1.1

If you include the token %USERNAME% in the sqlfire.auth-ldap-search-filter definition, then
SQLFire replaces the token with the user name that is being authenticated. If do not provide a search-filter,
then SQLFire uses the default search filter:
(&(objectClass=inetOrgPerson)(uid=%USERNAME%))
If you provide a search filter that does not have the %USERNAME% token, then SQLFire prepends the token to
the default search filter. For example:
(&(<provided_filter>)(objectClass=inetOrgPerson)(uid=%USERNAME%))
Example LDAP Search Configuration
For example, consider the following LDAP search invoked using the OpenLDAP ldapsearch
tool:
ldapsearch -b ou=users,dc=domain,dc=com /* base DN */
-x /* non-SASL plain-text authentication */
-D uid=test,ou=ldapTesting,dc=domain,dc=com /* bind DN
*/
-w test /* bind password */
"(&(objectClass=user)(uid=user1))" /* filter */
To configure this search with SQLFire you would use the properties:
sqlfire.auth-ldap-search-base=ou=users,dc=domain,dc=com
sqlfire.auth-ldap-search-filter=(&(objectClass=user)(uid=%USERNAME%))
sqlfire.auth-ldap-search-dn=uid=test,ou=ldapTesting,dc=domain,dc=com
sqlfire.auth-ldap-search-pw=test
LDAP Restrictions and Performance Guidelines
SQLFire does not support LDAP groups.
For performance reasons, the LDAP directory server should be in the same LAN as SQLFire. SQLFire does not
cache the user's credential information locally and thus must connect to the directory server every time a user
connects.
Connection requests that provide the full DN are faster than those that must search for the full DN.
JNDI-Specific Properties for External Directory Services
SQLFire allows you to set a few advanced JNDI properties, which you can set by any supported means of setting
SQLFire properties. Typically you would set these at the same level (database or system) for which you configured
the external authentication service.
The list of supported properties can be found in Appendix A: JNDI Standard Environment Properties in the Java
Naming and Directory API at http://download.oracle.com/javase/1.5.0/docs/guide/jndi/spec/jndi/properties.html.
The external directory service must support the property.
Each JNDI provider has its set of properties that you can set within the SQLFire system.
For example, you can set the property java.naming.security.authentication to allow user credentials to be encrypted
on the network if the provider supports it. You can also specify that SSL be used with LDAP (LDAPS).
JMX and Authentication
If you use the SQLFire JMX Agent to administer and manage an authentication-enabled distributed system, the
agent must provide security credentials. Security properties cannot be passed to a JMX Agent on the command
line, but they can be supplied at startup by adding the security-specific Java system properties (-D properties).
With the properties specified, the call to Agent.connectToSystem causes the agent to be authenticated with the
distributed system. SQLFire security does not manage RMI clients to the JMX Agent. Once connected, the JMX
vFabric SQLFire User's Guide244
Deploying vFabric SQLFire