Authentication Scheme Resources
When using multiple authentication schemes, there can be overlap between users and groups. For example, an internal login role admin and an LDAP group admin. For each role, you can bind the role to an authentication scheme preventing roles from being assigned to the wrong users.
Restriction: Only applies when the authentication_options scheme_permissions in the dse.yaml is set to x fv.
The location of the dse.yaml file depends on the type of installation:
-
Package installations:
/etc/dse/dse.yaml -
Tarball installations:
<installation_location>/resources/dse/conf/dse.yaml
Schemes hierarchy:
Synopsis
- ALL AUTHENTICATION SCHEMES
-
Allows role to be assigned to users who authenticated against any scheme.
GRANT EXECUTE ON ALL AUTHENTICATION SCHEMES TO <role_name>; - LDAP SCHEME | KERBEROS SCHEME | INTERNAL SCHEME
-
Only assigns role to user if they authenticated against the specified scheme:
GRANT EXECUTE ON (LDAP SCHEME | KERBEROS SCHEME | INTERNAL SCHEME) TO <role_name>;
Permission matrix
| Permission | Resource | Description |
|---|---|---|
EXECUTE |
ALL AUTHENTICATION SCHEMES |
Assign role to user from any scheme. |
LDAP SCHEME |
Assign role to only LDAP users. |
|
KERBEROS SCHEME |
Assign role to only Kerberos principals. |
|
INTERNAL SCHEME |
Assign role to only internally authenticated login roles. |
