1.1

Table Of Contents
Note: This property must be specied either as a Java system property or in the
sqlfire.properties le. For example, when booting a new SQLFire server with sqlf, you
could use the command-line option
-J-Dsqlfire.auth-ldap-server=ldaps://server:port/ to specify the Java system
property.
4. If you use SSL-encrypted LDAP and your LDAP server certicate is not recognized by a valid Certicate
Authority (CA), create a local trust store for each SQLFire member and import the LDAP server certicate
to the trust store. See
http://docs.oracle.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html#CreateKeystore for
more information.
5.
If you performed step 3, include the javax.net.ssl.trustStore and
javax.net.ssl.trustStorePassword system properties when you start individual SQLFire members.
For example:
sqlf server start -dir=./server -locators=localhost[10101]
-client-port=1528 -auth-provider=LDAP \
-J-Dsqlfire.auth-ldap-server=ldaps://ldapserver:636/
-user=user_name -password=user_pwd \
-J-Dsqlfire.auth-ldap-search-dn=uid=sqlfire1,ou=ldapExample,dc=gemstone,dc=com
\
-J-Dsqlfire.auth-ldap-search-pw=sqlfire1 \
-J-Dsqlfire.auth-ldap-search-base=ou=ldapTesting,dc=gemstone,dc=com \
-J-Djavax.net.ssl.trustStore=/Users/yozie/vFabric_SQLFire_11_bNNNNN/keystore_name
\
-J-Djavax.net.ssl.trustStorePassword=keystore_password
Note: javax.net.ssl.trustStore and javax.net.ssl.trustStorePassword must
be specied as Java system properties (using the -J option on the sqlf command line).
Note: LDAP server and search properties must be set to the same value for each member of the SQLFire
distributed system. However, individual SQLFire members can be started using different authenticated
user credentials, trust stores, and so forth.
Guest Access to Search for DNs
In an LDAP system, users are hierarchically organized in the directory as a set of entries. An entry is a set of
name-attribute pairs identied by a unique name, called a DN (distinguished name).
An entry is unambiguously identied by a DN, which is the concatenation of selected attributes from each entry
in the tree along a path leading from the root down to the named entry, ordered from right to left. For example,
a DN for a user might look like this:
cn=mary,ou=People,o=example.com
uid=mary,ou=People,o=example.com
The allowable entries for the name are dened by the entry's objectClass.
An LDAP client can bind to the directory (successfully log in) if it provides a user ID and password. The user
ID must be a DN, the fully qualied list of names and attributes. This means that the user must provide a very
long name.
vFabric SQLFire User's Guide242
Deploying vFabric SQLFire