1.1.1

Note: Regardless of which method you use to define the new password, you must restart all SQLFire
members (including locators) using the new password. You cannot change a system password user on
only a subset of the SQLFire members. This limitation applies only to system users defined in the BUILTIN
authentication schema. LDAP authentication occurs outside of the SQLFire system, so passwords can be
changed without affecting available SQLFire members.
Create Distributed System Users
Create user accounts to protect database resources.
To define distributed system users, you must first connect to a SQLFire system and then execute a system
procedure to create a user account.
Note: To create the first user account, log in using an established SQLFire system user. After creating a
distributed system user, you can connect and assign database privileges using the new account.
For example:
sqlf
connect peer
'locators=localhost:10334;mcast-port=0;user=SB;auth-provider=BUILTIN;sqlfire.user.SB=PSB;password=PSB';
call sys.create_user('sqlfire.user.newuser', 'newpassword');
disconnect;
After creating one or more distributed system user accounts, you can use those credentials, instead of a system
user credential, to connect to SQLFire:
sqlf
connect client 'localhost:10334;user=newuser;password=newpassword';
Use distributed system user accounts with the GRANT and REVOKE statements to manage access to database
resources. See Configuring User Authorization on page 250.
Configuring LDAP Directory Service
SQLFire can authenticate users against an existing LDAP directory service within your enterprise. LDAP
(lightweight directory access protocol) provides an open directory access protocol running over TCP/IP.
An LDAP directory service can quickly authenticate a user's name and password. The runtime library provided
with the Java Development Kit (JDK) includes libraries that allow you to access an LDAP directory service.
See the API documentation for the javax.naming.ldap package at http://download.oracle.com/javase/6/docs/api/;
the LDAP section of the JNDI tutorial at http://download.oracle.com/javase/tutorial/jndi/ldap/; and the LDAP
section of the JNDI specification at
http://download.oracle.com/javase/1.5.0/docs/guide/jndi/spec/jndi/jndi.5.html#pgfId=999241.
Examples of LDAP service providers include the 389 Directory Server and OpenLDAP.
Configure SQLFire to Use Your LDAP Directory Service
When configuring vFabric SQLFire to use LDAP as your authentication service, you must specify which LDAP
server to use.
Procedure
1. Set the auth-provider property to "LDAP" when you start each locator and server in the SQLFire distributed
system.
2. When you set the auth-provider property to "LDAP," SQLFire uses LDAP for authenticating distributed
system members as well as clients to the distributed system. For this reason, SQLFire members must supply
the user option (and optionally, the password option) at startup. If you omit the password option, the SQLFire
member prompts you for a password at the command line.
245
Configuring Authentication and Authorization