17.10 - Setting Up Non-LDAP External Authentication with Directory Authorization - Advanced SQL Engine - Teradata Database

Teradata Vantage™ - Advanced SQL Engine Security Administration

Product
Advanced SQL Engine
Teradata Database
Release Number
17.10
Release Date
July 2021
Content Type
Administration
Security
Publication ID
B035-1100-171K
Language
English (United States)
  1. Make sure users that will use this method:
    • Are defined to Kerberos.
    • Are defined in the directory in such a way that they can be located by an <Identity Map> or <Identity Search>. See Optimizing Directory Searches.
  2. Complete the setup tasks listed for Option 2: Directory Authentication and Authorization, with the following changes:
    1. Do not configure the LDAP mechanism, because it is not used for authentication.
    2. Copy the following mechanism properties from the LDAP mechanism in the TDGSS library configuration file, into the TdgssUserConfigFile.xml for the authentication mechanism, KRB5 or SPNEGO:

      LdapServerName

      Optional LDAP identifications properties, if needed. See Optimizing Directory Searches.
      Some identification properties do not apply to this option.
    3. Because this option requires service binds, Teradata strongly recommends that you implement TLS protection. See Using TLS with a Directory Server.
      Non-LDAP authentication ignores the LdapClientMechanism property setting.
    4. Set the authentication mechanism (KRB5 or SPNEGO) as the default on all affected clients, or instruct users to specify the mechanism in the logon string.
  3. You can use either of the these logon forms: