Sign inTry Free

Synchronization Rules

On this page

During the sync, the LDAP tool runs the following SQL commands under specified conditions.

SQL Commands

Conditions

CREATE USER

LDAP groups to sync contain members who are not SingleStore users.

CREATE GROUP

LDAP groups to sync are not SingleStore groups.

DROP USER

SingleStore contains users that have been removed from the LDAP groups listed for syncing.

  • If the --drop-unmanaged-users option is used, the tool deletes SingleStore users that are not present in LDAP.

  • If the --drop-unmanaged-users option is skipped, the tool deletes only managed SingleStore users (members of the constant.GroupForManagedLDAPUsers group) that are no longer present in LDAP.

DROP GROUP

SingleStore contains groups that have been deleted from LDAP.

GRANT GROUP

LDAP groups to sync contain members that are not part of the corresponding SingleStore groups. The tool will add those users to the SingleStore groups.

REVOKE GROUP

SingleStore groups contain members that are no longer part of the corresponding LDAP groups listed for syncing. The tool will remove those users from the SingleStore groups.

Additional Notes

  • New SingleStore users and groups that are created during the sync abide by the following rules.

    • New users and groups are created with the LDAP user and group names. The names of the imported users and groups must also be unique.

    • New users can be authenticated via Kerberos, PAM, SAML, or JWT, depending on the authentication protocol preconfigured in SingleStore.

    • New users are created with the parameters defined by the --resource-pool, --failed-login-attempts, and --password-lock-time options. Note that the resource pool you specify must already exist in SingleStore.

    • New users will be members of the ldap_users_internal_group group. This group must not be modified. Note: Members of ldap_users_internal_group will be referred to as "managed" users throughout this document.

    • New users are created with the % hostname, allowing them to connect to the cluster from any host.

  • New SingleStore groups are created with the members of the LDAP groups that are synced. As SingleStore does not support sub-groups of user groups, only one group level is supported. For example, DentalCSR and MedicalCSR are two LDAP user groups. After syncing with SingleStore, members of DentalCSR in LDAP become members of DentalCSR in SingleStore, whereas members of MedicalCSR in LDAP will be added to MedicalCSR in SingleStore. If a user belongs to both LDAP groups, then the user will be part of both SingleStore groups.

  • If a SingleStore user that is dropped during a sync also has an active database connection, the user can run commands until the session expires. However, the deleted user cannot establish new database connections.

  • If an LDAP user already exists in SingleStore, the tool will sync the LDAP user’s information with SingleStore.

  • The tool does not sync a user’s hosts or passwords from LDAP.

Last modified: June 22, 2022

Was this article helpful?

On this page

Was this article helpful?