mysql plugin authentication (socket especially)

MySQL supports a plugin authentication.

From mysql-5.6.2 ( http://dev.mysql.com/doc/refman/5.6/en/socket-authentication-plugin.html ) and MariaDB-5.2+ (https://mariadb.com/kb/en/mariadb/unix_socket-authentication-plugin/) mysqld can authenticate users via the username that connects to the unix socket. As php-cgi is used to run web applications authenticating via a socket.

Earlier versions of MySQL offered socket authentication as part of an Enterprise offering.

The advantage of socket authentication is a malicious user cannot brute force authentication against another DB user.

Both mariadb and mysql can grant/create users with plugin auth using IDENTIFIED WITH {plugin_name} [AS 'plugin_option'] as part of the grant/create user syntax instead of IDENTIFIED BY {password}.

The available plugins can be obtained by using 'show plugins' and filtering by Type=AUTHENTICATION (in the application). This is syntax is available on 5.1 to obtain the possible values of the plugin name. The optional 'AS plugin_option' should be available to all plugins and the option depends on the plugin. Having this global would be an advantage.

If the account plan can configure the default and available mysql authentication option (password, {list of plugins}) and this is can be over-ridden for specific mysql users that would be great. Overriding/adding a plugin option by non-admin users should be configurable as somethings like pam service for a pam authentication plugin have serious implications.

This is mechanism is compatible with existing application username/password mechanism as effectively the password is ignored when connecting as a user with a configured socket authentication plugin.