentication_ldap_simple_referral
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          Boolean
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           OFF
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For simple LDAP authentication, whether to enable LDAP
            search referral. See
      <a class="xref" href="ldap-pluggable-authentication.html#ldap-pluggable-authentication-ldap-referral" title="LDAP Search Referral">
       LDAP Search Referral
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_simple_response_timeout">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_response_timeout">
       <code class="literal">
        authentication_ldap_simple_response_timeout
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242348352">
     </a>
     <a class="indexterm" name="idm46045242347232">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_simple_response_timeout">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-simple-response-timeout=#
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_response_timeout">
            authentication_ldap_simple_response_timeout
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          Integer
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           30
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Minimum Value
         </th>
         <td>
          <code class="literal">
           0
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Maximum Value
         </th>
         <td>
          <code class="literal">
           31536000
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Unit
         </th>
         <td>
          seconds
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      Specifies the time (in seconds) that MySQL server waits for
            the LDAP server to response to an LDAP bind request.
     </p>
     <p>
      When a MySQL account authenticates using LDAP, MySQL server
            sends an LDAP bind request to the LDAP server. If the LDAP
            server does not respond to the request after a configured
            amount of time, MySQL abandons the request and emits an
            error message. If the timeout setting is zero, MySQL server
            ignores this system variable setting. For more information,
            see
      <a class="xref" href="ldap-pluggable-authentication.html#ldap-pluggable-authentication-timeouts" title="Setting Timeouts for LDAP Pluggable Authentication">
       Setting Timeouts for LDAP Pluggable Authentication
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_simple_server_host">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_server_host">
       <code class="literal">
        authentication_ldap_simple_server_host
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242313904">
     </a>
     <a class="indexterm" name="idm46045242312864">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_simple_server_host">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-simple-server-host=host_name
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_server_host">
            authentication_ldap_simple_server_host
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For simple LDAP authentication, the LDAP server host. The
            permitted values for this variable depend on the
            authentication method:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         For
         <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_auth_method_name">
          <code class="literal">
           authentication_ldap_simple_auth_method_name=SIMPLE
          </code>
         </a>
         :
                The LDAP server host can be a host name or IP address.
        </p>
       </li>
       <li class="listitem">
        <p>
         For
         <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_auth_method_name">
          <code class="literal">
           authentication_ldap_simple_auth_method_name=AD-FOREST
          </code>
         </a>
         .
                The LDAP server host can be an Active Directory domain
                name. For example, for an LDAP server URL of
         <code class="literal">
          ldap://example.mem.local:389
         </code>
         , the
                domain name can be
         <code class="literal">
          mem.local
         </code>
         .
        </p>
        <a class="indexterm" name="idm46045242286880">
        </a>
        <p>
         An Active Directory forest setup can have multiple
                domains (LDAP server IPs), which can be discovered using
                DNS. On Unix and Unix-like systems, some additional
                setup may be required to configure your DNS server with
                SRV records that specify the LDAP servers for the Active
                Directory domain. For information about DNS SRV, see
         <a class="ulink" href="https://tools.ietf.org/html/rfc2782" target="_blank">
          RFC
                2782
         </a>
         .
        </p>
        <p>
         Suppose that your configuration has these properties:
        </p>
        <div class="itemizedlist">
         <ul class="itemizedlist" style="list-style-type: square; ">
          <li class="listitem">
           <p>
            The name server that provides information about
                    Active Directory domains has IP address
            <code class="literal">
             10.172.166.100
            </code>
            .
           </p>
          </li>
          <li class="listitem">
           <p>
            The LDAP servers have names
            <code class="literal">
             ldap1.mem.local
            </code>
            through
            <code class="literal">
             ldap3.mem.local
            </code>
            and IP addresses
            <code class="literal">
             10.172.166.101
            </code>
            through
            <code class="literal">
             10.172.166.103
            </code>
            .
           </p>
          </li>
         </ul>
        </div>
        <p>
         You want the LDAP servers to be discoverable using SRV
                searches. For example, at the command line, a command
                like this should list the LDAP servers:
        </p>
        <div class="copytoclipboard-wrapper">
         <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa24917118"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">host <span class="token property">-t</span> SRV _ldap<span class="token punctuation">.</span>_tcp<span class="token punctuation">.</span>mem<span class="token punctuation">.</span>local</code></pre>
        </div>
        <p>
         Perform the DNS configuration as follows:
        </p>
        <div class="orderedlist">
         <ol class="orderedlist" type="1">
          <li class="listitem">
           <p>
            Add a line to
            <code class="filename">
             /etc/resolv.conf
            </code>
            to specify the name server that provides information
                    about Active Directory domains:
           </p>
           <div class="copytoclipboard-wrapper">
            <pre class="programlisting one-line language-none"><div class="docs-select-all right" id="sa361766"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">nameserver 10.172.166.100</code></pre>
           </div>
          </li>
          <li class="listitem">
           <p>
            Configure the appropriate zone file for the name
                    server with SRV records for the LDAP servers:
           </p>
           <div class="copytoclipboard-wrapper">
            <pre class="programlisting language-none"><div class="docs-select-all right" id="sa91738044"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">_ldap._tcp.mem.local. 86400 IN SRV 0 100 389 ldap1.mem.local.
_ldap._tcp.mem.local. 86400 IN SRV 0 100 389 ldap2.mem.local.
_ldap._tcp.mem.local. 86400 IN SRV 0 100 389 ldap3.mem.local.</code></pre>
           </div>
          </li>
          <li class="listitem">
           <p>
            It may also be necessary to specify the IP address
                    for the LDAP servers in
            <code class="filename">
             /etc/hosts
            </code>
            if the server host
                    cannot be resolved. For example, add lines like this
                    to the file:
           </p>
           <div class="copytoclipboard-wrapper">
            <pre class="programlisting language-none"><div class="docs-select-all right" id="sa5163526"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">10.172.166.101 ldap1.mem.local
10.172.166.102 ldap2.mem.local
10.172.166.103 ldap3.mem.local</code></pre>
           </div>
          </li>
         </ol>
        </div>
        <p>
         With the DNS configured as just described, the
                server-side LDAP plugin can discover the LDAP servers
                and tries to authenticate in all domains until
                authentication succeeds or there are no more servers.
        </p>
        <p>
         Windows needs no such settings as just described. Given
                the LDAP server host in the
         <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_server_host">
          <code class="literal">
           authentication_ldap_simple_server_host
          </code>
         </a>
         value, the Windows LDAP library searches all domains and
                attempts to authenticate.
        </p>
       </li>
      </ul>
     </div>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_simple_server_port">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_server_port">
       <code class="literal">
        authentication_ldap_simple_server_port
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242261904">
     </a>
     <a class="indexterm" name="idm46045242260864">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_simple_server_port">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-simple-server-port=port_num
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_server_port">
            authentication_ldap_simple_server_port
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          Integer
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           389
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Minimum Value
         </th>
         <td>
          <code class="literal">
           1
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Maximum Value
         </th>
         <td>
          <code class="literal">
           32376
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For simple LDAP authentication, the LDAP server TCP/IP port
            number.
     </p>
     <p>
      If the LDAP port number is configured as 636 or 3269, the
            plugin uses LDAPS (LDAP over SSL) instead of LDAP. (LDAPS
            differs from
      <code class="literal">
       startTLS
      </code>
      .)
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_simple_tls">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_tls">
       <code class="literal">
        authentication_ldap_simple_tls
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242230080">
     </a>
     <a class="indexterm" name="idm46045242228976">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_simple_tls">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-simple-tls[={OFF|ON}]
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_tls">
            authentication_ldap_simple_tls
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          Boolean
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           OFF
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For simple LDAP authentication, whether connections by the
            plugin to the LDAP server are secure. If this variable is
            enabled, the plugin uses TLS to connect securely to the LDAP
            server. This variable can be set to override the default
            OpenLDAP TLS configuration; see
      <a class="xref" href="ldap-pluggable-authentication.html#ldap-pluggable-authentication-ldap-conf" title="LDAP Pluggable Authentication and ldap.conf">
       LDAP Pluggable Authentication and ldap.conf
      </a>
      If
            you enable this variable, you may also wish to set the
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_ca_path">
       <code class="literal">
        authentication_ldap_simple_ca_path
       </code>
      </a>
      variable.
     </p>
     <p>
      MySQL LDAP plugins support the StartTLS method, which
            initializes TLS on top of a plain LDAP connection.
     </p>
     <p>
      LDAPS can be used by setting the
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_server_port">
       <code class="literal">
        authentication_ldap_simple_server_port
       </code>
      </a>
      system variable.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_ldap_simple_user_search_attr">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_user_search_attr">
       <code class="literal">
        authentication_ldap_simple_user_search_attr
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242199536">
     </a>
     <a class="indexterm" name="idm46045242198416">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_ldap_simple_user_search_attr">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-ldap-simple-user-search-attr=value
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_user_search_attr">
            authentication_ldap_simple_user_search_attr
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
        <tr>
         <th>
          Default Value
         </th>
         <td>
          <code class="literal">
           uid
          </code>
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      For simple LDAP authentication, the name of the attribute
            that specifies user names in LDAP directory entries. If a
            user distinguished name is not provided, the authentication
            plugin searches for the name using this attribute. For
            example, if the
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_ldap_simple_user_search_attr">
       <code class="literal">
        authentication_ldap_simple_user_search_attr
       </code>
      </a>
      value is
      <code class="literal">
       uid
      </code>
      , a search for the user name
      <code class="literal">
       user1
      </code>
      finds entries with a
      <code class="literal">
       uid
      </code>
      value of
      <code class="literal">
       user1
      </code>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="sysvar_authentication_webauthn_rp_id">
      </a>
      <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_webauthn_rp_id">
       <code class="literal">
        authentication_webauthn_rp_id
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045242169248">
     </a>
     <a class="indexterm" name="idm46045242168144">
     </a>
     <div class="informaltable">
      <table frame="box" rules="all" summary="Properties for authentication_webauthn_rp_id">
       <colgroup>
        <col style="width: 30%"/>
        <col style="width: 70%"/>
       </colgroup>
       <tbody>
        <tr>
         <th>
          Command-Line Format
         </th>
         <td>
          <code class="literal">
           --authentication-webauthn-rp-id=value
          </code>
         </td>
        </tr>
        <tr>
         <th>
          System Variable
         </th>
         <td>
          <code class="literal">
           <a class="link" href="pluggable-authentication-system-variables.html#sysvar_authentication_webauthn_rp_id">
            authentication_webauthn_rp_id
           </a>
          </code>
         </td>
        </tr>
        <tr>
         <th>
          Scope
         </th>
         <td>
          Global
         </td>
        </tr>
        <tr>
         <th>
          Dynamic
         </th>
         <td>
          Yes
         </td>
        </tr>
        <tr>
         <th>
          <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
           <code class="literal">
            SET_VAR
           </code>
          </a>
          Hint Applies
         </th>
         <td>
          No
         </td>
        </tr>
        <tr>
         <th>
          Type
         </th>
         <td>
          String
         </td>
        </tr>
       </tbody>
      </table>
     </div>
     <p>
      This variable specifies the relying party ID used for
            server-side plugin installation, device registration, and
            WebAuthn authentication. If WebAuthn authentication is
            attempted and this value is not the one expected by the
            device, the device assumes that it is not talking to the
            correct server and an error occurs. The maximum value length
            is 255 characters.
     </p>
    </li>
   </ul>
  </div>
 </div>
 <br/>
</div>
