Add roles for LDAP groups

When using LDAP authentication with LDAP role management, Hyper-Converged Database (HCD) assigns the user all the roles that match the LDAP groups of which they are a member. At least one HCD role must have login privileges.

For more information about restricting access to data, see Restrict access to data.

LOGIN: At least one group the user belongs to must have login privileges that allow the user to execute requests.

Create a role in HCD that matches the exact name of the LDAP group:
```
CREATE ROLE GROUP_NAME WITH LOGIN = true;
```
Replace GROUP_NAME with the name of the LDAP group. The role name must match the cn or group attribute returned by your LDAP server exactly, including case.
Grant permissions to the group role:
```
GRANT SELECT, MODIFY ON KEYSPACE KEYSPACE_NAME TO GROUP_NAME;
```
Replace the following:
- KEYSPACE_NAME: The keyspace to which you are granting access.
- GROUP_NAME: The name of the LDAP group role.
  
  For more information, see About Role Based Access Control (RBAC).
Authenticate as an LDAP group member. When an LDAP user who belongs to the group logs in, HCD retrieves their group memberships from LDAP and automatically maps them to the matching database roles:
```
cqlsh -u LDAP_USERNAME -p LDAP_PASSWORD
```
Replace the following:
- LDAP_USERNAME: The username of the LDAP user.
- LDAP_PASSWORD: The LDAP password for that user.

Add roles for LDAP groups

Was this helpful?

Give Feedback