When LDAP is enabled, FairCom DB Server authenticates a supplied username / password (from InitISAMXtd) against the LDAP server itself. By default, FairCom DB doesn't query the server for any other information to be returned, it's simply pass/fail. Note: If the LDAP server becomes unavailable for any reason, users can't be authenticated.
The one exception is when LDAP_ALLOWED_GROUP options are specified. In those cases, FairCom DB additionally authenticates to LDAP with a specific LDAP account provided by the LDAP_APPLICATION_ID option (and passwords specified with LDAP_KEY_STORE) and query and validate group membership for that user. If a user is not allowed in the group, the connection is denied. The optional LDAP_GROUP_CHECK can be used to return and update group membership in FAIRCOM.FCS.
Once a user is authenticated and all group checks are complete, FairCom DB discards all authentication information and disconnects from the LDAP server and there is no further interaction.
Example
FairCom Server provides a set of keywords for configuring the LDAP subsystem:
SUBSYSTEM USER_AUTH LDAP
{
LDAP_SERVER localhost
LDAP_TIMEOUT 10
LDAP_PREFIX cn=
LDAP_BASE ou=people,dc=faircom,dc=com
LDAP_APPLICATION_ID cn=ctreesql,ou=applications,dc=faircom,dc=com
LDAP_ISAM_ALLOWED_GROUP cn=ctreeisamusers,ou=groups,dc=faircom,dc=com
LDAP_SQL_ALLOWED_GROUP cn=ctreesqlusers,ou=groups,dc=faircom,dc=com
LDAP_GROUP_CHECK
{attr:member}{base:ou=groups,dc=faircom,dc=com}{filter:(objectclass=groupOfNames)}
LDAP_PORT 389
LDAP_SSL NO
LDAP_KEY_STORE ldap.fkf
}
Security
LDAP client authentication requires passing an actual client LDAP password to the FairCom DB server. This requires additional encryption to protect the password in transit. Unique public/private key pairs are generated at runtime and are only used for this one particular connection request.
The encryption algorithm that the client library uses to securely pass the user password to the server when using LDAP authentication was updated in V13 to use an AES-GCM encryption with a random initialization vector (iv).
If a client library that uses AES-GCM for LDAP authentication connects to a server that does not support it, the connection attempt now fails with error code 1179, CLIENT_LOGON_REQUIRES_AES_GCM at the ISAM level, or error -18179 at the SQL level.
If a client library that does not use AES-GCM for LDAP authentication connects to a server that use AES-GCM authentication at the ISAM level, the connection attempt now fails with error code 941 or 1180 (SERVER_LOGON_REQUIRES_AES_GCM), or error code -17941 or -18180 at the SQL level.
Limitations
- The ADO.NET driver uses AES-CBC with a random iv, since AES-GCM is not supported by the .NET Framework (only .NET Core supports AES-GCM).
- While the JDBC driver can be compiled with Java 1.7 for backward compatibility, it requires Java 1.8 or later in order to use AES-GCM.
LDAP Keywords
Only LDAP keywords are allowed to be specified inside the SUBSYSTEM USER_AUTH LDAP block of the configuration file. Logic prevents non-LAP keywords from being specified in this block.
The following keywords can be used in the SUBSYSTEM USER_AUTH LDAP block:
General LDAP configuration
Site-specific directives
Required for group management checks
ADMIN_USER_GROUP
ADMIN_USER_GROUP <admin_user_name>:<admin_group_name>Specifies the name of the super administrator user (default ADMIN) and administrator group (default ADMIN). Only members of the specified administrator group can perform some operations with FairCom DB such as shutting down FairCom DB or connecting using the ctadmn utility.
Example
ADMIN_USER_GROUP Administrator:AdministratorsSee Also
GUEST_USER_GROUP
GUEST_USER_GROUP <user:group>Specifies the name of the guest user (default GUEST) and guest group (default GUEST).
Example
GUEST_USER_GROUP Guest:GuestsSee Also
LDAP_APPLICATION_ID
When the LDAP_APPLICATION_ID option is used, FairCom DB checks the ISAM and SQL group membership (if those configurations enabled) after authenticating the application ID and before authenticating the user ID. This is done because the user ID might not have been assigned the permissions needed to check group membership. LDAP_GROUP_CHECK is performed in the context of the LDAP application ID. This is consistent with what is done for the LDAP_ISAM_ALLOWED_GROUP and LDAP_SQL_ALLOWED_GROUP options.
When LDAP_APPLICATION_ID is not specified the current user ID is used for lookup.
See also:
LDAP_BASE
LDAP_BASE <base><base> is appended to the user name when authenticating the user using LDAP. and specifies the base name to use for the group membership search (LDAP_ISAM_ALLOWED_GROUP and LDAP_SQL_ALLOWED_GROUP configurations).
Example
LDAP_BASE DC=MyDomain,DC=localWith LDAP_BASE dc=mycompany, dc=com, and LDAP_PREFIX cn= in ctsrvr.cfg, then FairCom DB authenticates the user name MYUSERNAME as: cn=MYUSERNAME;dc=mycompany,dc=com
See Also
LDAP_GROUP_CHECK
LDAP_GROUP_CHECK {attr:<ATTRIBUTE>}{base:<BASE>}{filter:<FILTER>}Where:
-
<ATTRIBUTE>is the group attribute to be checked (for exampleattr:member) -
<BASE>is the LDAP base for the group membership search -
<FILTER>is the LDAP filter for the group membership search
FairCom Server V11.5 and later are able to update the c-tree group membership records in FAIRCOM.FCS at logon. Because SQL permissions use the current group membership for a user account as stored in FAIRCOM.FCS, this ability makes it possible for SQL permissions to act on the current LDAP group membership for a user account that is authenticated using LDAP.
To use this feature, add this option in the SUBSYSTEM USER_AUTH LDAP block in ctsrvr.cfg.
Any errors encountered are logged to CTSTATUS.FCS.
Example 1:
The file faircom.ldif contains these domain, user, and group definitions:
# Domain
dn: dc=faircom,dc=com
objectClass: domain
objectClass: top
dc: faircom
# People
dn: ou=people,dc=faircom,dc=com
objectclass: top
objectclass: organizationalUnit
ou: people
description: Container for user entries
dn: cn=user1,ou=people,dc=faircom,dc=com
cn: user1
objectClass: person
sn: user1
dn: cn=user2,ou=people,dc=faircom,dc=com
cn: user2
objectClass: person
sn: user2
dn: cn=user3,ou=people,dc=faircom,dc=com
cn: user3
objectClass: person
sn: user3
dn: cn=user4,ou=people,dc=faircom,dc=com
cn: user4
objectClass: person
sn: user4
dn: cn=user5,ou=people,dc=faircom,dc=com
cn: user5
objectClass: person
sn: user5
# Groups
dn: ou=groups,dc=faircom,dc=com
objectClass: organizationalUnit
ou: groups
description: Container for group entries
dn: cn=dev,ou=groups,dc=faircom,dc=com
objectClass: groupOfNames
cn: dev
description: Research and Development group
member: cn=user2,ou=people,dc=faircom,dc=com
member: cn=user3,ou=people,dc=faircom,dc=com
dn: cn=support,ou=groups,dc=faircom,dc=com
objectClass: groupOfNames
cn: support
description: Technical Support group
member: cn=user1,ou=people,dc=faircom,dc=com
member: cn=user2,ou=people,dc=faircom,dc=com
member: cn=user3,ou=people,dc=faircom,dc=com
dn: cn=qa,ou=groups,dc=faircom,dc=com
objectClass: groupOfNames
cn: qa
description: Product Testing group
member: cn=user1,ou=people,dc=faircom,dc=com
member: cn=user2,ou=people,dc=faircom,dc=com
member: cn=user3,ou=people,dc=faircom,dc=com
dn: cn=it,ou=groups,dc=faircom,dc=com
objectClass: groupOfNames
cn: it
description: Information Technology group
member: cn=user4,ou=people,dc=faircom,dc=com
member: cn=user5,ou=people,dc=faircom,dc=com
dn: cn=ctreeisamusers,ou=groups,dc=faircom,dc=com
objectClass: groupOfNames
cn: ctreeisamusers
description: c-tree ISAM Users
member: cn=user1,ou=people,dc=faircom,dc=com
member: cn=user2,ou=people,dc=faircom,dc=com
member: cn=user3,ou=people,dc=faircom,dc=com
member: cn=user4,ou=people,dc=faircom,dc=com
member: cn=user5,ou=people,dc=faircom,dc=com
dn: cn=ctreesqlusers,ou=groups,dc=faircom,dc=com
objectClass: groupOfNames
cn: ctreesqlusers
description: c-tree SQL Users
member: cn=user1,ou=people,dc=faircom,dc=com
member: cn=user2,ou=people,dc=faircom,dc=com
member: cn=user3,ou=people,dc=faircom,dc=com
member: cn=user4,ou=people,dc=faircom,dc=com
member: cn=user5,ou=people,dc=faircom,dc=com
# Applications
dn: ou=applications,dc=faircom,dc=com
objectclass: top
objectclass: organizationalUnit
ou: applications
description: Container for application entries
dn: cn=ctreesql,ou=applications,dc=faircom,dc=com
cn: ctreesql
objectClass: person
sn: ctreesql
Example 2:
The following LDAP configuration options in ctsrvr.cfg require LDAP authentication using an application ID of ctreesql, allow ISAM logons only from members of the ctreeisamusers group, allow SQL logons only from members of the ctreesqlusers group, and update the c-tree group definitions for a particular user ID at logon time based on that user ID's current LDAP group membership:
SUBSYSTEM USER_AUTH LDAP
{
LDAP_SERVER localhost
LDAP_TIMEOUT 10
LDAP_PREFIX cn=
LDAP_BASE ou=people,dc=faircom,dc=com
LDAP_APPLICATION_ID cn=ctreesql,ou=applications,dc=faircom,dc=com
LDAP_ISAM_ALLOWED_GROUP cn=ctreeisamusers,ou=groups,dc=faircom,dc=com
LDAP_SQL_ALLOWED_GROUP cn=ctreesqlusers,ou=groups,dc=faircom,dc=com
LDAP_GROUP_CHECK {attr:member}{base:ou=groups,dc=faircom,dc=com}{filter:(objectclass=groupOfNames)}
LDAP_PORT 389
LDAP_SSL NO
LDAP_KEY_STORE ldap.fkf
}
When user3 successfully connects to c-tree Server, the user3 user account and groups to which user3 belongs are added to FAIRCOM.FCS:
User Id User Description (Groups)
------------ ------------------------------------
ADMIN ( ADMIN )
USER3 ( CTREEISAMUSERS CTREESQLUSERS DEV QA SUPPORT )Now it is possible to create a SQL table and grant permission to user3 through a group to which user3 belongs. For example:
As ADMIN:
create table t(ch char(5));
insert into t values ('abc');
commit;
As user3:
select * from t;
error(-20228): Access denied(Authorisation failed)
As ADMIN:
grant select on admin.t to dev;
commit;
As user3:
select * from t;
CH
--
abc
1 record selected
Perform LDAP_GROUP_CHECK in Context of LDAP Application IDThe check for group membership, configured by the LDAP_GROUP_CHECK option, was done in the context of the user account that was logging on. However, the user account might not have permission to query its LDAP groups.
The logic has been enhanced so that, if an LDAP application is specified (by specifying the LDAP_APPLICATION_ID option in the SUBSYSTEM USER_AUTH LDAP block in ctsrvr.cfg), it now performs the LDAP_GROUP_CHECK in the context of the LDAP application ID. This is consistent with what is done for the LDAP_ISAM_ALLOWED_GROUP and LDAP_SQL_ALLOWED_GROUP options.
When LDAP_APPLICATION_ID is specified, you MUST also use LDAP_KEY_STORE to specify an application password, otherwise the application authentication will fail.
Note When
LDAP_APPLICATION_IDis not specified the logic behaves as before, using the current user ID for lookup.
See also:
LDAP_ISAM_ALLOWED_GROUP & LDAP_SQL_ALLOWED_GROUP
In V11 and later, FairCom Server's ability to check LDAP group membership has been improved. Previously, part of the filter was hard-coded. Now, the entire filter can be specified in the configuration file. Additionally, the attribute is no longer hard-coded; now it can be specified in the configuration file.
To use the new functionality, specify the following syntax for the LDAP_ISAM_ALLOWED_GROUP and/or LDAP_SQL_ALLOWED_GROUP options:
LDAP_ISAM_ALLOWED_GROUP {attr:ATTRIBUTE_VALUE}{base:BASE_VALUE}{filter:FILTER_VALUE}
For example:
LDAP_ISAM_ALLOWED_GROUP {attr:member}{base:dc=mycompany,dc=com}{filter:(&(objectClass=groupOfNames)(cn=myusergroup))}
LDAP_KEY_STORE
LDAP_KEY_STORE <key_store_file>This option is used in conjunction with the LDAP_APPLICATION_ID keyword. <key_store_file> is the name of an encrypted store file created using the ctcpvf utility. The encrypted store file contains the application ID password (that is, the password that c-tree Server will use when authenticating the user name <application_id> with LDAP).
See Also:
LDAP_LOCAL_PREFIX
LDAP_LOCAL_PREFIX <prefix>When LDAP_SERVER is enabled, all non-admin users authenticate using LDAP. The LDAP_LOCAL_PREFIX <prefix> keyword allows filtering certain users to use local c-tree authentication if their user name begins with <prefix>. This prefix comparison is case-insensitive.
Note If the user account existed prior to this V12 change, local authentication may fail with
LDRQ_ERR(985) or SQL error (-17985): CT - Logon is denied because this user account requires LDAP authentication, but c-tree Server has not enabled LDAP authentication. If this occurs, the user account will need to be deleted and re-created.
LDAP_MODULE
LDAP_MODULE <module_name><module_name> specifies the LDAP shared library to load. The default value is libldap.so. On Solaris, libldap.so is the native LDAP library, so this should be used to specify the name of the OpenLDAP version of libldap.so.
LDAP_MODULE is not supported on windows.
Example
LDAP_MODULE libldap.so
LDAP_PORT
LDAP_PORT <port>Specifies the port to use when connecting to the LDAP server. The default is to use the standard LDAP port: 389 for non-SSL connections, and 636 for SSL connections (which is enabled by specifying LDAP_SSL YES in ctsrvr.cfg).
LDAP_PREFIX
LDAP_PREFIX <prefix>-
<prefix>is a string to prepend to the user name that is passed to LDAP.
For example, if you specify LDAP_BASE dc=mycompany, dc=com, and LDAP_PREFIX cn= in ctsrvr.cfg, then c-tree Server authenticates the user name MYUSERNAME as:
cn=MYUSERNAME,dc=mycompany,dc=com
LDAP_SERVER
LDAP_SERVER <ldap_host_name>:<ldap_port>Specifies the host name and port of an LDAP server for authentication.
Example
LDAP_SERVER 192.168.0.15:389See Also
LDAP_SSL
LDAP_SSL YES | NOIf YES is specified, c-tree Server uses SSL when connecting to the LDAP server. The default is NO.
LDAP_TIMEOUT
LDAP_TIMEOUT <timeout>Specifies an LDAP server connection timeout in seconds (default is 60).
Example
LDAP_TIMEOUT 30See Also
LOGIN_ALLOWED_GROUP
LOGIN_ALLOWED_GROUP <group>When this keyword is specified, only users who are members of the specified group are allowed to connect to the FairCom Server. The FairCom Server returns error LGRP_ERR when a user who is not a member of the specified group attempts to connect to the FairCom Server. If the keyword is not specified, any user who can be authenticated using the specified LDAP server is permitted to connect to the FairCom Server.
Example
LOGIN_ALLOWED_GROUP c-treeUsersSee Also