Synchronization Rules

During the sync, the LDAP tool runs the following SQL commands under specified conditions.

SQL Commands

Conditions

CREATE USER

LDAP groups to sync contain members who are not SingleStore DB users.

CREATE GROUP

LDAP groups to sync are not SingleStore DB groups.

DROP USER

SingleStore DB contains users that have been removed from the LDAP groups listed for syncing.

  • If the --drop-unmanaged-users option is used, the tool deletes SingleStore DB users that are not present in LDAP.

  • If the --drop-unmanaged-users option is skipped, the tool deletes only managed SingleStore DB users (members of the constant.GroupForManagedLDAPUsers group) that are no longer present in LDAP.

DROP GROUP

SingleStore DB contains groups that have been deleted from LDAP.

GRANT GROUP

LDAP groups to sync contain members that are not part of the corresponding SingleStore DB groups. The tool will add those users to the SingleStore DB groups.

REVOKE GROUP

SingleStore DB groups contain members that are no longer part of the corresponding LDAP groups listed for syncing. The tool will remove those users from the SingleStore DB groups.

Additional Notes

  • New SingleStore DB users and groups that are created during the sync abide by the following rules.

    • New users and groups are created with the LDAP user and group names. The names of the imported users and groups must also be unique.

    • New users can be authenticated via Kerberos, PAM, SAML, or JWT, depending on the authentication protocol preconfigured in SingleStore DB.

    • New users are created with the parameters defined by the --resource-pool, --failed-login-attempts, and --password-lock-time options. Note that the resource pool you specify must already exist in SingleStore DB.

    • New users will be members of the ldap_users_internal_group group. This group must not be modified. Note: Members of ldap_users_internal_group will be referred to as "managed" users throughout this document.

    • New users are created with the % hostname, allowing them to connect to the cluster from any host.

  • New SingleStore DB groups are created with the members of the LDAP groups that are synced. As SingleStore DB does not support sub-groups of user groups, only one group level is supported. For example, DentalCSR and MedicalCSR are two LDAP user groups. After syncing with SingleStore DB, members of DentalCSR in LDAP become members of DentalCSR in SingleStore DB, whereas members of MedicalCSR in LDAP will be added to MedicalCSR in SingleStore DB. If a user belongs to both LDAP groups, then the user will be part of both SingleStore DB groups.

  • If a SingleStore DB user that is dropped during a sync also has an active database connection, the user can run commands until the session expires. However, the deleted user cannot establish new database connections.

  • If an LDAP user already exists in SingleStore DB, the tool will sync the LDAP user’s information with SingleStore DB.

  • The tool does not sync a user’s hosts or passwords from LDAP.