2.06 - Teradata Target Connector Security Guidelines - Teradata QueryGrid

Teradata connectors support Trusted, TD2, LDAP, and Kerberos security mechanisms when acting as target connectors. The following considerations apply to each of the security mechanisms:

• The username and password assigned and communicated from the initiator connector takes precedence over the one defined for the Teradata target connector properties.

  For example, if the Teradata initiator provides an authorization object, it takes precedence over security-related connector property settings. Defining these connector properties is optional. If, however, credentials are not provided by the initiator connector, a username and password must exist in its connector property settings.

• An Administrator can define user mappings in the QueryGrid portlet if the initiator end user differs from the remote system end user. This is the user to which you have granted CONNECT THROUGH on the remote system.
• For user mapping, the local user submitting the query is mapped to the remote user that submits the query. User mapping applies as follows:
  • For a Teradata initiator connector, user mapping can be used when it is set up with DEFINER authorization such that the local user submitting the query is the not the same as the authenticating user.
  • For a target connector, user mapping is applicable when it is set up with the TRUSTED authentication mechanism and the remote user is not the same as the authenticating user.

CREATE USER proxyuser AS PERM = 0 PASSWORD = password;
GRANT CONNECT THROUGH proxyuser TO PERMANENT target_end_user without role;
>> this target_end_user is the user that has access to objects that we will access from local system

The following property settings are required for Teradata target connectors using the Trusted security model.

The following property settings are required for Teradata target connectors using the TD2 security model.

You can configure Teradata target connectors to use LDAP authentication involving a username and password. This means that queries with a Teradata target can be submitted using the LDAP security mechanism to authenticate; for example, the Presto-to-Teradata connection supports LDAP. The following properties must be configured to use LDAP with Teradata target connectors.

Teradata Kerberos set up must be completed before configuring QueryGrid. The following property settings are required for Teradata target connectors using the Kerberos security model.