Use the Lightweight Directory Access Protocol as a Directory Service

Lightweight Directory Access Protocol (LDAP) is an industry standard for accessing directory services. Directory services allow components to look up information by a distinguished name (DN) from an LDAP server that stores and manages server, user, and software information that is used throughout the enterprise or over a network.

SAP ASE uses directory services to establish client and RPC connections over the Internet. LDAP directory services are used to establish connections. LDAP is a licensed feature of SAP ASE.

The LDAP server can be located on a different platform from the one on which SAP ASE or the clients are running. LDAP defines the communication protocol and the contents of messages exchanged between clients and servers. Messages are operators, such as client requests for read, write and query, and server responses, including data-format information.

The LDAP server stores and retrieves information about:

• SAP ASE, such as IP address, port number, and network protocol
• Security mechanisms and filters
• High availability companion server name

You can Configure the LDAP server with these access restrictions:

• Anonymous authentication – all data is visible to any user.
• User name and password authentication – SAP ASE uses the default user name and password for UNIX platforms:
  • $SYBASE/$SYBASE_OCS/config/libtcl.cfg on 32-bit platforms
  • $SYBASE/$SYBASE_OCS/config/libtcl64.cfg on 64-bit platforms

User name and password authentication properties establish and end a session connection to an LDAP server.

When an LDAP server is specified in the libtcl.cfg or libtcl64.cfg file (collectively the libtcl*.cfg file), the server information is accessible only from the LDAP server. SAP ASE ignores the interfaces file.

If multiple directory services are supported in a server, the order in which they are searched is specified in libtcl*.cfg. You cannot specify the search order with the dataserver command line option.

See the Security Administration Guide.

• LDAP Directory Services Versus the SAP Interfaces File
  The LDAP driver implements directory services for use with an LDAP server.
• The libtcl*.cfg File
  Use the libtcl*.cfg file to specify the LDAP server name, port number, DIT base, user name, and password to authenticate the connection to an LDAP server.
• Enabling LDAP Directory Services
  Enable LDAP directory service.
• Keywords for the LDAP URL Variables
  Configure the libtcl.cfg file DIRECTORY section.
• Adding a Server to the Directory Services
  Use dsedit to add a new server entry.
• Multiple Directory Services
  You can specify multiple directory services for high availability failover protection.
• Encrypting the Password
  Entries in the libtcl.cfg file are in human-readable format. SAP provides a pwdcrypt utility for basic password encryption.
• Performance
  Performance when using an LDAP server may be slower than when using an interfaces file because the LDAP server requires time to make a network connection and retrieve data.
• Migrating from the interfaces File to LDAP
  Once you have upgraded SAP ASE, configure the server to use LDAP service.