LDAP link parameters

Enables or disables LDAP Link.

Valid Values:

0—LDAP Link disabled

1—LDAP Link enabled

Default: 0

The LDAP server URL.

To use a plaintext connection between Vertica and the LDAP server, begin the LDAPLinkURL with ldap:// and set the TLSMODE of LDAPLink to DISABLE.

To use StartTLS, begin the LDAPLinkURL with ldap:// and set the TLSMODE of LDAPLink to ENABLE or higher.

To use LDAPS, begin the LDAPLinkURL with ldaps:// and set the TLSMODE of LDAPLink to ENABLE or higher.

Example:

=> SET PARAMETER LDAPLinkURL='ldap://example.dc.com';

A cron expression, the exact time at which the LDAP and Vertica servers should synchronize. Unlike LDAPLinkInterval, the runtime of the synchronization does not affect the next scheduled synchronization. Setting this parameter overrides LDAPLinkInterval.

New synchronizations are only scheduled after the current one ends. This means that if a synchronization runs for long enough to reach the start of what would be the "next" synchronization according to the cron expression, that "next" synchronization will not run, and in fact will not be scheduled until after the current one finishes.

Default: None (empty).

The time interval, in seconds, by which the LDAP and Vertica servers should synchronize. The interval is calculated based on the completion time of the previous synchronization operation, not its start time. This means that with an interval of 86400 seconds (one day), if the previous synchronization started at 9:00 and ended at 9:30, then the next synchronization would start at 9:30 the next day.

To use this scheduling method, LDAPLinkCron must not be set (default).

Default: 86400 (one day).

The first interval, in seconds, for LDAP/Vertica synchronization after the clerk node joins the cluster.

Default: 120

The time, in seconds, the system waits to retry a failed synchronization.

Default: 10

The number of retry attempts if synchronization failed.

Default: 10.

The base dn from where to start replication.

Example:

=> SET PARAMETER LDAPLinkSearchBase='ou=vertica,dc=mycompany,dc=com';

Vertica recommends using a separate OU for database users.

The timeout length, in seconds, for the LDAP search operation during an LDAP Link Service run.

Default: 10

Indicates what dn level to replicate.

Valid Values:

• sub—Replicate entire subtree under baseDN

• one—Replicate to one level under baseDN

• base —Replicate only the baseDN level

If you decrease the scope (for example, sub to one), some users may not be recognized during the next synchronization.

Default: sub

Determines how to filter users to be replicated.

Default: "(objectClass=inetOrgPerson)"

Determines how to filter groups to be replicated.

Default: "(objectClass=groupofnames)"

[Optional] The LDAP field to use when creating a role name in Vertica.

Default: cn

The LDAP group that identifies the members of an LDAP group. This attribute returns a Fully Qualified Domain Name (FQDN).

Default: member

The LDAP field to use when creating a user name in Vertica.

Default: uid

Specifies the attribute on which you want to join to assign users to their roles.

Default: dn

Example:

POSIX groups associate users and groups with the uid attribute instead of dn.

=> SET PARAMETER LDAPLinkJoinAttr='uid';

Specifies whether the users synchronized through LDAP Link should have their groups set as default roles. If LDAPLinkAddRolesAsDefault is disabled (default), then the users are granted their groups as non-default roles, which must be manually enabled with SET ROLE.

Default: 0 (disabled)

Example:

To enable:

=> ALTER DATABASE DEFAULT SET LDAPLinkAddRolesAsDefault = 1;

To disable:

=> ALTER DATABASE DEFAULT SET LDAPLinkAddRolesAsDefault = 0;

The LDAP Bind DN used for authentication.

Example:

=> SET PARAMETER LDAPLinkBindDN='CN=amir,OU=QA,DC=dc,DC=com';

The valid password for the LDAP Bind DN to access the server. Only accessible by the dbadmin user.

Example:

=> SET PARAMETER LDAPLinkBindPswd='password';

Determines how to resolve a user conflict.

Valid Values:

IGNORE—Ignores the incoming LDAP user and maintains the existing Vertica user.

MERGE—Converts the existing user to an LDAP user.

Default: MERGE

Enables or disables the shutdown of LDAPLink synchronization if no users are found in LDAP.

Valid values:

0 - Disables the LDAPLink synchronization shutdown if no users are found. This may lead to inadvertent dropping of Vertica users.

1 - Enables the LDAPLink synchronization shutdown if no users are found. This prevents inadvertent dropping of Vertica users.

[Optional] Tests the connection to the LDAP server and logs the response without doing a synchronization. Also tests if parameters are correctly set.

Note that this parameter is not the preferred dry run method. Instead, the LDAP_Link_Dryrun family of meta-functions provides more granular control over configurations and is the preferred way to perform LDAP Link dry runs.

Valid Values:

0 - Disables LDAPLinkDryRun

1 - Enables LDAPLinkDryRun

Default: 0