Document client plugin_dir setting

Thanks for the bug report.

Can you paste the relevant part of SHOW PLUGINS output, SELECT user,host,plugin,authentication_string FROM mysql.user WHERE user LIKE "your_pam_authenticated_user", and "ls -l" in your plugin directory?

Hi

Heres the stuff that you wanted (And some more:))

[root]# bin/mysql_config --plugindir
/db/test/server/lib/mysql/plugin

[root plugin]# ls -al
-rwxr-xr-x 1 root root 15546 Nov 19 09:47 auth_pam.so

TEST XtraDB (none)> INSTALL PLUGIN auth_pam_server SONAME 'auth_pam.so';
Query OK, 0 rows affected (0.03 sec)

TEST XtraDB (none)> show variables like 'plugin%';
+---------------+----------------------------------+
| Variable_name | Value |
+---------------+----------------------------------+
| plugin_dir | /db/test/server/lib/mysql/plugin |
+---------------+----------------------------------+

[root server]# ls -al /etc/pam.d/mysqld
-rw-r--r-- 1 root root 192 Dec 12 11:22 /etc/pam.d/mysqld

TEST XtraDB (none)> create user 'patlin'@'localhost' identified with auth_pam_server;
Query OK, 0 rows affected (0.01 sec)

[root server]# bin/mysql -upatlin -p
Enter password:
ERROR 2059 (HY000): Authentication plugin 'auth_pam' cannot be loaded: /usr/local/Percona-Server-5.5.13-rel20.4-138.Linux.x86_64/lib/plugin/auth_pam.so: cannot open shared object file: No such file or directory

TEST XtraDB (none)> SHOW PLUGINS;
+--------------------------------+----------+--------------------+-------------+---------+
| Name | Status | Type | Library | License |
+--------------------------------+----------+--------------------+-------------+---------+
| auth_pam_server | ACTIVE | AUTHENTICATION | auth_pam.so | GPL |
+--------------------------------+----------+--------------------+-------------+---------+

TEST XtraDB (none)> SELECT user,host,plugin,authentication_string FROM mysql.user WHERE user LIKE "patlin";
+--------+-----------+-----------------+-----------------------+
| user | host | plugin | authentication_string |
+--------+-----------+-----------------+-----------------------+
| patlin | localhost | auth_pam_server | |
+--------+-----------+-----------------+-----------------------+

Hi

When we try to login with a account with auth_pam plugin in.

mysqld: pam_unix(mysqld:auth): conversation failed
mysqld: pam_unix(mysqld:auth): auth could not identify password for [<pamuser>]
mysqld: pam_warn(mysqld:auth): function=[pam_sm_authenticate] service=[mysqld] terminal=[<unknown>] user=[<pamuser>] ruser=[<pamuser>] rhost=[localhost]
mysqld: pam_unix(mysqld:auth): conversation failed
mysqld: pam_unix(mysqld:auth): unable to obtain a password
mysqld: pam_unix(mysqld:auth): auth could not identify password for [<pamuser>]
mysqld: pam_unix(mysqld:auth): conversation failed
mysqld: pam_unix(mysqld:auth): auth could not identify password for [<pamuser>]
mysqld: pam_warn(mysqld:auth): function=[pam_sm_authenticate] service=[mysqld] terminal=[<unknown>] user=[<pamuser>] ruser=[<pamuser>] rhost=[localhost]
mysqld: pam_unix(mysqld:auth): conversation failed
mysqld: pam_unix(mysqld:auth): unable to obtain a password
mysqld: pam_unix(mysqld:auth): auth could not identify password for [<pamuser>]

It can be understandable because we are runing with kerberos login and we don't have any passwords in the shadow file.

I also tryed to get kerberos working but I get this :

authentication fails for 'pamuser' (<email address hidden>): Authentication failure (Cannot read password)

and the pam mysqld conf file is like this:

#%PAM-1.0

auth sufficient /lib/security/$ISA/pam_krb5.so ignore_unknown_upn minimum_uid=5000

account required /lib/security/$ISA/pam_access.so

password required /lib/security/$ISA/pam_cracklib.so dcredit=-2 ucredit=-2 ocredit=-1 lcredit=0 minlen=18
password sufficient /lib/security/$ISA/pam_krb5.so use_authtok

Have we missed something?

Your client has a wrong plugin_dir setting

please add:

[client]
plugin_dir='/db/test/server/lib/mysql/plugin'

This worked in my case

That was the missing piece. It works. No bugg.

Thanx
Patrik

Thank you Patrik.

Changing this to be a documentation bug.