Rules for Specifying Users as Policy Members - Advanced SQL Engine - Teradata Database

• The DN of a Teradata user object
• The DN of a directory principal

The choice of user object is subject to the following rules:

If the directory principal is mapped to a Teradata user object, use the DN of the Teradata user object for the member attribute.

If the directory principal is not mapped to a Teradata user object, use the DN of the directory principal for the member attribute.

If users logging on through Unity are externally authenticated, PROXY must be configured. If PROXY is configured, Unity also uses the PROXY mechanism for TD2 sessions.

If PROXY is configured, create a PROXY mechanism policy and assign policy membership to the Unity user for each server, to ensure the security of Unity connections to the database,

1. Define the Unity user as part of initial setup of each Unity server. See the Teradata Unity documentation.
2. Re-specify the Unity user and password on each Unity server when configuring the certificate and private key for use with externally authenticated Vantage users. For information about Unity, see Teradata® Unity™ Installation, Configuration, and Upgrade Guide for Customers, B035-2523 and Teradata® Unity™ User Guide, B035-2520.
3. Define each Unity user as a Teradata user object in the directory, as shown in the diagram in Using LDAP Directory Objects in Policies.
4. Assign PROXY policy membership to the Unity user for each Unity server in the directory. For instructions on the syntax used to assign membership to users, see the topics for each policy type beginning with Configuring a Security Mechanism Policy.