LDAP Authentication by using OPENLDAP

Procedure

1. Add the OPENLDAP user to Netezza Performance Server.

   create user <user> password <password>

   Define the password according to your password policy.
   Example:

   create user <user> password <password>

2. Set the authentication type.
   • Set authentication to OPENLDAP with the SSL/TLS OFF
     1. Run the command.

        nzsql -c " SET AUTHENTICATION LDAP BASE 'dc=example,dc=com' NAMECASE lowercase SERVER 'OPENLDAP_SERVER_FQDN_OR_IP' SSL 'OFF' BINDPW Netezzapwd BINDDN 'cn=oldap_admin_user1,cn=Users,dc=example,dc=com'; "

        cn is the Common Name.

        dc is the Domain component.

     2. Now the sssd.conf file looks as the following example.

        [domain/external_ldap]
        
        ###The below common parameters and values should not be changed
        
        ldap_default_authtok_type = obfuscated_password
        ldap_schema = rfc2307
        #ldap_group_name =
        #ldap_user_name =
        ignore_group_members = False
        auth_provider = ldap
        ldap_rfc2307_fallback_to_local_users = True
        ldap_referrals = False
        override_homedir = /home/%u
        ldap_network_timeout = 3
        ldap_opt_timeout = 60
        cache_credentials = True
        entry_cache_group_timeout = 0
        entry_cache_user_timeout = 0
        ldap_search_timeout = 30
        id_provider = ldap
        entry_cache_timeout = 600
        case_sensitive = False
        ldap_id_mapping = False
        #ldap_group_attribute =
        #debug_level = 10
        
        ###Supplied from Input
        
        ldap_uri = ldap://OPENLDAP_SERVER_FQDN_OR_IP:389
        ldap_user_search_base = dc=example,dc=com
        ldap_default_bind_dn = cn=oldap_admin_user1,cn=Users,dc=example,dc=com
        ldap_tls_reqcert = never
        #ldap_id_use_start_tls =
        #ldap_tls_cacert =
        
        ldap_default_authtok = AAAQAHyh0uE+spiukG6zQ89FjCZdgIqHaYvqz5ToDPwbIxy2/whEzpa0+OTycf5q4Ivni+cHJ1EMkRarmGo9Wwna5voAAQID
        [sssd]
        services = nss, ifp, sudo, ssh, pam
        domains = external_ldap
        
        [nss]
        memcache_timeout = 600
        homedir_substring = /home
        
        [pam]
        #debug_level = 10
        
        [sudo]
        [autofs]
        [ssh]
        [pac]
        [ifp]
        [secrets]

   • Set authentication to OPENLDAP with the SSL ON

     A certificate must be issued to the OPENLDAP server by a trusted CA. Obtain the CA certificate file and save it on a location on the Netezza Performance Server system. For the Netezza Performance Server high availability (HA) systems, save the file in a location on the shared drive, such as a new directory under /nz. Both Netezza Performance Server nodes must be able to access the certificate file by using the same path name. Typically, the CA certificate has the .pem extension.

     1. Run the command.

        nzsql -c " SET AUTHENTICATION LDAP BASE 'dc=example,dc=com' NAMECASE lowercase SERVER 'OPENLDAP_SERVER_FQDN_OR_IP' SSL 'ON' BINDPW Netezzapwd BINDDN 'cn=oldap_admin_user1,cn=Users,dc=example,dc=com' CACERT '/nz/caCert/ca_cert.pem'; "