1.1

Table Of Contents
Typically, the user knows only a simple user name (for example, the rst part of the DN above, mary). With
SQLFire, you do not need the full DN, because an LDAP client (SQLFire) can go to the directory rst as a guest
or even an anonymous user, search for the full DN, then rebind to the directory using the full DN (and thus
authenticate the user).
SQLFire typically initiates a search for a full DN before binding to the directory using the full DN for user
authentication. SQLFire does not initiate a search in the following cases:
You have set sqlre.auth-ldap-search-lter to sqlre.user.
A user DN has been cached locally for the specic user with the sqlre.user.UserName property.
For more information, see sqlre.auth-ldap-search-lter.
Some systems permit anonymous searches; other require a user DN and password. You can specify a user's DN
and password for the search with the properties listed below. In addition, you can limit the scope of the search
by specifying a lter (denition of the object class for the user) and a base (directory from which to begin the
search) with the properties listed below.
Note: Each of the following properties must be specied as a system property when you boot a SQLFire
peer. For example, when booting a new SQLFire server with sqlf, use the command-line option
-J-Dsqlre.auth-ldap-search-base=searchbase.
sqlre.auth-ldap-search-dn (required if your LDAP provider does not support anonymous binding)
Species the DN with which to bind (authenticate) to the server when searching for user DNs. This parameter
is optional if anonymous access is supported by your server. If specied, this value must be a DN recognized
by the directory service, and it must also have the authority to search for the entries.
If not set, it defaults to an anonymous search using the root DN specied by the sqlre.auth-ldap-search-base
property. For example:
uid=guest,o=example.com
sqlre.auth-ldap-search-pw (optional)
Species the password to use for the guest user congured above to bind to the directory service when looking
up the DN. If not set, it defaults to an anonymous search using the root DN specied by the
sqlre.auth-ldap-search-base property.
myPassword
sqlre.auth-ldap-search-base (required)
Species the root DN of the point in your hierarchy from which to begin a guest search for the user's DN. For
example:
ou=people,o=example.com
By default, SQLFire tries to bind the anonymous user for searching when you congure
sqlre.auth-ldap-search-base. If your LDAP server does not support anonymous binding, also congure
sqlre.auth-ldap-search-dn and sqlre.auth-ldap-search-pw.
When using Netscape Directory Server, set this property to the root DN, the special entry to which access
control does not apply (optional).
To narrow the search, you can specify a user's objectClass.
sqlre.auth-ldap-search-lter (optional)
Set sqlre.auth-ldap-search-lter to a logical expression that species what constitutes a user for your LDAP
directory service. The default value of this property is objectClass=inetOrgPerson. For example:
objectClass=person
243
Configuring Authentication and Authorization