Creates an LDAP URL search string, lists an LDAP URL search string, or verifies an LDAP URL search string or login.
sp_ldapadmin { set_primary_url, ‘ldapurl’ |
set_secondary_url, { ‘ldapurl’ | null } |
set_access_acct, account_distinguished_name, account_password |
set_dn_lookup_url, distinguished_name_url |
list_urls | check_url, ‘ldapurl’ |
check_login, ‘login_name’ }
creates the specified search string ldapurl. Exactly one primary search string can be created.
The syntax for ldapurl is:
ldapurl::=ldap://host:port/node?attributes?base | one | sub?filter
where:
host – is the host name of the LDAP server.
port – is the port number of the LDAP server.
node – specifies the node in the object hierarchy at which to start the search.
attributes – is a list of attributes to return in the result set. Each LDAP server may support a different list of attributes.
filter – specifies the attribute or attributes to be authenticated. The filter can be simple, such as “uid=*,” or compound, such as “(uid=*)(ou=group).” The syntax is LDAP server dependent and uses a wildcard (*) to describe the login name.
creates the specified secondary search string ldapurl or no secondary search string. Exactly one secondary search string can be created.
specifies the identity and password that Adaptive Server uses to conduct searches and other read-only adminstrative actions. The identity is in the form of a distinguished name. Use account_distinguished_name to authenticate this user with the LDAP server. Both account_distinguished_name and account_password are limited to 255 characters each.
uses the searched distinguished name algorithm to authenticate the login with an LDAP directory server when you set set_dn_lookup_url to a non-NULL value.
distinguished_name_url has a maximum length of 255 characters and is used to search for a distinguished name associated with the login name.
displays LDAP URL search strings.
verifies an LDAP URL search string. Can also verify the existence of a user account, but it does not authenticate the user.
verifies a user account for the existing LDAP URL search strings. It does not authenticate the user.
qualifies the search criteria. base specifies a search of the base node; one specifies a search of node and one sublevel below node; and sub specifies a search of node and all node sublevels.
Creates an LDAP URL search string for the LDAP SunONE Directory Server.
sp_ldapadmin set_primary_url,'ldap://voyager:389/ ou=People,dc=MyCompany,dc=com??sub?uid=*'
The search string identifies a directory server listening on host name “voyager,” port number 389 (the default LDAP protocol port), the base node to begin the search is within organizational unit (ou) “People,” and the domain is “MyCompany.com.” It returns all attributes that match the filter uid=*. Adaptive Server replaces the wildcard with the Adaptive Server login name that is to be authenticated.
Creates an LDAP URL search string defined in OpenLDAP 2.0.25 using the criteria described in Example 1.
sp_ldapadmin set_primary_url,'ldap://voyager:389/ dc=MyCompany,dc=com??sub?cn=*'
Sets the secondary LDAP URL search string to null, indicating no failover and no secondary LDAP server.
sp_ldapadmin set_secondary_url, null
Creates an LDAP URL search string with a compound filrer.
sp_ldapadmin set_primary_url, 'ldap://voyager:389/ ou=people,dc=siroe,dc=com??sub?(&(uid=*) (ou=accounting))
Uses the default Microsoft Active Directory schema found on Windows 2000 controllers:
1> sp_ldapadmin set_access_acct, 'cn=aseadmin, cn=Users, dc=mycompany, dc=com', 'aseadmin secret password' 2> go 1> sp_ldapadmin set_dn_lookup_url, 'ldap://mydomainhostname:389/cn=Users,dc=mycompany,dc=com? distinguishedName?sub?samaccountname=*' 2> go 1> sp_ldapadmin set_primary_url,'ldap://mydomainhostname:389/' 2> go
The “aseadmin” username is added to the Active Directory server and granted read access to the trees and objects where users are found. The LDAP attribute specified by distinguishedName is obtained and used to authenticate the user. The filter specifies a search on attribute samaccountname=*; the * wildcard is replaced with the name from the Adaptive Server login record.
For example, “samaccountname=jqpublic” returns
DN attribute “distinguishedName” with
value “cn=John Q. Public, cn=Users,dc=mycompany,
dc=com” to Adaptive Server.
Adaptive Server uses this string to bind to ldap://mydomainhostname:389.
If the bind is successful, authentication succeeds.
The LDAP vendor determines the syntax of the search string. In all cases, the search string specifies the attribute name that uniquely identifies the user in the form “attribute=wildcard” as in “cn=*.”
The first attribute in a compound filter must define the Relative Distinguished Name (RDN). For example, “...sub?(uid=*)(ou=group).” Otherwise, the authentication fails.
When a search string is added, Adaptive Server verifies that it uses valid LDAP URL syntax and that it references an existing node. To ensure that the valid string returns expected values, carefully choose and verify the search string when configuring Adaptive Server.
The secondary URL search string enables failover to another LDAP server. Adaptive Server uses the primary URL search string unless the LDAP Server is not active or the search string is invalid. In this event, Adaptive Server uses the secondary URL search string for authentication.
Only the System Security Officer can execute sp_ldapadmin.
Values in event and extrainfo columns from the sysaudits table are:
Event |
Audit option |
Command or access audited |
Information in extrainfo |
|---|---|---|---|
38 |
exec_procedure |
Execution of a procedure |
|
| Copyright © 2005. Sybase Inc. All rights reserved. |
|
|
