Adding roles for LDAP logins

A role manager assigns a DataStax Enterprise (DSE) role by matching the username provided for authentication with a DSE role name. Create a role for each LDAP user who needs to access the database.

The LDAP username attribute is defined in user_search_filter, such as the UID (Open LDAP) or SamAccountName (Microsoft Active Directory).

Create a login role that matches the username:

CREATE ROLE <`LDAP_USER_ROLE`> WITH LOGIN = true;

Parameter	Description
`LDAP_USER_ROLE`	The username passed from the authenticator to the role manager. The string is exactly as the user entered it at login, including case. Note: SUPERUSER is name of a role that is granted full database access, except on objects with a restricted permission. See Restricting access to data.
LOGIN	REQUIRED. Allows the user basic database access.

Parameter

Description

LDAP_USER_ROLE

The username passed from the authenticator to the role manager. The string is exactly as the user entered it at login, including case.

Note: SUPERUSER is name of a role that is granted full database access, except on objects with a restricted permission. See Restricting access to data.

REQUIRED. Allows the user basic database access.

Do NOT set a password.

Bind the assignment to an authentication scheme:
```
GRANT EXECUTE on LDAP SCHEME to <`LDAP_USER_ROLE`>;
```
This step is required only when enabling scheme_permissions.
To allow another role to manage the new role:
```
GRANT AUTHORIZE FOR ALTER, DROP
ON <new_role_name>
TO <management_role>;
```
All superusers have AUTHORIZE permissions on all roles. The role that creates a role is also granted all permissions on the role.

Next steps

Assign permissions to the role, see Assigning permissions.

Adding roles for LDAP logins

Next steps

Was this helpful?

Give Feedback

Adding roles for LDAP logins

Create and bind a Login role

Next steps

Was this helpful?