Mysql Percona 8 with PAM+SSSD+AD Authentication - mysql

Question

Good afternoon everyone.
We are using MYSQL Percona 8 with PAM+SSSD+AD authentication.
Faced with the fact that authentication works well only on the machine where the server is installed, from the terminal console.
When connecting from any other machine, the error is:
ERROR 2059 (HY000): Authentication plugin ‘dialog’ cannot be loaded: /usr/lib/mysql/plugin/dialog.so: cannot open shared object file: No such file or directory
At first I thought the problem was in the native mysql client, so I installed Percona-client , it didn’t help, I tried to add dialog.so manually, which resulted in the error:
ERROR 2059 (HY000): Authentication plugin ‘dialog’ cannot be loaded: Incompatible client plugin interface
In the end, I came to the decision that the connection only starts working if percona-server-server is installed on the client machine.
I think this is an absurd solution or a bug, I don’t know.
Tell me how to transfer only the necessary module and make the client work without installing the entire server?
p.s By the way, even the latest DBeaver also cannot work with this, but in the process of torment, it turned out that if you select not "MySQL" but "MariaDB" when connecting, then it successfully connects via PAM. Perhaps this will help someone.
I probably managed to find a solution to a similar problem here for mariadb and redhat. But I don’t know how to build mysql percona client with these modules.
https://bugzilla.redhat.com/attachment.cgi?id=940720&action=diff

Answer 1

I had a similar issue and changed the plugin from "auth_pam" to "auth_pam_compat" and it resolved the issues with LDAP/PAM Stack authenticated users.
Found in a forum online - https://rimzy.net/category/authenticatin-plugin/
This issue is applicable to all plugins that require loading an external library at the client-side, including the PAM authentication plugin. In this case, you will get the error
ERROR 2059 (HY000): Authentication plugin 'dialog' cannot be loaded: /usr/local/Percona-Server-8.0.25-15-Linux.x86_64.glibc2.17/lib/plugin/dialog.so: cannot open shared object file: No such file or directory
Oracle-compatible auth_pam_compat plugin does not experience this issue, because, instead of
dialog.so
it uses the built-in
mysql_clear_password
plugin.