LDAP link service

LDAP Link enables synchronization between the LDAP and OpenText™ Analytics Database servers. This eliminates the need for you to manage two sets of users and groups or roles, one on the LDAP server and another on the database server. With LDAP synchronization, the database server becomes a replication database for the LDAP server.

Automatic synchronization

With LDAP Link the database server closely integrates with an existing directory service such as MS Active Directory or OpenLDAP. The database server automatically synchronizes:

• LDAP users to database users

• LDAP groups to database roles

You manage all user and group properties in the LDAP server. As the database administrator, you only need to set up database access permissions for users and groups.

Configure LDAP Link with LDAP Link connection parameters that reside in the catalog. See General and Connection Parameters for more information.

Configure LDAP link with dry runs

The LDAP Link dry run meta-functions allow you to configure the service in discrete stages before making any changes to your database. These stages are:

1. LDAP Link Bind: Establishing a connection between the LDAP server and the database

2. LDAP Link Search: Searching the LDAP server for users and groups

3. LDAP Link Sync: Mapping LDAP users and groups to their equivalents in the database.

Query the system table LDAP_LINK_DRYRUN_EVENTS to view the results of each dry run.

For more information on dry runs and configuring LDAP Link, see Configuring LDAP link with dry runs.

Enable LDAP link

Enable LDAP Link as shown:

=> ALTER DATABASE dbname SET PARAMETER LDAPLinkURL='ldap://example.dc.com',
    LDAPLinkSearchBase='dc=DC,dc=com', LDAPLinkBindDN='CN=jsmith,OU=QA,DC=dc,DC=com,
    LDAPLinkBindPswd='password',LDAPLinkFilterUser='(objectClass=inetOrgPerson)', LDAPLinkFilterGroup='(objectClass=group)', LDAPLinkOn=1;
=> SELECT ldap_link_sync_start();

See LDAP link parameters.

LDAP link workflow

After you enable LDAP Link, synchronization occurs according to this workflow:

1. The System Administrator creates users and user groups on the LDAP server.

2. The System Administrator sets up LDAP Link service parameters as required and enables the service.

3. Using the LDAP Link service, the database replicates the users and user groups from the Application LDAP to the database, creating database users and roles.

4. The LDAP server uses Kerberos (KDC) to authenticate the user logging in to the database.

   • The LDAP user can log in to the database if assigned the appropriate authentication type.

   • After logging in, you can grant users privileges using GRANT statements or as part of a Group.