Skip to content

Commit

Permalink
PS-9629 [DOCS] - Review Simple LDAP documentation variables 8.0
Browse files Browse the repository at this point in the history 
	modified:   docs/ldap-authentication.md
	new file:   docs/ldap-simple-variables.md
  • Loading branch information
@patrickbirch
patrickbirch committed Jan 13, 2025
1 parent 0d7e07d commit 4743640
Show file tree
Hide file tree
Showing 4 changed files with 262 additions and 276 deletions.
42 changes: 15 additions & 27 deletions docs/ldap-authentication.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,6 @@ individuals, groups, and organizations.

*Percona Server for MySQL* 8.0.30-22 implements an SASL-based LDAP authentication plugin. This plugin only supports the SCRAM-SHA-1 SASL mechanism.

!!! important

--8<--- "tech.preview.md:5:5"

*Percona Server for MySQL* 8.0.19-10 implements the simple LDAP authentication. The Percona simple LDAP authentication plugin is a free and Open Source implementation of the MySQL Enterprise Simple LDAP authentication plugin.

## Plugin names and file names
Expand Down Expand Up @@ -114,12 +110,6 @@ Install the plugin with the following statements.
mysql> INSTALL PLUGIN authentication_ldap_simple SONAME 'authentication_ldap_simple.so';
```

To set and persist values at runtime, use the following statements:

```{.bash data-prompt="mysql>"}
mysql> SET PERSIST authentication_ldap_simple_server_host='127.0.0.1';
mysql> SET PERSIST authentication_ldap_simple_bind_base_dn='dc=percona, dc=com';
```

=== "Load the SASL-based LDAP authentication plugin"

Expand All @@ -134,7 +124,7 @@ Install the plugin with the following statements.
mysql> SET PERSIST authentication_ldap_sasl_bind_base_dn='dc=percona, dc=com';
```

## Create a user using simple LDAP authentication
## Create a user using LDAP simple authentication

There are several methods to add or modify a user.

Expand All @@ -156,21 +146,21 @@ There are several methods to add or modify a user.
mysql> CREATE USER ... IDENTIFIED WITH authentication_ldap_simple BY 'cn=[user name],ou=[organization unit],dc=[domain component],dc=com'
```

Unless the [authentication_ldap_simple_group_role_mapping](ldap-system-variables.md#authentication_ldap_simple_group_role_mapping) variable is used, creating a user with an authentication string does not use the following system variables:
Unless the [authentication_ldap_simple_group_role_mapping](ldap-simple-variables.md#authentication_ldap_simple_group_role_mapping) variable is used, creating a user with an authentication string does not use the following system variables:

* [authentication_ldap_simple_bind_base_dn](ldap-system-variables.md#authentication_ldap_simple_bind_base_dn)
* [authentication_ldap_simple_bind_base_dn](ldap-simple-variables.md#authentication_ldap_simple_bind_base_dn)

* [authentication_ldap_simple_bind_root_dn](ldap-system-variables.md#authentication_ldap_simple_bind_root_dn)
* [authentication_ldap_simple_bind_root_dn](ldap-simple-variables.md#authentication_ldap_simple_bind_root_dn)

* [authentication_ldap_simple_bind_root_pwd](ldap-system-variables.md#authentication_ldap_simple_bind_root_pwd)
* [authentication_ldap_simple_bind_root_pwd](ldap-simple-variables.md#authentication_ldap_simple_bind_root_pwd)

* [authentication_ldap_simple_user_search_attr](ldap-system-variables.md#authentication_ldap_simple_user_search_attr)
* [authentication_ldap_simple_user_search_attr](ldap-simple-variables.md#authentication_ldap_simple_user_search_attr)

* [authentication_ldap_simple_group_search_attr](ldap-system-variables.md#authentication_ldap_simple_group_search_attr)
* [authentication_ldap_simple_group_search_attr](ldap-simple-variables.md#authentication_ldap_simple_group_search_attr)

Creating the user with `IDENTIFIED BY authentication_ldap_simple` uses the variables.

Creating the user with the [authentication_ldap_simple_group_role_mapping](ldap-system-variables.md#authentication_ldap_simple_group_role_mapping) variable also adds the [authentication_ldap_simple_bind_root_dn](ldap-system-variables.md#authentication_ldap_simple_bind_root_dn) and [authentication_ldap_simple_bind_root_pwd](ldap-system-variables.md#authentication_ldap_simple_bind_root_pwd) variables.
Creating the user with the [authentication_ldap_simple_group_role_mapping](ldap-simple-variables.md#authentication_ldap_simple_group_role_mapping) variable also adds the [authentication_ldap_simple_bind_root_dn](ldap-simple-variables.md#authentication_ldap_simple_bind_root_dn) and [authentication_ldap_simple_bind_root_pwd](ldap-simple-variables.md#authentication_ldap_simple_bind_root_pwd) variables.

## Create a user using SASL-based LDAP authentication

Expand All @@ -192,21 +182,21 @@ There are several methods to add or modify a user.
mysql> CREATE USER ... IDENTIFIED WITH authentication_ldap_sasl BY 'cn=[user name],ou=[organization unit],dc=[domain component],dc=com'
```

Unless the [authentication_ldap_sasl_group_role_mapping](ldap-system-variables.md#authentication_ldap_sasl_group_role_mapping) variable is used, creating a user with an authentication string does not use the following system variables:
Unless the [authentication_ldap_sasl_group_role_mapping](ldap-sasl-variables.md#authentication_ldap_sasl_group_role_mapping) variable is used, creating a user with an authentication string does not use the following system variables:

* [authentication_ldap_sasl_bind_base_dn](ldap-system-variables.md#authentication_ldap_sasl_bind_base_dn)
* [authentication_ldap_sasl_bind_base_dn](ldap-sasl-variables.md#authentication_ldap_sasl_bind_base_dn)

* [authentication_ldap_sasl_bind_root_dn](ldap-system-variables.md#authentication_ldap_sasl_bind_root_dn)
* [authentication_ldap_sasl_bind_root_dn](ldap-sasl-variables.md#authentication_ldap_sasl_bind_root_dn)

* [authentication_ldap_sasl_bind_root_pwd](ldap-system-variables.md#authentication_ldap_sasl_bind_root_pwd)
* [authentication_ldap_sasl_bind_root_pwd](ldap-sasl-variables.md#authentication_ldap_sasl_bind_root_pwd)

* [authentication_ldap_sasl_user_search_attr](ldap-system-variables.md#authentication_ldap_sasl_user_search_attr)
* [authentication_ldap_sasl_user_search_attr](ldap-sasl-variables.md#authentication_ldap_sasl_user_search_attr)

* [authentication_ldap_sasl_group_search_attr](ldap-system-variables.md#authentication_ldap_sasl_group_search_attr)
* [authentication_ldap_sasl_group_search_attr](ldap-sasl-variables.md#authentication_ldap_sasl_group_search_attr)

Creating the user with `IDENTIFIED BY authentication_ldap_sasl` uses the variables.

Creating the user with the [authentication_ldap_sasl_group_role_mapping](ldap-system-variables.md#authentication_ldap_sasl_group_role_mapping) variable also adds the[authentication_ldap_sasl_bind_root_dn](ldap-system-variables.md#authentication_ldap_sasl_bind_root_dn) and [authentication_ldap_sasl_bind_root_pwd](ldap-system-variables.md#authentication_ldap_sasl_bind_root_pwd) variables.
Creating the user with the [authentication_ldap_sasl_group_role_mapping](ldap-sasl-variables.md#authentication_ldap_sasl_group_role_mapping) variable also adds the[authentication_ldap_sasl_bind_root_dn](ldap-sasl-variables.md#authentication_ldap_sasl_bind_root_dn) and [authentication_ldap_sasl_bind_root_pwd](ldap-sasl-variables.md#authentication_ldap_sasl_bind_root_pwd) variables.

## Examples

Expand Down Expand Up @@ -271,8 +261,6 @@ If you installed either plugin at [server startup](#load-the-plugins-at-server-s
mysql> UNINSTALL PLUGIN authentication_ldap_simple;
```

If you used `SET_PERSIST`, use `RESET PERSIST` to remove the settings.

=== "Uninstall the SASL-based LDAP authentication plugin"

If you installed the plugins at [runtime](#load-the-sasl-based-ldap-authentication-plugin-at-runtime), run the following statements:
Expand Down
Loading

0 comments on commit 4743640

Please sign in to comment.