Description\n-----------\n\nThis draft, intended for technical review under DOCS-5715, requires validation for technical accuracy. It includes generated text and code blocks and needs evaluation by a subject matter expert (SME) in this format. Please refrain from relying on any information on the page.\n\nMariaDB Server supports modern authentication standards—including JSON Web Tokens (JWT), OpenID Connect (OIDC), and OAuth 2.0—through its pluggable authentication architecture.\n\nBy leveraging the operating system's PAM (Pluggable Authentication Modules) subsystem, MariaDB can integrate with external Identity Providers (IdPs) like AWS Cognito, Google Cloud Identity, and Azure AD without requiring proprietary database plugins. The database delegates the validation of tokens to the underlying OS security layer.\n\nPrerequisites\n\nBefore proceeding, ensure the following components are available:\n\n MariaDB Server (Active and running).\n PAM Module: You must install a third-party PAM module corresponding to your desired authentication method (e.g., pam_oidc.so, pam_oauth2.so, or pam_jwt.so).\n   _Note: These are system-level libraries installed into /lib/security or /lib64/security. Ensure the module you choose is actively maintained and compatible with your OS._\n Identity Provider (IdP): You must have your Issuer URL, Client ID, and Audience values ready from your provider (e.g., Google, Okta, Azure).\n\nConfiguration and Connection Workflow\n\n_How to bridge the operating system's authentication layer with MariaDB user management._\n\nHow Authentication Works\n\nBefore configuring the system, it is helpful to understand the handshake between the Client, the Database, and the Operating System.\n\n``mermaid\nsequenceDiagram\n    participant Client as Client (User/App)\n    participant DB as MariaDB Server\n    participant Plugin as auth_pam Plugin\n    participant OS as OS PAM Subsystem\n    participant Module as PAM Module (pam_oidc.so)\n\n    Note over Client, DB: Step 3: Connect via Client\n    Client->>DB: Connect(Username, Password=Token)\n    \n    Note over DB, Plugin: Step 2: Configure MariaDB Server\n    DB->>DB: Check User Definition\n    DB->>Plugin: Delegate Auth (User is IDENTIFIED VIA PAM)\n    \n    Note over Plugin, OS: Step 1: Configure PAM Service\n    Plugin->>OS: Authenticate using Service "mariadb"\n    OS->>OS: Read /etc/pam.d/mariadb\n    \n    Note right of OS: This file tells OS to load pam_oidc.so\n    OS->>Module: Invoke pam_oidc.so with Token\n    \n    Module->>Module: Validate Token (Issuer/Audience)\n    Module-->>OS: Return Success/Failure\n    OS-->>Plugin: Return Success/Failure\n    Plugin-->>DB: Return Auth Result\n    DB-->>Client: Connection Accepted/Rejected\n`\n\nConfigure the PAM Service\n\nYou must define a PAM service that loads your chosen module. This file tells the operating system how to validate the credentials passed by MariaDB.\n\nFile: /etc/pam.d/mariadb\n\n_The specific flags below (like issuer or aud) are standard OIDC parameters. Consult your specific PAM module's documentation for exact flag syntax._\n\n`bash\n/etc/pam.d/mariadb\nGeneric OIDC Configuration Example\n\n1. 'auth' checks the validity of the token\nauth required pam_oidc.so issuer=https://accounts.google.com aud=YOUR_CLIENT_ID\n\n2. 'account' checks if the user is allowed to login (often required by PAM)\naccount required pam_oidc.so\n`\n\nEnsure strict validation of the aud (Audience) parameter to confirm that tokens are issued exclusively for your database application, preventing the use of tokens intended for different applications.\n\nConfigure MariaDB Server\n\nOnce the OS is configured, you must enable the PAM plugin in MariaDB and create a user that utilizes it.\n\n1. Log in to MariaDB as root.\n2.  Install the PAM Plugin:\n\n    `sql\n    INSTALL SONAME 'auth_pam';\n    `\n3.  Create the User: The USING clause specifies the service name (filename) in /etc/pam.d/.\n\n    `sql\n    -- Create a user that maps to the 'sub' (Subject) claim in the token\n    CREATE USER 'jdoe'@'%' IDENTIFIED VIA pam USING 'mariadb';\n    `\n\nConnect via Client\n\nWhen connecting, the "Password" field is used to transmit the JWT or OIDC Token.\n\n`bash\n1. Obtain your token (e.g., via gcloud or your IdP's CLI)\nexport DB_TOKEN="eyJhbGciOiJSUzI1NiIsImtpZ..."\n\n2. Connect to MariaDB, passing the token as the password\nmariadb --user="jdoe" --password="$DB_TOKEN"\n`\n\nTroubleshooting\n\n   Authentication Failure: Check the system authentication logs.\n\n    `bash\n    sudo tail -f /var/log/auth.log\n    `\n\n    _Look for errors regarding "invalid audience," "expired token," or "issuer mismatch."_\n SELinux/AppArmor: If the database cannot access the PAM configuration, ensure your security context allows mysqld to read from /etc/pam.d/.\n* Username Mapping: By default, the MariaDB username must match the identity in the token (often the sub or emailclaim). Some PAM modules allow you to map these (e.g., mapping user@example.com to user); check your module's user_template` or mapping documentation.\n\nURL: https://mariadb.com/docs/server/reference/plugins/authentication-plugins/authentication-with-pluggable-authentication-modules-pam/authentication-with-jwt-oidc-and-oauth-2.0-via-pam