Processing LDAP Search Results

On this page


The processing of LDAP search results involves obtaining the required user and group information from LDAP and mapping it with SingleStore users and groups. This processing is handled by the "detail" section in the output.

detail: # detail specifies the structure of the user and group ldap entries
user_object_class: user # --user-object-class user
group_object_class: group # --group-object-class group
user_attribute: sAMAccountName # --user-attribute sAMAccountName
group_attribute: sAMAccountName # --group-attribute sAMAccountName
user_member_of_attribute: memberOf # --user-member-of-attribute memberOf
group_members_attribute: member # --group-members-attribute member
user_principal_name_attribute: userPrincipalName # --user-principal-name-attribute userPrincipalName

Note that only users and groups are taken into account.


Here is a part of a sample LDAP user entry with details on processing the user entry.

# peter pan, Users, memsql.ldap.testing
dn: CN=peter pan,CN=Users,DC=memsql,DC=ldap,DC=testing
objectClass: user # --user-object-class user is used to distinguish user entries from all the other entries
memberOf: CN=employees,DC=memsql,DC=ldap,DC=testing # --user-member-of-attribute memberOf is used to map the user to their groups
sAMAccountName: pan # --user-attribute sAMAccountName is used as a name for the SQL user
userPrincipalName: pan@memsql.ldap.testing # --user-principal-name-attribute userPrincipalName is used for as SPN for the Kerberos authentication

All the attribute keys may be overridden with their equivalent values (which will result in using the equivalent attributes). For example, cn can be used instead of the sAMAccountName for the SQL username.

Here are some examples of the CREATE USER queries that depend on the described options.

In CREATE USER 'Peter' IDENTIFIED WITH 'authentication_pam' AS '',

  • Peter is the value of --user-attribute

  • authentication_pam is selected by --auth-method pam

  • is the value of --pam-auth-service

In CREATE USER u IDENTIFIED WITH 'authentication_gss' AS '',

  • u is the value of --user-attribute

  • authentication_gss is selected by --auth-method kerberos

  • is

    • either the value of the attribute selected by --user-principal-name-attribute

    • or u is the --user-attribute value and is the value of --kerberos-realm, which overrides the first option


Here is a part of a sample LDAP group entry with details on processing it.

# employees, memsql.ldap.testing
dn: CN=employees,DC=memsql,DC=ldap,DC=testing
objectClass: group # --group-object-class group is used to distinguish group entries from all the other entries
member: CN=peter pan,CN=Users,DC=memsql,DC=ldap,DC=testing # --group-members-attribute member is used to map the group to its users
sAMAccountName: employees # --group-attribute sAMAccountName is used as a name for the SQL group

In CREATE GROUP 'employees', the group name is taken from the --group-attribute value.

Last modified: June 22, 2022

Was this article helpful?