Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

PAM Authentication:

PAM enables a system to use a standard interface to access various kinds of authentication methods, such as Unix passwords or an LDAP directory.

Cleartext Client-Side Authentication Plugin

client-side plugin can be used to send the password to the server in clear text. There is no corresponding server-side plugin.

I have read documentation but could not get enough help, PAM authentication is supported only in MySQL Enterprise edition but cleartext authentication is applicable to all MySQL servers as it's a client who invokes this kind of authentication mechanism.


Has anybody practically tried using PAM authentication or Cleartext authentication plugin?

If so please explain how to configure and setup with an example?

share|improve this question
I have added similar question in stackoverflow as well but could not get any reply there… – Peter Venderberghe Jun 12 '13 at 13:40

The Cleartext Authentication Plugin, as you have pointed out, is included in all distributions, but it's not quite correct to that it "is applicable to all MySQL servers." Yes, it is, but actually, not really... because with Cleartext:

There is no corresponding server-side plugin. Rather, the client-side plugin can be used by any server-side plugin that needs a clear text password

Okay, Oracle, which server-side plugins would those be?

The answer to that would appear to be "none of them," except, of course, the proprietary PAM plugin.

Of course, if you aren't using a plugin that needs it on the server-side, there's no reason you would use the cleartext plugin on the client side, and the only reason you'd need it on the server side would be because you were going to pass the credentials on to another system... like the PAM plugin does.

If you need the PAM authentication plugin's capabilities, the choices appear to be these:

  • write your own server-side plugin for PAM authentication or direct authentication against whatever backend system contains your access credentials
  • use Percona's PAM Authentication Plugin for MySQL which is free and open source and works in MySQL Server as well as in Percona Server
  • use MariaDB, which supports PAM authentication through its own native client mechanism since 5.2.10 and with some support for the MySQL cleartext client plugin as of MariaDB 5.5.32
  • pay Oracle's asking price for "Enterprise" MySQL and get the "official" plugin.
share|improve this answer
+1 for this. Have you tried using these authentication plugins yourself? If so any further help would be better. – Peter Venderberghe Jun 13 '13 at 4:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.