MySQL – What is the diffrence between ClearText authentication and PAM authentication plugins

MySQLmysql-5.5

PAM Authentication:

PAM enables a system to use a standard interface to access various kinds of authentication methods, such as Unix passwords or an LDAP directory.

Cleartext Client-Side Authentication Plugin

client-side plugin can be used to send the password to the server in clear text. There is no corresponding server-side plugin.

I have read documentation but could not get enough help, PAM authentication is supported only in MySQL Enterprise edition but cleartext authentication is applicable to all MySQL servers as it's a client who invokes this kind of authentication mechanism.

Questions:

Has anybody practically tried using PAM authentication or Cleartext authentication plugin?

If so please explain how to configure and setup with an example?

Best Answer

The Cleartext Authentication Plugin, as you have pointed out, is included in all distributions, but it's not quite correct to that it "is applicable to all MySQL servers." Yes, it is, but actually, not really... because with Cleartext:

There is no corresponding server-side plugin. Rather, the client-side plugin can be used by any server-side plugin that needs a clear text password

Okay, Oracle, which server-side plugins would those be?

The answer to that would appear to be "none of them," except, of course, the proprietary PAM plugin.

Of course, if you aren't using a plugin that needs it on the server-side, there's no reason you would use the cleartext plugin on the client side, and the only reason you'd need it on the server side would be because you were going to pass the credentials on to another system... like the PAM plugin does.

If you need the PAM authentication plugin's capabilities, the choices appear to be these:

  • write your own server-side plugin for PAM authentication or direct authentication against whatever backend system contains your access credentials
  • use Percona's PAM Authentication Plugin for MySQL which is free and open source and works in MySQL Server as well as in Percona Server
  • use MariaDB, which supports PAM authentication through its own native client mechanism since 5.2.10 and with some support for the MySQL cleartext client plugin as of MariaDB 5.5.32
  • pay Oracle's asking price for "Enterprise" MySQL and get the "official" plugin.