I have installed Percona PAm plugin on my Percona server as shown below:

mysql> show plugins;
| auth_pam                      | ACTIVE   | AUTHENTICATION     | auth_pam.so        | GPL     |
| auth_pam_compat               | ACTIVE   | AUTHENTICATION     | auth_pam_compat.so | GPL     |

And also have this configured:

cat /etc/pam.d/mysqld 
auth required pam_sss.so
account required pam_sss.so

I have a group on the AD server called "dba", and added an AD user 'john.d' in this group. So I would like to log into MySQL using AD users e.g., john.d, who should also inherit all privileges granted to the "dba" group. Below is how this AD group, "dba", is a setup to allow its users access the Percona server:

CREATE USER ''@'' IDENTIFIED WITH auth_pam AS 'mysqld,dba=dbarole';
CREATE USER 'dbarole'@'%' IDENTIFIED BY 'dbapass';
GRANT ALL PRIVILEGES ON *.* TO 'dbarole'@'%';
GRANT PROXY ON 'dbarole'@'%' TO ''@'';

When I log into MySQL as dbarole, everything works well with all granted privileges. But when I log in as john.d, one of the AD users included into the "dba" AD group, this user does not inherit the privileges (ALL) granted to its group, but only has the USAGE privilege as shown below:

mysql> show grants;
| Grants for @                      |
| GRANT USAGE ON *.* TO ''@''       |
| GRANT PROXY ON 'dba'@'%' TO ''@'' |
2 rows in set (0.00 sec)

mysql> show databases;
| Database           |
| information_schema |
1 row in set (0.01 sec)

My Question is, how can I get an AD user to inherit privileges granted to their group in MySQL?

  • this blog post may help -percona.com/blog/2017/07/13/… Commented Dec 24, 2018 at 12:16
  • Actually, that is the post i was following, and still could not get things to work as described in my original post. Have you actually been successful in doing so? Commented Dec 26, 2018 at 1:36
  • Finally figured out. My solution was to add the AD group to /etc/shadow using the command: realm permit -g dba Commented Dec 27, 2018 at 2:07

2 Answers 2


To stay with access_provider = ad and be able to authenticate in MySQL with your domain account you should add following string to sssd.conf:

ad_gpo_map_remote_interactive = +sshd, +mysqld

If you use some additional PAM services just add them in the same manner


All I had to do is add the dba group using the following realm command:

realm permit -g dba

Doing so will automatically change the /etc/sssd/sssd.conf file and add the following line(s):

access_provider = simple
simple_allow_groups = dba

Before running real, access_provider was setup as "ad", and was automatically changed to "simple" as shown above.

  • Did you setup nss or anything else? I am stuck where you are , but realm permit -g <my_ad_group> does add to my sssd.conf file, but still have the smae issue
    – rezizter
    Commented Oct 13, 2020 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.