sp_ldapadmin

Description

Creates an LDAP URL search string, lists an LDAP URL search string, or verifies an LDAP URL search string or login.

Syntax

sp_ldapadmin { set_primary_url, ‘ldapurl’ | 
	set_secondary_url, { ‘ldapurl’ | null } |
	list_urls | check_url, ‘ldapurl’ |
	check_login, ‘login_name’ }

ldapurl::=ldap://host:port/node/?attributes?base | one | sub?filter

Parameters

set_primary_url, ‘ldapurl’: creates the specified search string ldapurl. Exactly one primary search string can be created.

set_secondary_url, { ‘ldapurl’ | null }: creates the specified secondary search string ldapurl or no secondary search string. Exactly one secondary search string can be created.

list_urls: displays LDAP URL search strings.

check_url, ‘ldapurl’: verifies an LDAP URL search string. Can also verify the existence of a user account, but it does not authenticate the user.

check_login, login_name: verifies a user account for the existing LDAP URL search strings. It does not authenticate the user.

host: is the host name of the LDAP server.

port: is the port number of the LDAP server.

node: specifies the node in the object hierarchy at which to start the search.

attributes: is a list of attributes to return in the result set. Each LDAP server may support a different list of attributes.

base | one | sub: qualifies the search criteria. base specifies a search of the base node; one specifies a search of node and one sublevel below node; and sub specifies a search of node and all node sublevels.

filter: specifies the attribute or attributes to be authenticated. The filter can be simple, such as “uid=*,” or compound, such as “(uid=*)(ou=group).” The syntax is LDAP server dependent and uses a wildcard (*) to describe the login name.

Examples

Example 1

Creates an LDAP URL search string for the LDAP SunONE Directory Server.

sp_ldapadmin set_primary_url,'ldap://voyager:389/
    ou=People,dc=MyCompany,dc=com??sub?uid=*'

The search string identifies a directory server listening on host name “voyager,” port number 389 (the default LDAP protocol port), the base node to begin the search is within organizational unit (ou) “People,” and the domain is “MyCompany.com.” It returns all attributes that match the filter uid=*. Adaptive Server replaces the wildcard with the Adaptive Server login name that is to be authenticated.

Example 2

Creates an LDAP URL search string defined in OpenLDAP 2.0.25 using the criteria described in Example 1.

sp_ldapadmin set_primary_url,'ldap://voyager:389/
    dc=MyCompany,dc=com??sub?cn=*'

Example 3

Sets the secondary LDAP URL search string to null, indicating no failover and no secondary LDAP server.

sp_ldapadmin set_secondary_url, null

Example 4

Creates an LDAP URL search string with a compound filrer.

sp_ldapadmin set_primary_url, 'ldap://voyager:389/
    ou=people,dc=siroe,dc=com??sub?(&(uid=*)
    (ou=accounting))

Usage

The LDAP vendor determines the syntax of the search string. In all cases, the search string specifies the attribute name that uniquely identifies the user in the form “attribute=wildcard” as in “cn=*.”
The first attribute in a compound filter must define the Relative Distinguished Name (RDN). For example, “...sub?(uid=*)(ou=group).” Otherwise, the authentication fails.
When a search string is added, Adaptive Server verifies that it uses valid LDAP URL syntax and that it references an existing node. To ensure that the valid string returns expected values, carefully choose and verify the search string when configuring Adaptive Server.
The secondary URL search string enables failover to another LDAP server. Adaptive Server uses the primary URL search string unless the LDAP Server is not active or the search string is invalid. In this event, Adaptive Server uses the secondary URL search string for authentication.

Permissions

Only the System Security Officer can execute sp_ldapadmin.