MySQL plugin for authorization user at LDAP

Installation:

• copy plugin dir in ${MYSQLSRCDIR}/plugin/;
• run `make' command in ${MYSQLSRCDIR};
• copy plugin ${MYSQLSRCDIR}/plugin/ldap_authorization.so to your mysql_plugin_dir (Perhaps, it is /usr/local/lib/mysql/plugin/);
• in mysql console run: mysql> INSTALL PLUGIN ldap_authorization SONAME 'ldap_authorization.so';

Configuration option for plugin:

• ldap_authorization_host - like 'ldap://127.0.0.1,ldap://192.168.0.1' - is required field
• ldap_authorization_port - int - isn't required field
• ldap_authorization_validgroups - field for list of valid groups for current mysql node. Groups are separated by commas. This group must be using for 'CREATE user' statement - is required field
• ldap_authorization_binddn - login who can get access to LDAP catalog - is required field
• ldap_authorization_bindpasswd - password for login from ldap_authorization_binddn field - is required field
• ldap_authorization_defaultfilter - filter for limit search in LDAP catalog - isn't required field
• ldap_authorization_timeout - set timeout for get answer from LDAP - isn't required field
• ldap_authorization_tls - use TLS connection? - isn't required field. Valid values - 0 or 1. Default - 0.
• ldap_authorization_debug - print debug message - isn't required field. Valid values - 0 or 1. Default - 0.

Example config:

ldap_authorization_debug=ON

ldap_authorization_bindpasswd='mega_password_for_readonly'

ldap_authorization_binddn='cn=readonly,dc=example,dc=com'

ldap_authorization_basedn='dc=example,dc=com'

ldap_authorization_auth_host='ldap://192.168.0.1,ldap://192.168.0.2'

ldap_authorization_validgroups='ldap_group1,ldap_group2'

For add new user in MySQL server:

• mysql> DELETE FROM mysql.user where User='';
• mysql> FLUSH PRIVILEGES;
• mysql> CREATE USER ''@'192.168.0.%' IDENTIFIED WITH ldap_authorization as 'ldap_group1 ldap_group2'; /* BaseDN change to your date. ex. dc=example,dc=net */
• mysql> CREATE USER 'ldap_group1'@'192.168.0.%' identified by '123pass'; /* ldap_group1 must be set at ldap_authorization_validgroups variable */
• mysql> CREATE USER 'ldap_group2'@'192.168.0.%' identified by '321pass'; /* ldap_group2 must be set at ldap_authorization_validgroups variable */ Create proxy user for give permissions:
• mysql> GRANT PROXY ON 'ldap_group1'@'192.168.0.%' TO ''@'192.168.0.%';
• mysql> GRANT PROXY ON 'ldap_group2'@'192.168.0.%' TO ''@'192.168.0.%';

For check:

• SELECT USER(), CURRENT_USER(), @@proxy_user, @@external_user\G

Addition:

• All log messages is gone via syslog