Skip to content

PS-11248 [DOCS] - External roles never revoked - LDAP 9.7.2-2 #777

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alina-derkach-oaza merged 1 commit into from
Aug 13, 2026
Merged

PS-11248 [DOCS] - External roles never revoked - LDAP 9.7.2-2 #777

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions docs/ldap-authentication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,20 @@ If the password is correct, and the LDAP server finds a match, then LDAP authent

The database server compares the client user name to the authenticated user name. If these names are the same, the database server uses the client user name to check for privileges. If the name differs, then the database server looks for an account that matches the authenticated name.

## External roles

The mechanism already keeps a container with external roles (ones granted on request of the authentication plugin). On connection, the server compares roles returned by the authentication plugin with existing external roles and:

* Grants returned roles not in the container (roles already in the container were granted previously),
* Revokes external roles that exist in the container but are not returned by the plugin,
* Updates the container so it is inline with the actually granted roles.

!!! admonition "note"

External role privileges are granted or revoked on the user's connection. Group membership is determined by the group attribute from LDAP.

Privileges are not revoked immediately when a user is removed from a group, because the MySQL server does not directly synchronize with the LDAP server.

## Prerequisites for authentication

The LDAP authentication plugins required the following:
Expand Down
Loading