General

The processing of LDAP search results involves obtaining the required user and group information from LDAP and mapping it with SingleStore users and groups. This processing is handled by the "detail" section in the output.

detail: # detail specifies the structure of the user and group ldap entries
  user_object_class: user # --user-object-class user
  group_object_class: group # --group-object-class group
  user_attribute: sAMAccountName # --user-attribute sAMAccountName
  group_attribute: sAMAccountName # --group-attribute sAMAccountName
  user_member_of_attribute: memberOf # --user-member-of-attribute memberOf
  group_members_attribute: member # --group-members-attribute member
  user_principal_name_attribute: userPrincipalName # --user-principal-name-attribute userPrincipalName

Note that only users and groups are taken into account.

Users

Here is a part of a sample LDAP user entry with details on processing the user entry.

# peter pan, Users, memsql.ldap.testing
  dn: CN=peter pan,CN=Users,DC=memsql,DC=ldap,DC=testing
  objectClass: user # --user-object-class user is used to distinguish user entries from all the other entries
  memberOf: CN=employees,DC=memsql,DC=ldap,DC=testing # --user-member-of-attribute memberOf is used to map the user to their groups
  sAMAccountName: pan # --user-attribute sAMAccountName is used as a name for the SQL user
  userPrincipalName: pan@memsql.ldap.testing # --user-principal-name-attribute userPrincipalName is used for as SPN for the Kerberos authentication

All the attribute keys may be overridden with their equivalent values (which will result in using the equivalent attributes). For example, cn can be used instead of the sAMAccountName for the SQL username.

Here are some examples of the CREATE USER queries that depend on the described options.

In CREATE USER 'Peter' IDENTIFIED WITH 'authentication_pam' AS 'testing.com',

• Peter is the value of --user-attribute

• authentication_pam is selected by --auth-method pam

• testing.com is the value of --pam-auth-service

In CREATE USER u IDENTIFIED WITH 'authentication_gss' AS 'u@testing.com',

• u is the value of --user-attribute

• authentication_gss is selected by --auth-method kerberos

• u@testing.com is

  • either the value of the attribute selected by --user-principal-name-attribute

  • or u is the --user-attribute value and testing.com is the value of --kerberos-realm, which overrides the first option

Groups

Here is a part of a sample LDAP group entry with details on processing it.

# employees, memsql.ldap.testing
  dn: CN=employees,DC=memsql,DC=ldap,DC=testing
  objectClass: group # --group-object-class group is used to distinguish group entries from all the other entries
  member: CN=peter pan,CN=Users,DC=memsql,DC=ldap,DC=testing # --group-members-attribute member is used to map the group to its users
  sAMAccountName: employees # --group-attribute sAMAccountName is used as a name for the SQL group

In CREATE GROUP 'employees', the group name is taken from the --group-attribute value.