17.10 - Example: Test of IP Access Restrictions for Directory Users - Advanced SQL Engine - Teradata Database

Teradata Vantage™ - Advanced SQL Engine Security Administration

Product
Advanced SQL Engine
Teradata Database
Release Number
17.10
Release Date
July 2021
Content Type
Administration
Security
Publication ID
B035-1100-171K
Language
English (United States)

These examples test user djl for IP addresses 141.206.35.87, 141.206.35.88, and 141.206.35.89, and that the user is not permitted to log on from 141.206.35.88.

$ tdgssauth -m ldap -u djl -i 141.206.35.87
TDGSS_BIN_FILE not set.
TDGSSCONFIG GDO used in tdgss.
Please enter a password: 
                        Status: authenticated, not authorized
                 Database user: perm01 [permanent user]
            Authenticated user: ldap://esroot.example.com:389/CN=djl,OU=people,OU=testing,DC=example,DC=com
        Audit trail identifier: djl
        Authenticating service: esroot1
     Actual mechanism employed: ldap [OID 1.3.6.1.4.1.191.1.1012.1.20]
       Mechanism specific data: djl

 Security context capabilities: replay detection
                                out of sequence detection
                                confidentiality
                                integrity
                                protection ready
                                exportable security context

 Minimum quality of protection: none
                       Options: none

In this example, the last line of the output indicates that logon is denied.

$ tdgssauth -m ldap -u djl -i 141.206.35.88
TDGSS_BIN_FILE not set.
TDGSSCONFIG GDO used in tdgss.
Please enter a password: 
                        Status: authenticated, not authorized
                 Database user: perm01 [permanent user]
            Authenticated user: ldap://esroot.example.com:389/CN=djl,OU=people,OU=testing,DC=example,DC=com
        Audit trail identifier: djl
        Authenticating service: esroot1
     Actual mechanism employed: ldap [OID 1.3.6.1.4.1.191.1.1012.1.20]
       Mechanism specific data: djl

 Security context capabilities: replay detection
                                out of sequence detection
                                confidentiality
                                integrity
                                protection ready
                                exportable security context


The TDGSS function tdgss_inquire_policy_for_user returned an error:
  Major status 0x000d0000 – Failure
  Minor status 0xe10000ed – The user is not permitted to log on from the IP address.
$ tdgssauth -m ldap -u djl -i 141.206.35.89
TDGSS_BIN_FILE not set.
TDGSSCONFIG GDO used in tdgss.
Please enter a password: 
                        Status: authenticated, not authorized
                 Database user: perm01 [permanent user]
            Authenticated user: ldap://esroot.example.com:389/CN=djl,OU=people,OU=testing,DC=example,DC=com
        Audit trail identifier: djl
        Authenticating service: esroot1
     Actual mechanism employed: ldap [OID 1.3.6.1.4.1.191.1.1012.1.20]
       Mechanism specific data: djl

 Security context capabilities: replay detection
                                out of sequence detection
                                confidentiality
                                integrity
                                protection ready
                                exportable security context

 Minimum quality of protection: none
                       Options: none