客户端程序与服务器通信，客户端向服务器发送客户端用户名（默认为操作系统用户名）和密码：

服务器根据外部用户名和客户端连接的主机找到匹配的 MySQL 帐户。PAM 插件使用 MySQL 服务器传递给它的信息（例如用户名、主机名、密码和身份验证字符串）。当您定义使用 PAM 进行身份验证的 MySQL 帐户时，身份验证字符串包含：

该插件使用身份验证字符串中指定的 PAM 服务来检查用户凭据并返回or 。密码必须适用于 PAM 服务使用的密码存储。例子： 'Authentication succeeded, Username is user_name''Authentication failed'

如果凭据检查失败，服务器将拒绝连接。

否则，身份验证字符串指示是否发生代理。如果字符串不包含 PAM 组映射，则不会发生代理。在这种情况下，MySQL 用户名与外部用户名相同。

否则，根据PAM组映射指示代理，MySQL用户名根据映射列表中的第一个匹配组确定。“ PAM 组”的含义 取决于 PAM 服务。例子：

如果代理用户（外部用户）拥有被 PROXY代理 MySQL 用户名的权限，代理就会发生，代理用户会承担被代理用户的权限。

antonio验证 Unix 身份验证是否允许使用用户名和密码 登录操作系统 antonio_password。

通过创建一个 mysql-unix名为 /etc/pam.d/mysql-unix. 文件内容取决于系统，因此请检查目录中现有的与登录相关的文件/etc/pam.d 以查看它们的外观。在 Linux 上，该 mysql-unix文件可能如下所示：

#%PAM-1.0
auth            include         password-auth
account         include         password-auth

对于 macOS，使用login而不是 password-auth.

PAM 文件格式在某些系统上可能不同。例如，在 Ubuntu 和其他基于 Debian 的系统上，请改用这些文件内容：

@include common-auth
@include common-account
@include common-session-noninteractive

创建一个与操作系统用户名具有相同用户名的 MySQL 帐户，并将其定义为使用 PAM 插件和mysql-unix PAM 服务进行身份验证：

CREATE USER 'antonio'@'localhost'
  IDENTIFIED WITH authentication_pam
  AS 'mysql-unix';
GRANT ALL PRIVILEGES
  ON mydb.*
  TO 'antonio'@'localhost';

此处，身份验证字符串仅包含 PAM 服务名称，mysql-unix用于对 Unix 密码进行身份验证。

使用mysql命令行客户端以antonio. 例如：

$> mysql --user=antonio --password --enable-cleartext-plugin
Enter password: antonio_password

服务器应允许连接并且以下查询返回如下所示的输出：

mysql> SELECT USER(), CURRENT_USER(), @@proxy_user;
+-------------------+-------------------+--------------+
| USER()            | CURRENT_USER()    | @@proxy_user |
+-------------------+-------------------+--------------+
| antonio@localhost | antonio@localhost | NULL         |
+-------------------+-------------------+--------------+

这表明antonio 操作系统用户已通过身份验证，拥有授予antonioMySQL 用户的权限，并且没有发生代理。

Verify that Unix authentication permits logins to the operating system with the user name antonio and password antonio_password.

Set up PAM to authenticate MySQL connections using LDAP by creating a mysql-ldap PAM service file named /etc/pam.d/mysql-ldap. The file contents are system dependent, so check existing login-related files in the /etc/pam.d directory to see what they look like. On Linux, the mysql-ldap file might look like this:

#%PAM-1.0
auth        required    pam_ldap.so
account     required    pam_ldap.so

If PAM object files have a suffix different from .so on your system, substitute the correct suffix.

The PAM file format might differ on some systems.

Create a MySQL account with the same user name as the operating system user name and define it to authenticate using the PAM plugin and the mysql-ldap PAM service:

CREATE USER 'antonio'@'localhost'
  IDENTIFIED WITH authentication_pam
  AS 'mysql-ldap';
GRANT ALL PRIVILEGES
  ON mydb.*
  TO 'antonio'@'localhost';

Here, the authentication string contains only the PAM service name, mysql-ldap, which authenticates using LDAP.

Connecting to the server is the same as described in PAM Unix Password Authentication without Proxy Users.

Verify that Unix authentication permits logins to the operating system with the user name antonio and password antonio_password.

Verify that antonio is a member of the root or users PAM group.

Set up PAM to authenticate the mysql-unix PAM service through operating system users by creating a file named /etc/pam.d/mysql-unix. The file contents are system dependent, so check existing login-related files in the /etc/pam.d directory to see what they look like. On Linux, the mysql-unix file might look like this:

#%PAM-1.0
auth            include         password-auth
account         include         password-auth

For macOS, use login rather than password-auth.

The PAM file format might differ on some systems. For example, on Ubuntu and other Debian-based systems, use these file contents instead:

@include common-auth
@include common-account
@include common-session-noninteractive

Create a default proxy user (''@'') that maps external PAM users to the proxied accounts:

CREATE USER ''@''
  IDENTIFIED WITH authentication_pam
  AS 'mysql-unix, root=developer, users=data_entry';

Here, the authentication string contains the PAM service name, mysql-unix, which authenticates Unix passwords. The authentication string also maps external users in the root and users PAM groups to the developer and data_entry MySQL user names, respectively.

The PAM group mapping list following the PAM service name is required when you set up proxy users. Otherwise, the plugin cannot tell how to perform mapping from external user names to the proper proxied MySQL user names.

Create the proxied accounts and grant to each one the privileges it should have:

CREATE USER 'developer'@'localhost'
  IDENTIFIED WITH mysql_no_login;
CREATE USER 'data_entry'@'localhost'
  IDENTIFIED WITH mysql_no_login;

GRANT ALL PRIVILEGES
  ON mydevdb.*
  TO 'developer'@'localhost';
GRANT ALL PRIVILEGES
  ON mydb.*
  TO 'data_entry'@'localhost';

The proxied accounts use the mysql_no_login authentication plugin to prevent clients from using the accounts to log in directly to the MySQL server. Instead, it is expected that users who authenticate using PAM use the developer or data_entry account by proxy based on their PAM group. (This assumes that the plugin is installed. For instructions, see Section 6.4.1.10, “No-Login Pluggable Authentication”.) For alternative methods of protecting proxied accounts against direct use, see Preventing Direct Login to Proxied Accounts.

Grant to the proxy account the PROXY privilege for each proxied account:

GRANT PROXY
  ON 'developer'@'localhost'
  TO ''@'';
GRANT PROXY
  ON 'data_entry'@'localhost'
  TO ''@'';

Use the mysql command-line client to connect to the MySQL server as antonio.

$> mysql --user=antonio --password --enable-cleartext-plugin
Enter password: antonio_password

The server authenticates the connection using the default ''@'' proxy account. The resulting privileges for antonio depend on which PAM groups antonio is a member of. If antonio is a member of the root PAM group, the PAM plugin maps root to the developer MySQL user name and returns that name to the server. The server verifies that ''@'' has the PROXY privilege for developer and permits the connection. The following query returns output as shown:

mysql> SELECT USER(), CURRENT_USER(), @@proxy_user;
+-------------------+---------------------+--------------+
| USER()            | CURRENT_USER()      | @@proxy_user |
+-------------------+---------------------+--------------+
| antonio@localhost | developer@localhost | ''@''        |
+-------------------+---------------------+--------------+

This demonstrates that the antonio operating system user is authenticated to have the privileges granted to the developer MySQL user, and that proxying occurs through the default proxy account.

If antonio is not a member of the root PAM group but is a member of the users PAM group, a similar process occurs, but the plugin maps user PAM group membership to the data_entry MySQL user name and returns that name to the server:

mysql> SELECT USER(), CURRENT_USER(), @@proxy_user;
+-------------------+----------------------+--------------+
| USER()            | CURRENT_USER()       | @@proxy_user |
+-------------------+----------------------+--------------+
| antonio@localhost | data_entry@localhost | ''@''        |
+-------------------+----------------------+--------------+

This demonstrates that the antonio operating system user is authenticated to have the privileges of the data_entry MySQL user, and that proxying occurs through the default proxy account.