LDAP

When LDAP is enabled, FairCom DB Server authenticates a supplied username / password (from InitISAMXtd) against the LDAP server itself. By default, FairCom DB doesn't query the server for any other information to be returned, it's simply pass/fail. Note: If the LDAP server becomes unavailable for any reason, users can't be authenticated.

The one exception is when LDAP_ALLOWED_GROUP options are specified. In those cases, FairCom DB additionally authenticates to LDAP with a specific LDAP account provided by the LDAP_APPLICATION_ID option (and passwords specified with LDAP_KEY_STORE) and query and validate group membership for that user. If a user is not allowed in the group, the connection is denied. The optional LDAP_GROUP_CHECK can be used to return and update group membership in FAIRCOM.FCS.

Once a user is authenticated and all group checks are complete, FairCom DB discards all authentication information and disconnects from the LDAP server and there is no further interaction.

Example

FairCom Server provides a set of keywords for configuring the LDAP subsystem:

SUBSYSTEM USER_AUTH LDAP
{
LDAP_SERVER localhost
LDAP_TIMEOUT 10
LDAP_PREFIX cn=
LDAP_BASE ou=people,dc=faircom,dc=com
LDAP_APPLICATION_ID cn=ctreesql,ou=applications,dc=faircom,dc=com
LDAP_ISAM_ALLOWED_GROUP cn=ctreeisamusers,ou=groups,dc=faircom,dc=com
LDAP_SQL_ALLOWED_GROUP cn=ctreesqlusers,ou=groups,dc=faircom,dc=com
LDAP_GROUP_CHECK

{attr:member}{base:ou=groups,dc=faircom,dc=com}{filter:(objectclass=groupOfNames)}
LDAP_PORT 389
LDAP_SSL NO
LDAP_KEY_STORE ldap.fkf
} 

Security

LDAP client authentication requires passing an actual client LDAP password to the FairCom DB server. This requires additional encryption to protect the password in transit. Unique public/private key pairs are generated at runtime and are only used for this one particular connection request.

The encryption algorithm that the client library uses to securely pass the user password to the server when using LDAP authentication was updated in V13 to use an AES-GCM encryption with a random initialization vector (iv).

If a client library that uses AES-GCM for LDAP authentication connects to a server that does not support it, the connection attempt now fails with error code 1179, CLIENT_LOGON_REQUIRES_AES_GCM at the ISAM level, or error -18179 at the SQL level.

If a client library that does not use AES-GCM for LDAP authentication connects to a server that use AES-GCM authentication at the ISAM level, the connection attempt now fails with error code 941 or 1180 (SERVER_LOGON_REQUIRES_AES_GCM), or error code -17941 or -18180 at the SQL level.

Limitations

  • The ADO.NET driver uses AES-CBC with a random iv, since AES-GCM is not supported by the .NET Framework (only .NET Core supports AES-GCM).
  • While the JDBC driver can be compiled with Java 1.7 for backward compatibility, it requires Java 1.8 or later in order to use AES-GCM.

LDAP Keywords

Only LDAP keywords are allowed to be specified inside the SUBSYSTEM USER_AUTH LDAP block of the configuration file. Logic prevents non-LAP keywords from being specified in this block.

The following keywords can be used in the SUBSYSTEM USER_AUTH LDAP block:

General LDAP configuration

LDAP_SERVER

LDAP_PORT

LDAP_TIMEOUT

LDAP_SSL

Site-specific directives

LDAP_PREFIX

LDAP_BASE

Required for group management checks

LDAP_APPLICATION_ID

LDAP_KEY_STORE

LDAP_ISAM_ALLOWED_GROUP

LDAP_SQL_ALLOWED_GROUP

LDAP_GROUP_CHECK

 

ADMIN_USER_GROUP

ADMIN_USER_GROUP <admin_user_name>:<admin_group_name>

Specifies the name of the super administrator user (default ADMIN) and administrator group (default ADMIN). Only members of the specified administrator group can perform some operations with FairCom DB such as shutting down FairCom DB or connecting using the ctadmn utility.

Example

ADMIN_USER_GROUP Administrator:Administrators

See Also

 

GUEST_USER_GROUP

GUEST_USER_GROUP <user:group>

Specifies the name of the guest user (default GUEST) and guest group (default GUEST).

Example

GUEST_USER_GROUP Guest:Guests

See Also

 

LDAP_APPLICATION_ID

When the LDAP_APPLICATION_ID option is used, FairCom DB checks the ISAM and SQL group membership (if those configurations enabled) after authenticating the application ID and before authenticating the user ID. This is done because the user ID might not have been assigned the permissions needed to check group membership. LDAP_GROUP_CHECK is performed in the context of the LDAP application ID. This is consistent with what is done for the LDAP_ISAM_ALLOWED_GROUP and LDAP_SQL_ALLOWED_GROUP options.

When LDAP_APPLICATION_ID is not specified the current user ID is used for lookup.

See also:

LDAP_GROUP_CHECK

 

LDAP_BASE

LDAP_BASE <base>

<base> is appended to the user name when authenticating the user using LDAP. and specifies the base name to use for the group membership search (LDAP_ISAM_ALLOWED_GROUP and LDAP_SQL_ALLOWED_GROUP configurations).

Example

LDAP_BASE DC=MyDomain,DC=local

With LDAP_BASE dc=mycompany, dc=com, and LDAP_PREFIX cn= in ctsrvr.cfg, then FairCom DB authenticates the user name MYUSERNAME as: cn=MYUSERNAME;dc=mycompany,dc=com

See Also

LDAP_SERVER

LDAP_TIMEOUT

ADMIN_USER_GROUP

GUEST_USER_GROUP

LOGIN_ALLOWED_GROUP

 

LDAP_GROUP_CHECK

LDAP_GROUP_CHECK {attr:<ATTRIBUTE>}{base:<BASE>}{filter:<FILTER>}

Where:

  • <ATTRIBUTE> is the group attribute to be checked (for example attr:member)
  • <BASE> is the LDAP base for the group membership search
  • <FILTER> is the LDAP filter for the group membership search

FairCom Server V11.5 and later are able to update the c-tree group membership records in FAIRCOM.FCS at logon. Because SQL permissions use the current group membership for a user account as stored in FAIRCOM.FCS, this ability makes it possible for SQL permissions to act on the current LDAP group membership for a user account that is authenticated using LDAP.

To use this feature, add this option in the SUBSYSTEM USER_AUTH LDAP block in ctsrvr.cfg.

Any errors encountered are logged to CTSTATUS.FCS.

Example 1:

The file faircom.ldif contains these domain, user, and group definitions:


# Domain

dn: dc=faircom,dc=com
objectClass: domain
objectClass: top
dc: faircom

# People

dn: ou=people,dc=faircom,dc=com
objectclass: top
objectclass: organizationalUnit
ou: people
description: Container for user entries

dn: cn=user1,ou=people,dc=faircom,dc=com
cn: user1
objectClass: person
sn: user1

dn: cn=user2,ou=people,dc=faircom,dc=com
cn: user2
objectClass: person
sn: user2

dn: cn=user3,ou=people,dc=faircom,dc=com
cn: user3
objectClass: person
sn: user3

dn: cn=user4,ou=people,dc=faircom,dc=com
cn: user4
objectClass: person
sn: user4

dn: cn=user5,ou=people,dc=faircom,dc=com
cn: user5
objectClass: person
sn: user5

# Groups

dn: ou=groups,dc=faircom,dc=com
objectClass: organizationalUnit
ou: groups
description: Container for group entries

dn: cn=dev,ou=groups,dc=faircom,dc=com
objectClass: groupOfNames
cn: dev
description: Research and Development group
member: cn=user2,ou=people,dc=faircom,dc=com
member: cn=user3,ou=people,dc=faircom,dc=com

dn: cn=support,ou=groups,dc=faircom,dc=com
objectClass: groupOfNames
cn: support
description: Technical Support group
member: cn=user1,ou=people,dc=faircom,dc=com
member: cn=user2,ou=people,dc=faircom,dc=com
member: cn=user3,ou=people,dc=faircom,dc=com

dn: cn=qa,ou=groups,dc=faircom,dc=com
objectClass: groupOfNames
cn: qa
description: Product Testing group
member: cn=user1,ou=people,dc=faircom,dc=com
member: cn=user2,ou=people,dc=faircom,dc=com
member: cn=user3,ou=people,dc=faircom,dc=com

dn: cn=it,ou=groups,dc=faircom,dc=com
objectClass: groupOfNames
cn: it
description: Information Technology group
member: cn=user4,ou=people,dc=faircom,dc=com
member: cn=user5,ou=people,dc=faircom,dc=com

dn: cn=ctreeisamusers,ou=groups,dc=faircom,dc=com
objectClass: groupOfNames
cn: ctreeisamusers
description: c-tree ISAM Users
member: cn=user1,ou=people,dc=faircom,dc=com
member: cn=user2,ou=people,dc=faircom,dc=com
member: cn=user3,ou=people,dc=faircom,dc=com
member: cn=user4,ou=people,dc=faircom,dc=com
member: cn=user5,ou=people,dc=faircom,dc=com

dn: cn=ctreesqlusers,ou=groups,dc=faircom,dc=com
objectClass: groupOfNames
cn: ctreesqlusers
description: c-tree SQL Users
member: cn=user1,ou=people,dc=faircom,dc=com
member: cn=user2,ou=people,dc=faircom,dc=com
member: cn=user3,ou=people,dc=faircom,dc=com
member: cn=user4,ou=people,dc=faircom,dc=com
member: cn=user5,ou=people,dc=faircom,dc=com

# Applications

dn: ou=applications,dc=faircom,dc=com
objectclass: top
objectclass: organizationalUnit
ou: applications
description: Container for application entries

dn: cn=ctreesql,ou=applications,dc=faircom,dc=com
cn: ctreesql
objectClass: person
sn: ctreesql

Example 2:

The following LDAP configuration options in ctsrvr.cfg require LDAP authentication using an application ID of ctreesql, allow ISAM logons only from members of the ctreeisamusers group, allow SQL logons only from members of the ctreesqlusers group, and update the c-tree group definitions for a particular user ID at logon time based on that user ID's current LDAP group membership:


SUBSYSTEM USER_AUTH LDAP
{
 LDAP_SERVER   localhost
 LDAP_TIMEOUT   10
 LDAP_PREFIX   cn=
 LDAP_BASE   ou=people,dc=faircom,dc=com
 LDAP_APPLICATION_ID  cn=ctreesql,ou=applications,dc=faircom,dc=com
 LDAP_ISAM_ALLOWED_GROUP cn=ctreeisamusers,ou=groups,dc=faircom,dc=com
 LDAP_SQL_ALLOWED_GROUP cn=ctreesqlusers,ou=groups,dc=faircom,dc=com
 LDAP_GROUP_CHECK  {attr:member}{base:ou=groups,dc=faircom,dc=com}{filter:(objectclass=groupOfNames)}
 LDAP_PORT   389
 LDAP_SSL   NO
 LDAP_KEY_STORE  ldap.fkf
}

When user3 successfully connects to c-tree Server, the user3 user account and groups to which user3 belongs are added to FAIRCOM.FCS:

     User Id  User Description (Groups)
------------  ------------------------------------
       ADMIN  ( ADMIN )
       USER3  ( CTREEISAMUSERS CTREESQLUSERS DEV QA SUPPORT )

Now it is possible to create a SQL table and grant permission to user3 through a group to which user3 belongs. For example:

As ADMIN:

create table t(ch char(5));
insert into t values ('abc');
commit;

As user3:

select * from t;
error(-20228): Access denied(Authorisation failed)

As ADMIN:

grant select on admin.t to dev;
commit;

As user3:

select * from t;
CH
--
abc
1 record selected

Perform LDAP_GROUP_CHECK in Context of LDAP Application ID

The check for group membership, configured by the LDAP_GROUP_CHECK option, was done in the context of the user account that was logging on. However, the user account might not have permission to query its LDAP groups.

The logic has been enhanced so that, if an LDAP application is specified (by specifying the LDAP_APPLICATION_ID option in the SUBSYSTEM USER_AUTH LDAP block in ctsrvr.cfg), it now performs the LDAP_GROUP_CHECK in the context of the LDAP application ID. This is consistent with what is done for the LDAP_ISAM_ALLOWED_GROUP and LDAP_SQL_ALLOWED_GROUP options.

When LDAP_APPLICATION_ID is specified, you MUST also use LDAP_KEY_STORE to specify an application password, otherwise the application authentication will fail.

Note When LDAP_APPLICATION_ID is not specified the logic behaves as before, using the current user ID for lookup.

See also:

LDAP_APPLICATION_ID

 

LDAP_ISAM_ALLOWED_GROUP & LDAP_SQL_ALLOWED_GROUP

In V11 and later, FairCom Server's ability to check LDAP group membership has been improved. Previously, part of the filter was hard-coded. Now, the entire filter can be specified in the configuration file. Additionally, the attribute is no longer hard-coded; now it can be specified in the configuration file.

To use the new functionality, specify the following syntax for the LDAP_ISAM_ALLOWED_GROUP and/or LDAP_SQL_ALLOWED_GROUP options:


LDAP_ISAM_ALLOWED_GROUP {attr:ATTRIBUTE_VALUE}{base:BASE_VALUE}{filter:FILTER_VALUE}
 

For example:


LDAP_ISAM_ALLOWED_GROUP {attr:member}{base:dc=mycompany,dc=com}{filter:(&(objectClass=groupOfNames)(cn=myusergroup))}

 

LDAP_KEY_STORE

LDAP_KEY_STORE <key_store_file>

This option is used in conjunction with the LDAP_APPLICATION_ID keyword. <key_store_file> is the name of an encrypted store file created using the ctcpvf utility. The encrypted store file contains the application ID password (that is, the password that c-tree Server will use when authenticating the user name <application_id> with LDAP).

See Also:

 

LDAP_LOCAL_PREFIX

LDAP_LOCAL_PREFIX <prefix>

When LDAP_SERVER is enabled, all non-admin users authenticate using LDAP. The LDAP_LOCAL_PREFIX <prefix> keyword allows filtering certain users to use local c-tree authentication if their user name begins with <prefix>. This prefix comparison is case-insensitive.

Note If the user account existed prior to this V12 change, local authentication may fail with LDRQ_ERR (985) or SQL error (-17985): CT - Logon is denied because this user account requires LDAP authentication, but c-tree Server has not enabled LDAP authentication. If this occurs, the user account will need to be deleted and re-created.

 

LDAP_MODULE

LDAP_MODULE <module_name>

<module_name> specifies the LDAP shared library to load. The default value is libldap.so. On Solaris, libldap.so is the native LDAP library, so this should be used to specify the name of the OpenLDAP version of libldap.so.

LDAP_MODULE is not supported on windows.

Example

LDAP_MODULE libldap.so

 

LDAP_PORT

LDAP_PORT <port>

Specifies the port to use when connecting to the LDAP server. The default is to use the standard LDAP port: 389 for non-SSL connections, and 636 for SSL connections (which is enabled by specifying LDAP_SSL YES in ctsrvr.cfg).

 

LDAP_PREFIX

LDAP_PREFIX <prefix>
  • <prefix> is a string to prepend to the user name that is passed to LDAP.

For example, if you specify LDAP_BASE dc=mycompany, dc=com, and LDAP_PREFIX cn= in ctsrvr.cfg, then c-tree Server authenticates the user name MYUSERNAME as:

cn=MYUSERNAME,dc=mycompany,dc=com

 

LDAP_SERVER

LDAP_SERVER  <ldap_host_name>:<ldap_port>

Specifies the host name and port of an LDAP server for authentication.

Example

LDAP_SERVER 192.168.0.15:389

See Also

 

LDAP_SSL

LDAP_SSL YES | NO

If YES is specified, c-tree Server uses SSL when connecting to the LDAP server. The default is NO.

 

LDAP_TIMEOUT

LDAP_TIMEOUT <timeout>

Specifies an LDAP server connection timeout in seconds (default is 60).

Example

LDAP_TIMEOUT 30

See Also

 

LOGIN_ALLOWED_GROUP

LOGIN_ALLOWED_GROUP <group>

When this keyword is specified, only users who are members of the specified group are allowed to connect to the FairCom Server. The FairCom Server returns error LGRP_ERR when a user who is not a member of the specified group attempts to connect to the FairCom Server. If the keyword is not specified, any user who can be authenticated using the specified LDAP server is permitted to connect to the FairCom Server.

Example

LOGIN_ALLOWED_GROUP c-treeUsers

See Also