Managing users from external LDAP for Netezza Performance Server for Cloud Pak for Data System 11.0.3.1 to 11.0.7.0

Learn how to manage users from external LDAP for Netezza Performance Server for Cloud Pak for Data System 11.0.3.1 to 11.0.7.0.

Procedure

  1. Log in to Cloud Pak for Data System.
  2. Log in to Netezza Performance Server: 
    docker exec -it <ips hostname> bash
  3. Switch users to the nz user: 
    su - nz
  4. Verify the authentication: 
    nzsql -c "show authentication all"
    Example:
    [nz@node0201 ~]$ nzsql -c "show authentication all"
AUTH_OPTION            | AUTH_VALUE
-----------------------+------------
AUTHENTICATION METHOD  | LOCAL
(1 row)
  5. Depending on the LDAP server that you use:
    • OpenLDAP:
      1. Add the LDAP users to the database by connecting to the Netezza Performance Server host:
        create user <user>   password  <password>
        Define the password according to your password policy.
        Example:
        nzsql -c “create user test_ldap password 'password';“
      2. Set the authentication type to LDAP with SSL off:
        SET AUTHENTICATION LDAP
        Example output for SSL off:
        nzsql -c " SET AUTHENTICATION LDAP BASE 'dc=somedomain,dc=com' NAMECASE lowercase SERVER 
'<ldap_server>' SSL 'off' BINDDN 'cn=admin,dc=somedomain,dc=com' BINDPW adminpass;"
        where:
        CN
        Common Name
        DC
        Domain Component
        BINDDN
        Distinguished Name
        BINDPW
        Password associated with the Distinguished Name
        Note: Skip BINDDN 'cn=admin,dc=somedomain,dc=com' if bind password is not set on the LDAP server. In this case, the command example is:
        nzsql -c " SET AUTHENTICATION LDAP BASE 'dc=somedomain,dc=com' NAMECASE lowercase SERVER '<ldap_server>' SSL 'off'
      3. Verify the authentication type:
        nzsql -c "show authentication all;"
        Examples:
        • [nz@node0201 ~]$ nzsql -c "show authentication all;"
      AUTH_OPTION       |          AUTH_VALUE
------------------------+-------------------------------
 AUTHENTICATION METHOD  | LDAP
 AUTHMTHD LDAP BASE     | dc=somedomain,dc=com
 AUTHMTHD LDAP BINDDN   | cn=admin,dc=somedomain,dc=com
 AUTHMTHD LDAP NAMECASE | LOWERCASE
 AUTHMTHD LDAP SERVER   | <LDAP server IP>
 AUTHMTHD LDAP SSL      | off
(6 rows)
        • if BINDPW is not used in the set authentication command:
          [nz@node0201 ~]$ nzsql -c "show authentication all;"
      AUTH_OPTION       |          AUTH_VALUE
------------------------+-------------------------------
 AUTHENTICATION METHOD  | LDAP
 AUTHMTHD LDAP BASE     | dc=somedomain,dc=com
 AUTHMTHD LDAP NAMECASE | LOWERCASE
 AUTHMTHD LDAP SERVER   | <LDAP server IP>
 AUTHMTHD LDAP SSL      | off
(5 rows)

        Note that /etc/ldap.conf is deprecated on Netezza Performance Server. You must use /etc/sssd/sssd.conf to set up the LDAP configuration.

        ===========================/etc/sssd/sssd.conf==================================

[domain/external_ldap]

ldap_tls_reqcert = never
ldap_id_use_start_tls = False
ldap_schema = rfc2307
auth_provider = ldap
id_provider = ldap
ldap_rfc2307_fallback_to_local_users = True
ldap_referrals = False
ldap_id_mapping = False
override_homedir = /home/%u
ldap_network_timeout = 3
ldap_opt_timeout = 60
cache_credentials = True
ldap_user_search_base = dc=somedomain,dc=com
entry_cache_group_timeout = 0
entry_cache_user_timeout = 0
ldap_search_timeout = 30
entry_cache_timeout = 600
ldap_default_bind_dn = cn=admin,dc=somedomain,dc=com
ldap_uri = ldap:/<LDAP Server>:389


ldap_default_authtok_type = obfuscated_password
ldap_default_authtok = AAAQAGjPMpPlaKyKfPLvmpE1FSolHcAHS/0KoEaJ7k8yPZaphWL2hLYyjKBXO4C9aAgAIGKgBWONT+5nOITCVv6tTlwAAQID
[sssd]
services = nss, ifp, sudo, ssh, pam
domains = external_ldap

[nss]
memcache_timeout = 600
homedir_substring = /home



[sudo]
[autofs]
[ssh]
[pac]
[ifp]
    • Windows Active Directory:
      1. Add the AD users to the database:
        create user <user>  password  <password>
        Define the password according to your password policy.
        Example:
        nzsql -c "create user ad_user1 password 'password';"
      2. Set the authentication type to LDAP with SSL off:
        SET AUTHENTICATION LDAP
        Example:
        nzsql -c " SET AUTHENTICATION LDAP BASE 'dc=nzdevelopment,dc=com' NAMECASE lowercase SERVER '<ad-server>' 
SSL 'off' BINDPW Netezza26 BINDDN 'cn=ad_user1,cn=Users,dc=nzdevelopment,dc=com'; "
        where:
        cn
        Common Name
        dc
        Domain component
      3. Update the /etc/sssd/sssd.conf file on the Netezza Performance Server host manually as below:

        In the example, the items that you have to updated are assigned numbers from  1  to  6 .

        ===========================/etc/sssd/sssd.conf==================================

[domain/external_ldap]

ldap_tls_reqcert = never
ldap_id_use_start_tls = True
ldap_schema = AD  1 
ignore_group_members = True  2 
auth_provider = ldap
id_provider = ldap
ldap_rfc2307_fallback_to_local_users = True
ldap_referrals = False
ldap_id_mapping = True  3 
override_homedir = /home/%u
ldap_network_timeout = 3
ldap_opt_timeout = 60
cache_credentials = True
ldap_user_search_base = dc=nzdevelopment,dc=com
entry_cache_group_timeout = 0
entry_cache_user_timeout = 0
ldap_search_timeout = 30
entry_cache_timeout = 600
ldap_default_bind_dn = cn=ad_user1,cn=Users,dc=nzdevelopment,dc=com
ldap_uri = ldap://<AD Server>:389

case_sensitive = False  4 
ldap_group_name = CN  5 
ldap_user_name = sAMAccountName  6 

ldap_default_authtok_type = obfuscated_password
ldap_default_authtok = AAAQANEC2d5xigH0d4w9phf5F9zD4PvXWvxwz61LYsoQq5BM/M7WslokdqbS6CnOyTzGp4XmzCC7owRfYq8sALPYypoAAQID
[sssd]
services = nss, ifp, sudo, ssh, pam
domains = external_ldap

[nss]
memcache_timeout = 600
homedir_substring = /home


[sudo]
[autofs]
[ssh]
[pac]
[ifp]
      4. Restart the sssd service with the root user: 
        systemctl restart sssd
  6. Verify the LDAP/AD user authentication setup:
    1. Log in as the nz user:
      su – nz
    2. Run the command:
      nzsql -u <LDAP/AD user> -pw <LDAP/AD user password>
      Note: LDAP/AD user password is the password defined on the LDAP server for the LDAP user.
      Example: 
      [nz@node0201 ~]$ nzsql -db system -u test_ldap -pw netezzaips
Welcome to nzsql, the IBM Netezza SQL interactive terminal.

Type:  \h for help with SQL commands
       \? for help on internal slash commands
       \g or terminate with semicolon to execute query
       \q to quit

SYSTEM.ADMIN(TEST_LDAP)=> show authentication all;
      AUTH_OPTION       |          AUTH_VALUE
------------------------+-------------------------------
 AUTHENTICATION METHOD  | LDAP
 AUTHMTHD LDAP BASE     | dc=somedomain,dc=com
 AUTHMTHD LDAP BINDDN   | cn=admin,dc=somedomain,dc=com
 AUTHMTHD LDAP NAMECASE | LOWERCASE
 AUTHMTHD LDAP SERVER   | <ldap_server>
 AUTHMTHD LDAP SSL      | off
(6 rows) (6 rows)

[nz@node0201 ~]$