17.10 - Configuring Site-Aware SRV Resource Records in TDGSS - Advanced SQL Engine - Teradata Database

Teradata Vantage™ - Advanced SQL Engine Security Administration

Product
Advanced SQL Engine
Teradata Database
Release Number
17.10
Release Date
July 2021
Content Type
Administration
Security
Publication ID
B035-1100-171K
Language
English (United States)

You can configure the authentication mechanism for site-aware selection of a local directory by editing the LdapServerName property to a DNS SRV RR formatted site name, for example:

<Mechanism Name="ldap">
  <MechanismProperties
     MechanismEnabled="yes"
     AuthorizationSupported="no"
     ...
     LdapClientMechanism="simple"
     LdapServerName="_ldap._tcp.SanDiegoHQ._sites.domain1.com"
     ...
  />
</Mechanism>
Configuration Option Description
<Mechanism Name="ldap"> Site awareness requires directory authentication of the user, using the LDAP mechanism.
MechanismEnabled="yes" The LDAP mechanism must be enabled.
AuthorizationSupported="no" Site awareness functions whether or not the directory authorizes the user.
LdapClientMechanism="simple" The example is for a system using simple binding, but site awareness also supports DIGEST-MD5 binding.
LdapServerName="_ldap._tcp.SanDiegoHQ._sites.domain1.com" This setting requires a DNS SRV RR formatted site name, which identifies the local site directories available to authenticate the user.
In addition to performing the TDGSS configuration shown above, if the DNS service for the domain in which the database or Unity server resides is not the one where Active Directory registers its site-aware DNS SRV RRs (that is, a “foreign” service), then you must also manually configure the site-aware SRV RRs in the foreign DNS service.

For DNS SRV RR configuration instructions, see LdapServerName.

When you configure the LdapServerName property for site awareness, the authenticating mechanism selects a directory at random from among the available local directories for the site.