The gssapi authentication plugin validates user credentials against a GSSAPI-based authentication service, like Kerberos or NTLM.
The gssapi authentication plugin requires an additional package to be installed on Linux. On CentOS, RHEL, and Rocky Linux:
On Debian and Ubuntu:
On SLES:
The gssapi requires some system variables to be configured, including:
gssapi_keytab_path
gssapi_principal_name
For example:
The gssapi must be installed before it can be used.
To install with the INSTALL SONAME statement:
To install in a configuration file with the plugin_load_add option:
To create a user account that uses the gssapi , specify the plugin in the CREATE USER statement:
An optional realm can be specified:
This page is: Copyright © 2025 MariaDB. All rights reserved.
$ sudo yum install MariaDB-gssapi-server$ sudo apt install mariadb-plugin-gssapi-server$ sudo zypper install MariaDB-gssapi-server[mariadb]
...
gssapi_keytab_path=KEYTAB_PATH
gssapi_principal_name=PRINCIPAL_NAMEINSTALL SONAME 'gssapi';[mariadb]
...
plugin_load_add = auth_gssapiCREATE USER 'USER'@'192.0.2.%'
IDENTIFIED VIA gssapi;CREATE USER 'USER'@'192.0.2.%'
IDENTIFIED VIA gssapi USING 'USER@DOMAIN';