# Configuring PAM Authentication and User Mapping with LDAP Authentication In this article, we will walk through the configuration of PAM authentication using the [pam](https://mariadb.com/docs/server/reference/plugins/authentication-plugins/authentication-with-pluggable-authentication-modules-pam/authentication-plugin-pam) authentication plugin and user and group mapping with the [pam\_user\_map](https://mariadb.com/docs/server/reference/plugins/authentication-plugins/authentication-with-pluggable-authentication-modules-pam/user-and-group-mapping-with-pam) PAM module. The primary authentication will be handled by the [pam\_ldap](https://linux.die.net/man/5/pam_ldap) PAM module, which performs LDAP authentication. We will also set up an OpenLDAP server. ## Hypothetical Requirements In this walkthrough, we are going to assume the following hypothetical requirements: * The LDAP user `foo` should be mapped to the MariaDB user `bar`. (`foo: bar`) * Any LDAP user in the LDAP group `dba` should be mapped to the MariaDB user `dba`. (`@dba: dba`) ## Setting up the OpenLDAP Server Before we can use LDAP authentication, we first need to set up our OpenLDAP Server. This is usually done on a server that is completely separate from the database server. ### Installing the OpenLDAP Server and Client Components On the server acting as the OpenLDAP Server, first, we need to install the OpenLDAP components. On RHEL, CentOS, and other similar Linux distributions that use [RPM packages](https://mariadb.com/docs/server/server-management/install-and-upgrade-mariadb/installing-mariadb/binary-packages/rpm), that would go like this: ```bash sudo yum install openldap openldap-servers openldap-clients nss-pam-ldapd ``` ### Configuring the OpenLDAP Server Next, let's to configure the OpenLDAP Server. The easiest way to do that is to copy the template configuration file that is included with the installation. In many installations, that will be at `/usr/share/openldap-servers/DB_CONFIG.example`: ```bash sudo cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG sudo chown ldap. /var/lib/ldap/DB_CONFIG ``` #### Configuring the OpenLDAP Port Sometimes it is useful to change the port used by OpenLDAP. For example, some cloud environments block well-known authentication services, so they block the default LDAP port. On some systems, the port can be changed by setting `SLAPD_URLS` in `/etc/sysconfig/slapd`: ```ini SLAPD_URLS="ldapi:/// ldap://0.0.0.0:3306/" ``` I used `3306` because that is the port that is usually used by `mysqld`, so I know that it is not blocked. ### Starting the OpenLDAP Server Next, let's start the OpenLDAP Server and configure it to start on reboot. On [systemd](https://mariadb.com/docs/server/server-management/starting-and-stopping-mariadb/systemd) systems, that would go like this: ```bash sudo systemctl start slapd sudo systemctl enable slapd ``` ### Installing the Standard LDAP objectClasses In order to use LDAP for authentication, we also need to install some standard `objectClasses`, such as `posixAccount` and `posixGroup`. In LDAP, things like `objectClasses` are defined in [LDIF](https://www.digitalocean.com/community/tutorials/how-to-use-ldif-files-to-make-changes-to-an-openldap-system) files. In many installations, these specific `objectClasses` are defined in `/etc/openldap/schema/nis.ldif`. `nis.ldif` also depends on `core.ldif` and `cosine.ldif`. However, `core.ldif` is usually installed by default. We can install them with [ldapmodify](https://www.openldap.org/software/man.cgi?query=ldapmodify\&sektion=1\&apropos=0\&manpath=OpenLDAP+2.4-Release): ```bash sudo ldapmodify -a -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif sudo ldapmodify -a -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif ``` ### Creating the LDAP Directory Manager User Next, let’s create a directory manager user. We can do this by using OpenLDAP's [olc](https://www.openldap.org/doc/admin24/slapdconf2.html) configuration system to change the [olcRootDN](https://www.openldap.org/doc/admin24/slapdconf2.html#olcRootDN:%20%3CDN%3E) directive to the DN of the directory manager user, which means that the user will be a privileged LDAP user that is not subject to access controls. We will also set the root password for the user by changing the [olcRootPW](https://www.openldap.org/doc/admin24/slapdconf2.html#olcRootPW:%20%3Cpassword%3E) directive. We will also set the DN suffix for our backend LDAP database by changing the [olcSuffix](https://www.openldap.org/doc/admin24/slapdconf2.html#olcSuffix:%20%3Cdn%20suffix%3E) directive. Let’s use the [slappasswd](https://www.openldap.org/software/man.cgi?query=slappasswd\&apropos=0\&sektion=8\&manpath=OpenLDAP+2.4-Release\&format=html) utility to generate a password hash from a clear-text password. Simply execute: ```bash slappasswd ``` This utility provides a password hash that looks like this: `{SSHA}AwT4jrvmokeCkbDrFAnGvzzjCMb7bvEl` OpenLDAP's [olc](https://www.openldap.org/doc/admin24/slapdconf2.html) configuration system also uses [LDIF](https://www.digitalocean.com/community/tutorials/how-to-use-ldif-files-to-make-changes-to-an-openldap-system) files. Now that we have the password hash, let’s create an `LDIF` file to create the directory manager user: ```bash tee ~/setupDirectoryManager.ldif < SELECT USER(), CURRENT_USER(); +------------------------------------------------+----------------+ | USER() | CURRENT_USER() | +------------------------------------------------+----------------+ | foo@ip-172-30-0-198.us-west-2.compute.internal | bar@% | +------------------------------------------------+----------------+ 1 row in set (0.000 sec) ``` We can verify that our `foo` LDAP user was properly mapped to the `bar` MariaDB user by looking at the return value of [CURRENT\_USER()](https://mariadb.com/docs/server/reference/sql-functions/secondary-functions/information-functions/current_user). Then let's test our `gmontee` user in the `dba` group: ```bash $ mysql -u gmontee -h 172.30.0.198 [mariadb] Password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 135 Server version: 10.3.10-MariaDB MariaDB Server Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]> SELECT USER(), CURRENT_USER(); +----------------------------------------------------+----------------+ | USER() | CURRENT_USER() | +----------------------------------------------------+----------------+ | gmontee@ip-172-30-0-198.us-west-2.compute.internal | dba@% | +----------------------------------------------------+----------------+ 1 row in set (0.000 sec) ``` And then let's test our `bstillman` user in the `dba` group: ```bash $ mysql -u bstillman -h 172.30.0.198 [mariadb] Password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 136 Server version: 10.3.10-MariaDB MariaDB Server Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]> SELECT USER(), CURRENT_USER(); +------------------------------------------------------+----------------+ | USER() | CURRENT_USER() | +------------------------------------------------------+----------------+ | bstillman@ip-172-30-0-198.us-west-2.compute.internal | dba@% | +------------------------------------------------------+----------------+ 1 row in set (0.000 sec) ``` We can verify that our `gmontee` and `bstillman` LDAP users in the `dba` LDAP group were properly mapped to the `dba` MariaDB user by looking at the return values of `CURRENT_USER()`. ### Testing Local Unix Authentication If you chose the option that also allowed local Unix authentication, then let's test that out. Let's create a Unix user and give the user a password real quick: ```bash sudo useradd alice sudo passwd alice ``` And let's also map this user to `dba`: ``` @dba:dba foo: bar alice: dba ``` And we know that the existing anonymous user already has the `PROXY` privilege granted to the `dba` user, so this should just work without any other configuration. Let's test it out: ```bash $ mysql -u alice -h 172.30.0.198 [mariadb] Password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 141 Server version: 10.3.10-MariaDB MariaDB Server Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]> SELECT USER(), CURRENT_USER(); +--------------------------------------------------+----------------+ | USER() | CURRENT_USER() | +--------------------------------------------------+----------------+ | alice@ip-172-30-0-198.us-west-2.compute.internal | dba@% | +--------------------------------------------------+----------------+ 1 row in set (0.000 sec) ``` We can verify that our `alice` Unix user was properly mapped to the `dba` MariaDB user by looking at the return values of [CURRENT\_USER()](https://mariadb.com/docs/server/reference/sql-functions/secondary-functions/information-functions/current_user). ## Integrating with MariaDB MaxScale If you are connecting to MariaDB Server through MariaDB MaxScale, it is also recommended to configure the proxy to authenticate users via [MaxScale PAM Authenticator](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-authenticators/maxscale-pam-authenticator). *This page is licensed: CC BY-SA / Gnu FDL* {% @marketo/form formId="4316" %} --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://mariadb.com/docs/server/reference/plugins/authentication-plugins/authentication-with-pluggable-authentication-modules-pam/configuring-pam-authentication-and-user-mapping-with-ldap-authentication.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.