1.0

Table Of Contents
-J-Dsqlfire.auth-ldap-server=ldaps://server:port/ to specify the Java system
property.
4. If you use SSL-encrypted LDAP and your LDAP server certicate is not recognized by a valid Certicate
Authority (CA), create a local trust store for each SQLFire member and import the LDAP server certicate
to the trust store. See
http://docs.oracle.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html#CreateKeystore for
more information.
5.
If you performed step 3, include the javax.net.ssl.trustStore and
javax.net.ssl.trustStorePassword system properties when you start individual SQLFire members.
For example:
sqlf server start -dir=./server -locators=localhost[10101]
-client-port=1528 -auth-provider=LDAP \
-J-Dsqlfire.auth-ldap-server=ldaps://ldapserver:636/
-user=user_name -password=user_pwd \
-J-Dsqlfire.auth-ldap-search-dn=uid=sqlfire1,ou=ldapExample,dc=gemstone,dc=com
\
-J-Dsqlfire.auth-ldap-search-pw=sqlfire1 \
-J-Dsqlfire.auth-ldap-search-base=ou=ldapTesting,dc=gemstone,dc=com \
-J-Djavax.net.ssl.trustStore=/Users/yozie/vFabric_SQLFire_10x/keystore_name
\
-J-Djavax.net.ssl.trustStorePassword=keystore_password
&
Note: javax.net.ssl.trustStore and javax.net.ssl.trustStorePassword must
be specied as Java system properties (using the -J option on the sqlf command line).
Note: LDAP server and search properties must be set to the same value for each member of the SQLFire
distributed system. However, individual SQLFire members can be started using different authenticated
user credentials, trust stores, and so forth.
Guest Access to Search for DNs
In an LDAP system, users are hierarchically organized in the directory as a set of entries. An entry is a set of
name-attribute pairs identied by a unique name, called a DN (distinguished name).
An entry is unambiguously identied by a DN, which is the concatenation of selected attributes from each entry
in the tree along a path leading from the root down to the named entry, ordered from right to left. For example,
a DN for a user might look like this:
cn=mary,ou=People,o=example.com
uid=mary,ou=People,o=example.com
The allowable entries for the name are dened by the entry's objectClass.
An LDAP client can bind to the directory (successfully log in) if it provides a user ID and password. The user
ID must be a DN, the fully qualied list of names and attributes. This means that the user must provide a very
long name.
Typically, the user knows only a simple user name (for example, the rst part of the DN above, mary). With
SQLFire, you do not need the full DN, because an LDAP client (SQLFire) can go to the directory rst as a guest
or even an anonymous user, search for the full DN, then rebind to the directory using the full DN (and thus
authenticate the user).
vFabric SQLFire User's Guide234
Deploying vFabric SQLFire