LDAP Security Provider

The LDAP security provider suite includes authentication, attribution, and authorization providers. Add an LDAP provider to a security configuration to authenticate administrator logins (on the "admin" security configuration on the "default" domain) or device user logins (any custom security configuration for that purpose).

You can configure these providers:

• The LDAPLoginModule provides authentication services. Through appropriate configuration, you can enable certificate authentication in LDAPLoginModule.
• (Optional) LDAPAuthorizer or RoleCheckAuthorizer provide authorization service in conjunction with LDAPLoginModule. LDAPLoginModule works with either authorizer.

  The RoleCheckAuthorizer is part of every security configuration but does not appear in Sybase Control Center.

  Use LDAPAuthorizer only when LDAPLoginModule is not used to perform authentication, but roles are still required to perform authorization checks against the LDAP data store. If you use LDAPAuthorizer, always explicitly configure properties; for it cannot share the configuration options specified for the LDAPLoginModule.

• (Optional) LDAPAttributer is used to retrieve the list of roles from the LDAP repository. These roles are displayed in the role mapping screen in Sybase Control Center. The LDAP attributer is capable of sharing the configuration properties from the LDAPLoginModules. If no configuration properties are explicitly specified, then the attributer iterates through the configured LDAPLoginModules and retrieves the roles from all the LDAP repositories configured for the different LDAPLoginModules.

You need not enable all LDAP providers. You can also implement some LDAP providers with providers of other types. If you are stacking multiple LDAP providers, be aware of and understand the configuration implications.

• Configuration Best Practices for Multiple LDAP Trees
  Use the Sybase Unwired Platform administration perspective to configure LDAP authentication and authorization security providers, which are used to locate LDAP user information when organizational user groups exist within multiple LDAP trees.
• LDAP Role Computation
  Role checks are the primary means of performing access control when using LDAP authentication. Authentication and attribution capabilities both utilize role computation techniques to enumerate roles that authenticated users have.
• LDAP Provider Stacking and Configuration Sharing
  LDAP login and attribution modules can sometimes share a common configuration. LDAPAttributer can share the configuration properties from the configured LDAP login modules only if no configuration properties are explicitly configured for LDAPAttributer.
• Nested Groups and Roles in LDAP
  The LDAP provider computes the roles granted to an authenticated user using the role and group membership information from the LDAP repository. To support nested roles and groups, LDAP servers allow roles and groups to be members of other roles and groups respectively.
• Skipping LDAP Role Lookups (SkipRoleLookup)
  When configuring an LDAP provider, use the SkipRoleLookup configuration option to grant the user attributes defined in the UserRoleMembershipAttributes property.
• Configuring an LDAP Provider to use SSL
  If your LDAP server uses a secure connection, and its SSL certificate is signed by a nonstandard certificate authority, for example it is self-signed, use the keytool utility (keytool.exe) to import the certificate into the truststore.