diff --git a/CMakeLists.txt b/CMakeLists.txt
index d93a11f7eda2..3e959882cca5 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -267,6 +267,8 @@ IF(WITH_DEFAULT_FEATURE_SET)
   INCLUDE(${CMAKE_SOURCE_DIR}/cmake/build_configurations/feature_set.cmake)
 ENDIF()
 
+INCLUDE(CMakePushCheckState)
+
 # Add macros
 INCLUDE(character_sets)
 INCLUDE(cpu_info)
@@ -275,6 +277,7 @@ INCLUDE(lz4)
 INCLUDE(libevent)
 INCLUDE(ssl)
 INCLUDE(sasl)
+INCLUDE(ldap)
 INCLUDE(rpc)
 INCLUDE(readline)
 INCLUDE(protobuf)
@@ -316,6 +319,9 @@ ENDIF()
 IF(NOT WITHOUT_SERVER)
   OPTION (WITH_UNIT_TESTS "Compile MySQL with unit tests" ON)
 ENDIF()
+OPTION(WITH_AUTHENTICATION_LDAP
+  "Report error if the LDAP authentication plugin cannot be built." OFF)
+
 OPTION(FORCE_UNSUPPORTED_COMPILER "Disable compiler version checks" OFF)
 MARK_AS_ADVANCED(WITHOUT_SERVER DISABLE_SHARED FORCE_UNSUPPORTED_COMPILER)
 
@@ -586,6 +592,8 @@ MYSQL_CHECK_LIBEVENT()
 MYSQL_CHECK_LZ4()
 # Add SASL library
 MYSQL_CHECK_SASL()
+# Add LDAP library
+MYSQL_CHECK_LDAP()
 # Add protoc and libprotobuf
 IF(NOT WITHOUT_SERVER)
   MYSQL_CHECK_PROTOBUF()
diff --git a/LICENSE b/LICENSE
index 6b4788c611a9..ef094af30294 100644
--- a/LICENSE
+++ b/LICENSE
@@ -10,7 +10,7 @@ Introduction
    third-party software which may be included in this distribution of
    MySQL 5.7.28 (and later).
 
-   Last updated: September 2019
+   Last updated: November 2019
 
 Licensing Information
 
@@ -550,7 +550,6 @@ PSF LICENSE AGREEMENT FOR PYTHON 2.7.11
 8. By copying, installing or otherwise using Python 2.7.11, Licensee agrees
    to be bound by the terms and conditions of this License Agreement.
 
-
 Boost Library
 
    The following software may be included in this product:
@@ -819,71 +818,6 @@ OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
 ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 PERFORMANCE OF THIS SOFTWARE.
 
-   Some files are:
-Copyright (c) 1998 The NetBSD Foundation, Inc.
-All rights reserved.
-
-This code is derived from software contributed to The NetBSD
-Foundation by Christos Zoulas.
-
-Redistribution and use in source and binary forms, with or
-without modification, are permitted provided that the following
-conditions
-are met:
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above
-   copyright notice, this list of conditions and the following
-   disclaimer in the documentation and/or other materials provided
-   with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND
-CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
-INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
-BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
-OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
-OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
-OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
-LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
-NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-   Some files are:
-Copyright (c) 2009 The NetBSD Foundation, Inc.
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the
-   distribution.
-3. All advertising materials mentioning features or use of this
-   software must display the following acknowledgement:
-       This product includes software developed by the NetBSD
-       Foundation, Inc. and its contributors.
-4. Neither the name of The NetBSD Foundation nor the names of its
-   contributors may be used to endorse or promote products derived
-   from this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND
-CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
-INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
-BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
-OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
-OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
-OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
-LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
-NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
 Facebook Fast Checksum Patch
 
    The following software may be included in this product:
@@ -1773,7 +1707,6 @@ SUCH DAMAGE.
 libevent
 
    The following software may be included in this product:
-
 Copyright (c) 2000-2007 Niels Provos <provos@citi.umich.edu>
 Copyright (c) 2007-2012 Niels Provos and Nick Mathewson
 
@@ -1841,7 +1774,6 @@ WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-
 libgcc & libstdc++ Libraries
 
    The following software may be included in this product:
@@ -3709,32 +3641,30 @@ LZ4
 
    The following software may be included in this product:
 LZ4 Library
-Copyright (c) 2011-2014, Yann Collet
+Copyright (c) 2011-2016, Yann Collet
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
+modification, are permitted provided that the following conditions are met:
 
-* Redistributions of source code must retain the above copyright
-  notice, this list of conditions and the following disclaimer.
+* Redistributions of source code must retain the above copyright notice,
+  this list of conditions and the following disclaimer.
 
-* Redistributions in binary form must reproduce the above copyright
-  notice, this list of conditions and the following disclaimer in the
-  documentation and/or other materials provided with the distribution.
+* Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
 
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
-FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
-COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
-INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
-BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
-ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGE.
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAG
+ES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 md5 (Message-Digest Algorithm 5)
 
@@ -4033,16 +3963,14 @@ OpenSSL License
 
   The OpenSSL toolkit stays under a double license, i.e. both the conditions of
   the OpenSSL License and the original SSLeay license apply to the toolkit.
-  See below for the actual license texts. Actually both licenses are BSD-style
-  Open Source licenses. In case of any license issues related to OpenSSL
-  please contact openssl-core@openssl.org.
+  See below for the actual license texts.
 
   OpenSSL License
   ---------------
 
 /* ====================================================================
 
- * Copyright (c) 1998-2017 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2019 The OpenSSL Project.  All rights reserved.
  *
 
  * Redistribution and use in source and binary forms, with or without
diff --git a/cmake/ldap.cmake b/cmake/ldap.cmake
new file mode 100644
index 000000000000..ac533b843ce2
--- /dev/null
+++ b/cmake/ldap.cmake
@@ -0,0 +1,150 @@
+# Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License, version 2.0,
+# as published by the Free Software Foundation.
+#
+# This program is also distributed with certain software (including
+# but not limited to OpenSSL) that is licensed under separate terms,
+# as designated in a particular file or component or in included license
+# documentation.  The authors of MySQL hereby grant you an additional
+# permission to link the program and your derivative works with the
+# separately licensed software that they have included with MySQL.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License, version 2.0, for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
+
+# cmake -DWITH_LDAP=system|</path/to/custom/installation>
+# system is the default
+
+INCLUDE (CheckIncludeFile)
+INCLUDE (CheckIncludeFiles)
+
+SET(WITH_LDAP_DOC "\nsystem (use the OS ldap library)")
+STRING_APPEND(WITH_LDAP_DOC ", \n</path/to/custom/installation>")
+
+STRING(REPLACE "\n" "| " WITH_LDAP_DOC_STRING "${WITH_LDAP_DOC}")
+
+MACRO(FIND_SYSTEM_LDAP)
+  IF(WIN32)
+    SET(LDAP_SYSTEM_LIBRARY Wldap32 CACHE INTERNAL
+      "LDAP library is /c/Windows/system32/Wldap32.dll"
+      )
+  ELSE()
+    FIND_LIBRARY(LDAP_SYSTEM_LIBRARY
+      NAMES ldap_r ldap
+      )
+    FIND_LIBRARY(LBER_SYSTEM_LIBRARY
+      NAMES lber
+      )
+  ENDIF()
+  IF(LDAP_SYSTEM_LIBRARY AND (WIN32 OR LBER_SYSTEM_LIBRARY))
+    SET(LDAP_LIBRARY ${LDAP_SYSTEM_LIBRARY})
+    SET(LBER_LIBRARY ${LBER_SYSTEM_LIBRARY})
+    MESSAGE(STATUS "LBER_LIBRARY ${LBER_LIBRARY}")
+    MESSAGE(STATUS "LDAP_LIBRARY ${LDAP_LIBRARY}")
+  ENDIF()
+
+  IF(WIN32)
+    # LDAP system header is Winldap.h and is in some Windows SDK
+  ELSE()
+    CMAKE_PUSH_CHECK_STATE()
+
+    # For Solaris 11.3 we need to explicitly search here:
+    IF(SOLARIS)
+      INCLUDE_DIRECTORIES(BEFORE SYSTEM /usr/include/openldap)
+      SET(CMAKE_REQUIRED_INCLUDES "/usr/include/openldap")
+    ENDIF()
+
+    CHECK_INCLUDE_FILE(lber.h HAVE_LBER_H)
+    CHECK_INCLUDE_FILE(ldap.h HAVE_LDAP_H)
+    CMAKE_POP_CHECK_STATE()
+  ENDIF()
+
+ENDMACRO()
+
+MACRO(FIND_CUSTOM_LDAP)
+  FIND_PATH(LDAP_INCLUDE_DIR
+    NAMES ldap.h
+    PATHS ${WITH_LDAP_PATH}/include
+    NO_DEFAULT_PATH
+    NO_CMAKE_ENVIRONMENT_PATH
+    NO_SYSTEM_ENVIRONMENT_PATH
+    )
+
+  # On mac this list is <.dylib;.so;.a>
+  # We prefer static libraries, so we reverse it here.
+  LIST(REVERSE CMAKE_FIND_LIBRARY_SUFFIXES)
+
+  FIND_LIBRARY(LDAP_CUSTOM_LIBRARY
+    NAMES ldap_r ldap
+    PATHS ${WITH_LDAP_PATH}/lib
+    NO_DEFAULT_PATH
+    NO_CMAKE_ENVIRONMENT_PATH
+    NO_SYSTEM_ENVIRONMENT_PATH
+    )
+  FIND_LIBRARY(LBER_CUSTOM_LIBRARY
+    NAMES lber
+    PATHS ${WITH_LDAP_PATH}/lib
+    NO_DEFAULT_PATH
+    NO_CMAKE_ENVIRONMENT_PATH
+    NO_SYSTEM_ENVIRONMENT_PATH
+    )
+
+  LIST(REVERSE CMAKE_FIND_LIBRARY_SUFFIXES)
+
+  IF(LDAP_INCLUDE_DIR)
+    INCLUDE_DIRECTORIES(BEFORE SYSTEM ${LDAP_INCLUDE_DIR})
+
+    CMAKE_PUSH_CHECK_STATE()
+    SET(CMAKE_REQUIRED_INCLUDES ${LDAP_INCLUDE_DIR})
+    CHECK_INCLUDE_FILE(lber.h HAVE_LBER_H)
+    CHECK_INCLUDE_FILE(ldap.h HAVE_LDAP_H)
+    CMAKE_POP_CHECK_STATE()
+  ENDIF()
+
+  IF(LDAP_CUSTOM_LIBRARY AND LBER_CUSTOM_LIBRARY)
+    SET(LDAP_LIBRARY ${LDAP_CUSTOM_LIBRARY})
+    SET(LBER_LIBRARY ${LBER_CUSTOM_LIBRARY})
+    GET_FILENAME_COMPONENT(LDAP_LIBRARY_EXT ${LDAP_LIBRARY} EXT)
+    IF(LDAP_LIBRARY_EXT STREQUAL ".a")
+      SET(STATIC_LDAP_LIBRARY 1)
+    ENDIF()
+    MESSAGE(STATUS "LDAP_LIBRARY ${LDAP_LIBRARY}")
+    MESSAGE(STATUS "LBER_LIBRARY ${LBER_LIBRARY}")
+  ENDIF()
+ENDMACRO()
+
+MACRO(MYSQL_CHECK_LDAP)
+  IF(NOT WITH_LDAP)
+    SET(WITH_LDAP "system" CACHE STRING ${WITH_LDAP_DOC_STRING} FORCE)
+  ENDIF()
+
+  # See if WITH_LDAP is of the form </path/to/custom/installation>
+  FILE(GLOB WITH_LDAP_HEADER ${WITH_LDAP}/include/ldap.h)
+  IF (WITH_LDAP_HEADER)
+    FILE(TO_CMAKE_PATH "${WITH_LDAP}" WITH_LDAP)
+    SET(WITH_LDAP_PATH ${WITH_LDAP})
+  ENDIF()
+
+  IF(WITH_LDAP STREQUAL "system")
+    FIND_SYSTEM_LDAP()
+  ELSE()
+    FIND_CUSTOM_LDAP()
+  ENDIF()
+
+  IF(WIN32 AND WITH_LDAP STREQUAL "system")
+    SET(LDAP_FOUND 1)
+  ELSEIF(HAVE_LBER_H AND HAVE_LDAP_H AND LDAP_LIBRARY AND LBER_LIBRARY)
+    SET(LDAP_FOUND 1)
+  ELSE()
+    SET(LDAP_FOUND 0)
+  ENDIF()
+
+ENDMACRO()
diff --git a/cmake/os/FreeBSD.cmake b/cmake/os/FreeBSD.cmake
index 76258eea45d8..fe7da2021c39 100644
--- a/cmake/os/FreeBSD.cmake
+++ b/cmake/os/FreeBSD.cmake
@@ -1,5 +1,4 @@
-
-# Copyright (c) 2010, 2014, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2010, 2019, Oracle and/or its affiliates. All rights reserved.
 # 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License, version 2.0,
@@ -19,12 +18,19 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA 
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA 
 
-# This file includes FreeBSD specific options and quirks, related to system checks
+# This file includes FreeBSD specific options and quirks,
+# related to system checks
 
 INCLUDE(CheckCSourceRuns)
 
+SET(FREEBSD 1)
+
+# On FreeBSD some includes, e.g. sasl/sasl.h, is in /usr/local/include
+INCLUDE_DIRECTORIES(SYSTEM /usr/local/include)
+LIST(APPEND CMAKE_REQUIRED_INCLUDES "/usr/local/include")
+
 # We require at least Clang 3.3.
 IF(NOT FORCE_UNSUPPORTED_COMPILER)
   IF(CMAKE_C_COMPILER_ID MATCHES "Clang")
diff --git a/cmake/os/WindowsCache.cmake b/cmake/os/WindowsCache.cmake
index fc3928399457..6055f1eeabb9 100644
--- a/cmake/os/WindowsCache.cmake
+++ b/cmake/os/WindowsCache.cmake
@@ -1,4 +1,4 @@
-# Copyright (c) 2010, 2017, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2010, 2019, Oracle and/or its affiliates. All rights reserved.
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License, version 2.0,
@@ -69,7 +69,6 @@ SET(HAVE_SYS_PARAM_H CACHE  INTERNAL "")
 SET(HAVE_FNMATCH_H CACHE  INTERNAL "")
 SET(HAVE_SYS_UN_H CACHE  INTERNAL "")
 SET(HAVE_VIS_H CACHE INTERNAL "")
-SET(HAVE_SASL_SASL_H CACHE  INTERNAL "")
 
 # Libevent
 SET(HAVE_DEVPOLL CACHE  INTERNAL "")
diff --git a/cmake/sasl.cmake b/cmake/sasl.cmake
index ddb8dbef2f0c..222bdbba5ed4 100644
--- a/cmake/sasl.cmake
+++ b/cmake/sasl.cmake
@@ -1,4 +1,4 @@
-# Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2018, 2019, Oracle and/or its affiliates. All rights reserved.
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License, version 2.0,
@@ -20,43 +20,140 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
 
-# cmake -DWITH_SASL=system|path
+# cmake -DWITH_SASL=system|</path/to/custom/installation>
 # system is the default
-#
-# Sets SASL_LIBRARY. If not found, SASL_LIBRARY="".
 
-MACRO (FIND_SYSTEM_SASL)
+INCLUDE (CheckIncludeFile)
+INCLUDE (CheckIncludeFiles)
+
+SET(WITH_SASL_DOC "\nsystem (use the OS sasl library)")
+STRING_APPEND(WITH_SASL_DOC ", \n</path/to/custom/installation>")
+
+STRING(REPLACE "\n" "| " WITH_SASL_DOC_STRING "${WITH_SASL_DOC}")
+
+MACRO(RESET_SASL_VARIABLES)
+  UNSET(SASL_INCLUDE_DIR)
+  UNSET(SASL_INCLUDE_DIR CACHE)
+  UNSET(SASL_LIBRARY)
+  UNSET(SASL_LIBRARY CACHE)
+  UNSET(SASL_ROOT_DIR)
+  UNSET(SASL_ROOT_DIR CACHE)
+  UNSET(WITH_SASL)
+  UNSET(WITH_SASL CACHE)
+  UNSET(WITH_SASL_PATH)
+  UNSET(WITH_SASL_PATH CACHE)
+  UNSET(HAVE_CUSTOM_SASL_SASL_H)
+  UNSET(HAVE_CUSTOM_SASL_SASL_H CACHE)
+  UNSET(HAVE_SASL_SASL_H)
+  UNSET(HAVE_SASL_SASL_H CACHE)
+ENDMACRO()
+
+MACRO(FIND_SYSTEM_SASL)
+  # Cyrus SASL 2.1.26 on Solaris 11.4 has a bug that requires sys/types.h
+  # to be included before checking if sasl/sasl.h exists
+  CHECK_INCLUDE_FILES("sys/types.h;sasl/sasl.h" HAVE_SASL_SASL_H)
   FIND_LIBRARY(SASL_SYSTEM_LIBRARY NAMES "sasl2" "sasl")
   IF (SASL_SYSTEM_LIBRARY)
-    SET(SYSTEM_SASL_FOUND 1)
     SET(SASL_LIBRARY ${SASL_SYSTEM_LIBRARY})
     MESSAGE(STATUS "SASL_LIBRARY ${SASL_LIBRARY}")
   ENDIF()
 ENDMACRO()
 
-IF (NOT WITH_SASL)
-  SET(WITH_SASL "system" CACHE STRING "By default use system sasl library")
-ENDIF()
+MACRO(FIND_CUSTOM_SASL)
+  # First search in WITH_SASL_PATH.
+  FIND_PATH(SASL_ROOT_DIR
+    NAMES include/sasl/sasl.h
+    NO_CMAKE_PATH
+    NO_CMAKE_ENVIRONMENT_PATH
+    HINTS ${WITH_SASL_PATH}
+    )
+  # Then search in standard places (if not found above).
+  FIND_PATH(SASL_ROOT_DIR
+    NAMES include/sasl/sasl.h
+    )
 
-MACRO (MYSQL_CHECK_SASL)
-  IF (NOT WITH_SASL OR WITH_SASL STREQUAL "system")
-    FIND_SYSTEM_SASL()
-    IF (NOT SYSTEM_SASL_FOUND)
-      MESSAGE(STATUS "Cannot find system sasl libraries.")
-      SET(SASL_LIBRARY "")
+  FIND_PATH(SASL_INCLUDE_DIR
+    NAMES sasl/sasl.h
+    HINTS ${SASL_ROOT_DIR}/include
+    )
+
+  # On mac this list is <.dylib;.so;.a>
+  # We prefer static libraries, so we reverse it here.
+  LIST(REVERSE CMAKE_FIND_LIBRARY_SUFFIXES)
+
+  FIND_LIBRARY(SASL_LIBRARY
+    NAMES sasl2 sasl libsasl
+    PATHS ${WITH_SASL}/lib
+    NO_DEFAULT_PATH
+    NO_CMAKE_ENVIRONMENT_PATH
+    NO_SYSTEM_ENVIRONMENT_PATH)
+
+  LIST(REVERSE CMAKE_FIND_LIBRARY_SUFFIXES)
+
+  IF(SASL_LIBRARY)
+    GET_FILENAME_COMPONENT(SASL_LIBRARY_EXT ${SASL_LIBRARY} EXT)
+    IF(SASL_LIBRARY_EXT STREQUAL ".a")
+      SET(STATIC_SASL_LIBRARY 1)
     ENDIF()
-  ELSE()
-    FIND_LIBRARY(SASL_LIBRARY
-                 NAMES "sasl2" "sasl" "libsasl"
-                 PATHS ${WITH_SASL} ${WITH_SASL}/lib
-                 NO_DEFAULT_PATH
-                 NO_CMAKE_ENVIRONMENT_PATH
-                 NO_SYSTEM_ENVIRONMENT_PATH)
-    IF (NOT SASL_LIBRARY)
-      MESSAGE(STATUS "Cannot find sasl libraries in ${WITH_SASL}.") 
-      SET(SASL_LIBRARY "")
-    ELSE()
-      MESSAGE(STATUS "SASL_LIBRARY ${SASL_LIBRARY}")
+    MESSAGE(STATUS "SASL_LIBRARY ${SASL_LIBRARY}")
+  ENDIF()
+
+  IF(SASL_INCLUDE_DIR)
+    INCLUDE_DIRECTORIES(BEFORE SYSTEM "${SASL_INCLUDE_DIR}")
+
+    CMAKE_PUSH_CHECK_STATE()
+    SET(CMAKE_REQUIRED_INCLUDES "${SASL_INCLUDE_DIR}")
+    # Windows users doing 'git pull' will have cached HAVE_SASL_SASL_H=""
+    CHECK_INCLUDE_FILE(sasl/sasl.h HAVE_CUSTOM_SASL_SASL_H)
+    IF(HAVE_CUSTOM_SASL_SASL_H)
+      SET(HAVE_SASL_SASL_H 1 CACHE INTERNAL "Have include sasl/sasl.h" FORCE)
     ENDIF()
+    CMAKE_POP_CHECK_STATE()
   ENDIF()
+
+  IF(WIN32)
+    FIND_FILE(SASL_LIBRARY_DLL
+      NAMES libsasl.dll
+      PATHS ${WITH_SASL}/lib
+      NO_CMAKE_PATH
+      NO_CMAKE_ENVIRONMENT_PATH
+      NO_SYSTEM_ENVIRONMENT_PATH
+      )
+    FIND_FILE(SASL_SCRAM_PLUGIN
+      NAMES saslSCRAM.dll
+      PATHS ${WITH_SASL}/lib
+      NO_CMAKE_PATH
+      NO_CMAKE_ENVIRONMENT_PATH
+      NO_SYSTEM_ENVIRONMENT_PATH
+      )
+  ENDIF()
+ENDMACRO()
+
+MACRO(MYSQL_CHECK_SASL)
+  IF(NOT WITH_SASL)
+    SET(WITH_SASL "system" CACHE STRING "${WITH_SASL_DOC_STRING}" FORCE)
+  ENDIF()
+
+  # See if WITH_SASL is of the form </path/to/custom/installation>
+  FILE(GLOB WITH_SASL_HEADER ${WITH_SASL}/include/sasl/sasl.h)
+  IF (WITH_SASL_HEADER)
+    FILE(TO_CMAKE_PATH "${WITH_SASL}" WITH_SASL)
+    SET(WITH_SASL_PATH ${WITH_SASL})
+  ENDIF()
+
+  IF(WITH_SASL STREQUAL "system")
+    FIND_SYSTEM_SASL()
+  ELSEIF(WITH_SASL_PATH)
+    FIND_CUSTOM_SASL()
+  ELSE()
+    RESET_SASL_VARIABLES()
+    MESSAGE(FATAL_ERROR "Could not find SASL")
+  ENDIF()
+
+  IF(HAVE_SASL_SASL_H AND SASL_LIBRARY)
+    SET(SASL_FOUND TRUE)
+  ELSE()
+    SET(SASL_FOUND FALSE)
+  ENDIF()
+
 ENDMACRO()
diff --git a/cmake/ssl.cmake b/cmake/ssl.cmake
index e9f82c5a2628..eca098182493 100644
--- a/cmake/ssl.cmake
+++ b/cmake/ssl.cmake
@@ -53,9 +53,6 @@ SET(WITH_SSL_DOC
   "${WITH_SSL_DOC}, \n</path/to/custom/openssl/installation>")
 
 STRING(REPLACE "\n" "| " WITH_SSL_DOC_STRING "${WITH_SSL_DOC}")
-MACRO (CHANGE_SSL_SETTINGS string)
-  SET(WITH_SSL ${string} CACHE STRING ${WITH_SSL_DOC_STRING} FORCE)
-ENDMACRO()
 
 MACRO(FATAL_SSL_NOT_FOUND_ERROR string)
   MESSAGE(STATUS "\n${string}"
@@ -99,7 +96,7 @@ ENDMACRO()
 # WITH_SSL=[yes|system|<path/to/custom/installation>]
 MACRO (MYSQL_CHECK_SSL)
   IF(NOT WITH_SSL)
-    CHANGE_SSL_SETTINGS("system")
+    SET(WITH_SSL "system" CACHE STRING ${WITH_SSL_DOC_STRING} FORCE)
   ENDIF()
 
   # See if WITH_SSL is of the form </path/to/custom/installation>
@@ -152,7 +149,7 @@ MACRO (MYSQL_CHECK_SSL)
     ENDIF()
 
     # On mac this list is <.dylib;.so;.a>
-    # We prefer static libraries, so we revert it here.
+    # We prefer static libraries, so we reverse it here.
     IF (WITH_SSL_PATH)
       LIST(REVERSE CMAKE_FIND_LIBRARY_SUFFIXES)
       MESSAGE(STATUS "suffixes <${CMAKE_FIND_LIBRARY_SUFFIXES}>")
@@ -224,6 +221,9 @@ MACRO (MYSQL_CHECK_SSL)
         SET(MY_OPENSSL_LIBRARY imported_openssl)
         ADD_IMPORTED_LIBRARY(imported_openssl "${OPENSSL_LIBRARY}")
       ENDIF()
+      IF(CRYPTO_EXT STREQUAL ".a" OR OPENSSL_EXT STREQUAL ".a")
+        SET(STATIC_SSL_LIBRARY 1)
+      ENDIF()
     ENDIF()
 
     MESSAGE(STATUS "OPENSSL_INCLUDE_DIR = ${OPENSSL_INCLUDE_DIR}")
@@ -234,9 +234,13 @@ MACRO (MYSQL_CHECK_SSL)
     MESSAGE(STATUS "OPENSSL_FIX_VERSION = ${OPENSSL_FIX_VERSION}")
 
     INCLUDE(CheckSymbolExists)
+
+    CMAKE_PUSH_CHECK_STATE()
     SET(CMAKE_REQUIRED_INCLUDES ${OPENSSL_INCLUDE_DIR})
     CHECK_SYMBOL_EXISTS(SHA512_DIGEST_LENGTH "openssl/sha.h"
                         HAVE_SHA512_DIGEST_LENGTH)
+    CMAKE_POP_CHECK_STATE()
+
     IF(OPENSSL_FOUND AND HAVE_SHA512_DIGEST_LENGTH)
       SET(SSL_SOURCES "")
       SET(SSL_LIBRARIES ${MY_OPENSSL_LIBRARY} ${MY_CRYPTO_LIBRARY})
diff --git a/configure.cmake b/configure.cmake
index 057f10030e24..df9ab377dadf 100644
--- a/configure.cmake
+++ b/configure.cmake
@@ -248,7 +248,6 @@ CHECK_INCLUDE_FILES (sys/param.h HAVE_SYS_PARAM_H) # Used by NDB/libevent
 CHECK_INCLUDE_FILES (fnmatch.h HAVE_FNMATCH_H)
 CHECK_INCLUDE_FILES (sys/un.h HAVE_SYS_UN_H)
 CHECK_INCLUDE_FILES (vis.h HAVE_VIS_H) # Used by libedit
-CHECK_INCLUDE_FILES (sasl/sasl.h HAVE_SASL_SASL_H) # Used by memcached
 
 # For libevent
 CHECK_INCLUDE_FILES(sys/devpoll.h HAVE_DEVPOLL)
diff --git a/libmysql/authentication_ldap/CMakeLists.txt b/libmysql/authentication_ldap/CMakeLists.txt
index 93f7b6bde9ab..5eae986e043b 100644
--- a/libmysql/authentication_ldap/CMakeLists.txt
+++ b/libmysql/authentication_ldap/CMakeLists.txt
@@ -1,4 +1,4 @@
-# Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2017, 2019, Oracle and/or its affiliates. All rights reserved.
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License, version 2.0,
@@ -24,107 +24,55 @@
 # Configuration for building LDAP SASL Authentication Plugin (client-side)
 #
 
-INCLUDE(CheckIncludeFiles)
+INCLUDE(CheckIncludeFile)
 
 # If cmake was invoked with -DWITH_AUTHENTICATION_LDAP=1
 # then fail if we are unable to build the LDAP plugin.
 MACRO(CROAK_AND_RETURN)
   IF (WITH_AUTHENTICATION_LDAP)
-    MESSAGE(SEND_ERROR ${ARGV})
+    MESSAGE(FATAL_ERROR ${ARGV})
   ELSE()
-    MESSAGE(STATUS ${ARGV} " Skipping the LDAP SASL client authentication plugin.")
+    MESSAGE(STATUS ${ARGV}
+      "Skipping the LDAP SASL client authentication plugin.")
     RETURN()
   ENDIF()
 ENDMACRO()
 
-IF(NOT WIN32)
-  IF(DEFINED WITH_SASL)
-    MESSAGE(STATUS ${ARGV} "Currently LDAP SASL client authentication plug-in is build with only system installed cyrus SASL library.")
-  ENDIF()
-
-  IF(CMAKE_SYSTEM_NAME MATCHES "FreeBSD")
-    INCLUDE_DIRECTORIES(SYSTEM /usr/local/include)
-    LIST(APPEND CMAKE_REQUIRED_INCLUDES "/usr/local/include")
-  ENDIF()
-
-  CHECK_INCLUDE_FILES(sasl/sasl.h HAVE_SASL_H)
-  CHECK_INCLUDE_FILES(lber.h HAVE_LBER_H)
-
-  IF(HAVE_SASL_H)
-    SET(CMAKE_EXTRA_INCLUDE_FILES sasl/sasl.h)
-  ELSE()
-    CROAK_AND_RETURN("Required SASL library is missing.")
-  ENDIF()
-  IF(HAVE_LBER_H)
-    SET(CMAKE_EXTRA_INCLUDE_FILES lber.h)
-  ELSE()
-    CROAK_AND_RETURN("Required LBER library is missing.")
-  ENDIF()
-ELSE()
-  # There is no system installed SASL library on Windows
-  SET(WITH_SASL "" CACHE PATH "Location of the SASL install")
-
-  IF(NOT WITH_SASL OR WITH_SASL STREQUAL "system")
-    # This plug-in is only compulsory for the enterprise MySQL.
-    # For MySQL community/Dev's user can build without this plug-in.
-    MESSAGE(STATUS ${ARGV} " You need to set WITH_SASL path to build LDAP SASL client authentication plugin.")
-    RETURN()
-  ENDIF()
-
-  # Use forward slashes from CMake code
-  FILE(TO_CMAKE_PATH "${WITH_SASL}" SASL_ROOT_DIR)
-
-  FIND_PATH(SASL_INCLUDE_DIR
-    NAMES sasl/sasl.h
-    NO_CMAKE_PATH
-    NO_CMAKE_ENVIRONMENT_PATH
-    PATHS ${SASL_ROOT_DIR}/include
-  )
-
-  FIND_FILE(SASL_LIBRARY_DLL
-    NAMES libsasl.dll
-    NO_CMAKE_PATH
-    NO_CMAKE_ENVIRONMENT_PATH
-    PATHS ${SASL_ROOT_DIR}/lib
-  )
-
-  FIND_FILE(SASL_SCRAM_PLUGIN
-    NAMES saslSCRAM.dll
-    NO_CMAKE_PATH
-    NO_CMAKE_ENVIRONMENT_PATH
-    PATHS ${SASL_ROOT_DIR}/lib
-  )
-
-  IF(SASL_INCLUDE_DIR AND
-     SASL_LIBRARY AND
-     SASL_LIBRARY_DLL AND
-     SASL_SCRAM_PLUGIN)
-    SET(SASL_FOUND TRUE)
-  ELSE()
-    SET(SASL_FOUND FALSE)
-  ENDIF()
-
-  INCLUDE_DIRECTORIES(${SASL_INCLUDE_DIR})
-
-  MESSAGE(STATUS "SASL_INCLUDE_DIR  = ${SASL_INCLUDE_DIR}")
-  MESSAGE(STATUS "SASL_LIBRARY_DLL  = ${SASL_LIBRARY_DLL}")
-  MESSAGE(STATUS "SASL_SCRAM_PLUGIN = ${SASL_SCRAM_PLUGIN}")
+IF(NOT HAVE_SASL_SASL_H)
+  CROAK_AND_RETURN("Required SASL header is missing.")
+ENDIF()
 
+# On windows the LDAP system header is Winldap.h and is in some Windows SDK.
+IF(NOT WIN32 AND NOT HAVE_LBER_H)
+  CROAK_AND_RETURN("Required LBER header is missing.")
 ENDIF()
 
-MESSAGE(STATUS "SASL_LIBRARY      = ${SASL_LIBRARY}")
 MYSQL_ADD_PLUGIN(authentication_ldap_sasl_client
-                 auth_ldap_sasl_client.cc log_client.cc
-                 LINK_LIBRARIES ${SASL_LIBRARY}
-                 CLIENT_ONLY MODULE_ONLY
-                 MODULE_OUTPUT_NAME "authentication_ldap_sasl_client")
+  auth_ldap_sasl_client.cc
+  log_client.cc
+  LINK_LIBRARIES
+  ${SASL_LIBRARY}
+  # Uncomment to verify that all symbols are found.
+  # ${LINK_FLAG_NO_UNDEFINED} ${SSL_LIBRARIES}
+  CLIENT_ONLY
+  MODULE_ONLY
+  MODULE_OUTPUT_NAME "authentication_ldap_sasl_client")
+
+# The plugin may need symbols which are not loaded by the client.
+IF(STATIC_SASL_LIBRARY)
+  TARGET_LINK_LIBRARIES(authentication_ldap_sasl_client ${SSL_LIBRARIES})
+ENDIF()
 
 IF(WIN32)
   GET_FILENAME_COMPONENT(SASL_DLL_NAME ${SASL_LIBRARY_DLL} NAME)
   GET_FILENAME_COMPONENT(SASL_SCRAM_PLUGIN_NAME "${SASL_SCRAM_PLUGIN}" NAME)
 
-  # Note that "libsasl.dll" and "saslSCRAM.dll" go into the "bin" directory where
-  # "mysql.exe" and other client executables are located.
+  MESSAGE(STATUS "SASL_INCLUDE_DIR  = ${SASL_INCLUDE_DIR}")
+  MESSAGE(STATUS "SASL_LIBRARY_DLL  = ${SASL_LIBRARY_DLL}")
+  MESSAGE(STATUS "SASL_SCRAM_PLUGIN = ${SASL_SCRAM_PLUGIN}")
+
+  # Note that "libsasl.dll" and "saslSCRAM.dll" go into the "bin" directory
+  # where "mysql.exe" and other client executables are located.
   INSTALL(FILES "${SASL_LIBRARY_DLL}"
           DESTINATION ${INSTALL_BINDIR}
           COMPONENT SharedLibraries)
@@ -133,14 +81,15 @@ IF(WIN32)
           COMPONENT SharedLibraries)
 
   # To run client executables that load the plug-in from the build tree we need
-  # to copy the SASL library DLL and SASL SCRAM library DLL to the same directory as the client executables.
+  # to copy the SASL library DLL and SASL SCRAM library DLL to the
+  # same directory as the client executables.
   ADD_CUSTOM_COMMAND(TARGET authentication_ldap_sasl_client POST_BUILD
-                     COMMAND ${CMAKE_COMMAND} -E copy_if_different
-                             "${SASL_LIBRARY_DLL}"
-                             "${CMAKE_BINARY_DIR}/client/${CMAKE_CFG_INTDIR}/${SASL_DLL_NAME}"
-                     COMMAND ${CMAKE_COMMAND} -E copy_if_different
-                             "${SASL_SCRAM_PLUGIN}"
-                             "${CMAKE_BINARY_DIR}/client/${CMAKE_CFG_INTDIR}/${SASL_SCRAM_PLUGIN_NAME}"
+    COMMAND ${CMAKE_COMMAND} -E copy_if_different
+      "${SASL_LIBRARY_DLL}"
+      "${CMAKE_BINARY_DIR}/client/${CMAKE_CFG_INTDIR}/${SASL_DLL_NAME}"
+    COMMAND ${CMAKE_COMMAND} -E copy_if_different
+      "${SASL_SCRAM_PLUGIN}"
+      "${CMAKE_BINARY_DIR}/client/${CMAKE_CFG_INTDIR}/${SASL_SCRAM_PLUGIN_NAME}"
   )
   ADD_DEPENDENCIES(authentication_ldap_sasl_client mysqltest)
 
diff --git a/packaging/deb-in/CMakeLists.txt b/packaging/deb-in/CMakeLists.txt
index 58ba3a081131..db84cf2b68db 100644
--- a/packaging/deb-in/CMakeLists.txt
+++ b/packaging/deb-in/CMakeLists.txt
@@ -61,6 +61,8 @@ IF (DEB_PRODUCT STREQUAL "commercial")
   SET (DEB_PRODUCTNAMEC "${DEB_BASE_PRODUCTC}Commercial")
   SET (DEB_NOTPRODUCTNAME "${DEB_BASE_PRODUCT}community")
   SET (DEB_LICENSENAME "Advanced")
+  SET (DEB_CMAKE_EXTRAS "${DEB_CMAKE_EXTRAS} -DWITH_LDAP=${WITH_LDAP}")
+  SET (DEB_CMAKE_EXTRAS "${DEB_CMAKE_EXTRAS} -DWITH_SASL=${WITH_SASL}")
   SET (DEB_SERVERVERSION "${DEB_BASE_VERSION}+commercial-1")
   # List of plugins that are only in commercial packages
   # Plugins that are in both community and commercial should NOT be added here
diff --git a/packaging/deb-in/control.in b/packaging/deb-in/control.in
index 517a5e614880..5c394581e605 100644
--- a/packaging/deb-in/control.in
+++ b/packaging/deb-in/control.in
@@ -4,7 +4,7 @@ Section: database
 Priority: optional
 Standards-Version: 3.9.6
 Homepage: http://www.mysql.com/
-Build-Depends: debhelper (>= 9.0.0), libaio-dev[linux-any], libncurses5-dev (>= 5.0-6), libjson-perl, libldap2-dev, libsasl2-dev, perl, zlib1g-dev (>= 1:1.1.3-5), po-debconf, psmisc, bison, lsb-release, cmake, fakeroot, libnuma-dev, libmecab-dev, @DEB_CONTROL_BDEPS@
+Build-Depends: debhelper (>= 9.0.0), libaio-dev[linux-any], libncurses5-dev (>= 5.0-6), libjson-perl, libldap2-dev, libsasl2-dev, perl, zlib1g-dev (>= 1:1.1.3-5), po-debconf, psmisc, bison, lsb-release, cmake, fakeroot, libnuma-dev, libmecab-dev, ldap-utils, libsasl2-modules-gssapi-mit, @DEB_CONTROL_BDEPS@
 
 
 Package: mysql-server
diff --git a/packaging/rpm-fedora/mysql.spec.in b/packaging/rpm-fedora/mysql.spec.in
index e4515e5f5fb0..7ef1e896e6ea 100644
--- a/packaging/rpm-fedora/mysql.spec.in
+++ b/packaging/rpm-fedora/mysql.spec.in
@@ -31,6 +31,14 @@
 # By default, a build will include the system SSL library.
 %{?with_ssl: %global ssl_option -DWITH_SSL=%{with_ssl}}
 
+# Pass path to LDAP lib
+%{?with_ldap: %global ldap_option -DWITH_LDAP=%{with_ldap}}
+%{?with_ldap: %global ldap 1}
+
+# Pass path to SASL lib
+%{?with_sasl: %global sasl_option -DWITH_SASL=%{with_sasl}}
+%{?with_sasl: %global sasl 1}
+
 # Regression tests may take a long time, override the default to skip them
 %{!?runselftest:%global runselftest 1}
 
@@ -470,6 +478,8 @@ fi
            -DWITH_EMBEDDED_SERVER=1 \
            -DWITH_EMBEDDED_SHARED_LIBRARY=1 \
            %{?ssl_option} \
+           %{?ldap_option} \
+           %{?sasl_option} \
            -DCOMPILATION_COMMENT="%{compilation_comment_release}" \
            -DMYSQL_SERVER_SUFFIX="%{?server_suffix}"
   echo BEGIN_NORMAL_CONFIG ; egrep '^#define' include/config.h ; echo END_NORMAL_CONFIG
@@ -504,6 +514,8 @@ mkdir debug
            -DWITH_EMBEDDED_SHARED_LIBRARY=1 \
            -DWITH_NUMA=ON \
            %{?ssl_option} \
+           %{?ldap_option} \
+           %{?sasl_option} \
            -DCOMPILATION_COMMENT="%{compilation_comment_debug}" \
            -DMYSQL_SERVER_SUFFIX="%{?server_suffix}"
   echo BEGIN_DEBUG_CONFIG ; egrep '^#define' include/config.h ; echo END_DEBUG_CONFIG
diff --git a/packaging/rpm-oel/mysql.spec.in b/packaging/rpm-oel/mysql.spec.in
index ca66798d41c6..e10f0ef00611 100644
--- a/packaging/rpm-oel/mysql.spec.in
+++ b/packaging/rpm-oel/mysql.spec.in
@@ -42,6 +42,14 @@
 %{?with_mecab: %global mecab_option -DWITH_MECAB=%{with_mecab}}
 %{?with_mecab: %global mecab 1}
 
+# Pass path to LDAP lib
+%{?with_ldap: %global ldap_option -DWITH_LDAP=%{with_ldap}}
+%{?with_ldap: %global ldap 1}
+
+# Pass path to SASL lib
+%{?with_sasl: %global sasl_option -DWITH_SASL=%{with_sasl}}
+%{?with_sasl: %global sasl 1}
+
 # Pass path to the AWS SDK install
 %{?with_aws_sdk: %global aws_sdk_option -DWITH_AWS_SDK=%{with_aws_sdk}}
 %{?with_aws_sdk: %global aws_sdk 1}
@@ -177,6 +185,12 @@ BuildRequires:  pkgconfig(systemd)
 %endif
 BuildRequires:  cyrus-sasl-devel
 BuildRequires:  openldap-devel
+%if 0%{?commercial}
+BuildRequires:  openldap-clients
+%if 0%{?rhel} > 6
+BuildRequires:  cyrus-sasl-scram
+%endif
+%endif
 BuildRoot:      %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
 
 %if 0%{?rhel} > 6
@@ -774,6 +788,8 @@ mkdir debug
 %endif
            %{?ssl_option} \
            %{?mecab_option} \
+           %{?ldap_option} \
+           %{?sasl_option} \
            %{?aws_sdk_option} \
            %{?curl_lib_option} \
            -DCOMPILATION_COMMENT="%{compilation_comment_debug}" \
@@ -809,6 +825,8 @@ mkdir release
 %endif
            %{?ssl_option} \
            %{?mecab_option} \
+           %{?ldap_option} \
+           %{?sasl_option} \
            %{?aws_sdk_option} \
            %{?curl_lib_option} \
            -DCOMPILATION_COMMENT="%{compilation_comment_release}" \
diff --git a/packaging/rpm-sles/mysql.spec.in b/packaging/rpm-sles/mysql.spec.in
index 44b2fa1045e3..8fda99a2bd89 100644
--- a/packaging/rpm-sles/mysql.spec.in
+++ b/packaging/rpm-sles/mysql.spec.in
@@ -34,6 +34,14 @@
 %{?with_mecab: %global mecab_option -DWITH_MECAB=%{with_mecab}}
 %{?with_mecab: %global mecab 1}
 
+# Pass path to LDAP lib
+%{?with_ldap: %global ldap_option -DWITH_LDAP=%{with_ldap}}
+%{?with_ldap: %global ldap 1}
+
+# Pass path to SASL lib
+%{?with_sasl: %global sasl_option -DWITH_SASL=%{with_sasl}}
+%{?with_sasl: %global sasl 1}
+
 # Pass path to the AWS SDK install
 %{?with_aws_sdk: %global aws_sdk_option -DWITH_AWS_SDK=%{with_aws_sdk}}
 %{?with_aws_sdk: %global aws_sdk 1}
@@ -133,6 +141,9 @@ BuildRequires:  systemd-rpm-macros
 %endif
 BuildRequires:  cyrus-sasl-devel
 BuildRequires:  openldap2-devel
+%if 0%{?commercial}
+BuildRequires:  openldap2-client
+%endif
 BuildRoot:      %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
 
 %if 0%{?rhel} > 6
@@ -577,6 +588,8 @@ mkdir debug
            -DWITH_NUMA=ON \
            %{?ssl_option} \
            %{?mecab_option} \
+           %{?ldap_option} \
+           %{?sasl_option} \
            %{?aws_sdk_option} \
            %{?curl_lib_option} \
            -DCOMPILATION_COMMENT="%{compilation_comment_debug}" \
@@ -614,6 +627,8 @@ mkdir release
            -DWITH_NUMA=ON \
            %{?ssl_option} \
            %{?mecab_option} \
+           %{?ldap_option} \
+           %{?sasl_option} \
            %{?aws_sdk_option} \
            %{?curl_lib_option} \
            -DCOMPILATION_COMMENT="%{compilation_comment_release}" \
diff --git a/rapid/plugin/group_replication/src/plugin.cc b/rapid/plugin/group_replication/src/plugin.cc
index d38794a5ca27..a5f4e2358e38 100644
--- a/rapid/plugin/group_replication/src/plugin.cc
+++ b/rapid/plugin/group_replication/src/plugin.cc
@@ -38,12 +38,12 @@ unsigned int plugin_version= 0;
 
 //The plugin running flag and lock
 static mysql_mutex_t plugin_running_mutex;
-static bool group_replication_running;
+bool group_replication_running= false;
 bool wait_on_engine_initialization= false;
 bool server_shutdown_status= false;
 bool plugin_is_auto_starting= false;
-static bool plugin_is_waiting_to_set_server_read_mode= false;
-static bool plugin_is_being_uninstalled= false;
+bool plugin_is_waiting_to_set_server_read_mode= false;
+bool plugin_is_being_uninstalled= false;
 
 /* Plugin modules */
 //The plugin applier
@@ -987,6 +987,11 @@ int terminate_plugin_modules(bool flag_stop_async_channel)
 
 int plugin_group_replication_init(MYSQL_PLUGIN plugin_info)
 {
+  // Reset plugin local variables.
+  group_replication_running= false;
+  plugin_is_being_uninstalled= false;
+  plugin_is_waiting_to_set_server_read_mode= false;
+
   // Register all PSI keys at the time plugin init
 #ifdef HAVE_PSI_INTERFACE
   register_all_group_replication_psi_keys();
diff --git a/rapid/unittest/gunit/group_replication/CMakeLists.txt b/rapid/unittest/gunit/group_replication/CMakeLists.txt
index 90975f30623b..7701ab5d06bf 100644
--- a/rapid/unittest/gunit/group_replication/CMakeLists.txt
+++ b/rapid/unittest/gunit/group_replication/CMakeLists.txt
@@ -1,4 +1,4 @@
-# Copyright (c) 2014, 2016, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2014, 2019, Oracle and/or its affiliates. All rights reserved.
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License, version 2.0,
@@ -49,10 +49,5 @@ FOREACH(test ${TESTS})
   ADD_EXECUTABLE(${test}-t ${test}-t.cc)
   TARGET_LINK_LIBRARIES(${test}-t gr_unit_test_resource)
   TARGET_LINK_LIBRARIES(${test}-t gunit_small)
-  # mysys_ssl/libmysys_ssl.a already includes SSL objects on Solaris
-  IF(NOT CMAKE_SYSTEM_NAME MATCHES "SunOS")
-    TARGET_LINK_LIBRARIES(${test}-t perconaserverclient)
-  ENDIF()
   ADD_TEST(${test} ${test}-t)
 ENDFOREACH()
-
diff --git a/sql/CMakeLists.txt b/sql/CMakeLists.txt
index 17d8d40e5d0c..e58f53c116fd 100644
--- a/sql/CMakeLists.txt
+++ b/sql/CMakeLists.txt
@@ -547,6 +547,20 @@ ENDIF()
 SET_TARGET_PROPERTIES(mysqld PROPERTIES ENABLE_EXPORTS TRUE) 
 TARGET_LINK_LIBRARIES(mysqld sql binlog rpl master slave sql mysys mysys_ssl binlogevents_static)
 
+# Plugins may need more symbols than the server does.
+IF(UNIX AND STATIC_SSL_LIBRARY)
+  IF(APPLE)
+    TARGET_LINK_LIBRARIES(mysqld
+      -Wl,-force_load ${CRYPTO_LIBRARY}
+      -Wl,-force_load ${OPENSSL_LIBRARY}
+      )
+  ELSE()
+    TARGET_LINK_LIBRARIES(mysqld
+      -Wl,--whole-archive ${SSL_LIBRARIES} -Wl,--no-whole-archive
+      )
+  ENDIF()
+ENDIF()
+
 # Provide plugins with minimal set of libraries
 SET(INTERFACE_LIBS ${LIBRT})
 IF(INTERFACE_LIBS)