Allowing Standard Authentication in an LDAP User Authentication Only Environment

Allow select users to authenticate using standard authentication in an environment that supports only LDAP user authentication.

If LDAP user authentication is the only authentication method allowed to access the SAP Sybase IQ database, these circumstances may create a scenario in which no user is permitted to log on:

Of no login policy exists with LDAP user authentication enabled;
If no users are assigned to a login policy with LDAP user authorization enabled; or
If all user accounts assigned to a login policy with LDAP user authentication are locked.

You may not be able to prevent this scenario; however, there is a method that allows a select number of users to log in to SAP Sybase IQ database using standard authentication. This method is intended as a temporary solution when LOGIN_MODE configuration prevents all users from connecting to the database.

When granting the select users access using standard authentication, ensure that at least one of those users has the SET ANY SECURITY OPTION or MANAGE ANY LOGIN POLICY system privileges to allow them to permanently resolve the issue. Depending on the underlying cause of the inability of any users to log in using LDAP user authentication, one or both of these system privileges might be required to permanently resolve the issue. You can specify a maximum of five user IDs, separated by semicolons, and enclosed in double quotation marks.

Grant standard authentication access only after the lockdown problem has occurred; you need not set it in advance. It does not need to be set in advance. To allow select users to log in using standard authentication, execute the start_iq utility with the –al user-id-list command line switch. Once granted, at the credentials prompt, the user enters his or her standard authentication user name and password.

Include the -al switch at either the server or database level. At the server level, the -al switch remains in effect until the next time the server is restarted. At the database level, the -al switch remains in effect until the next time the database is stopped and restarted.

To allow standard authentication, execute one of these commands:

Level	Statement
Server	start_iq -al `"user1,user2,user3" server_name.cfg database-name.db`
Database	start_iq `servername.cfg database_name.db` -al `"user1,user2,user3"`

Example:

This example assumes that login_mode is set to “LDAPUA”. This command allows users Alice, Bob, and Carol to authenticate using standard authentication on database1 on server1:

start_iq –al  "alice;bob;carol" server1.cfg database1.db