After being authenticated by the directory, directory-based users are authorized database access privileges according to the following rules:
- If the directory maps users to database objects (users, external roles, and profiles), each directory user is authorized the privileges of the objects to which it is mapped.
- If the directory does not map users to database objects, but the directory username matches a database username, the directory user is authorized all the privileges belonging to the matching database user.
- If a directory user is neither mapped to any database objects, nor does the directory username match a database username, the directory user has no privileges to access the database.
One or more setup tasks (depending on implementation) must be completed before a directory user can access the database. See Teradata Vantage™ - Advanced SQL Engine Security Administration, B035-1100.