Security Configuration

Security Configuration Options

require_authentication

• true - need authentication through username/password or LDAP, no anonymous login
• false - (default)- authentication is allowed, but non-authenticated users will be logged in as anonymous

enable_authorization

• true - enforce authorization permissions
• false - (default)- no restrictions

LDAP Integration

LDAP integration with Kinetica is accomplished through an Apache httpd proxy. This proxy comes packaged with Kinetica and can be found in /opt/gpudb/httpd. OpenLDAP's LDAP server daemon (slapd) is also included in this directory. We have preconfigured httpd to work with this instance of slapd. If you would like to use your enterprise's own LDAP, you just need to modify the /opt/gpudb/httpd/conf/httpd/httpd.conf file's Location section. Since this portion is controlled by Apache httpd, not Kinetica, please see the Apache documentation for further details.

If you will be using the included version OpenLDAP, you must start and initialize this manually using the commands:

sudo /opt/gpudb/httpd/gpudb-openldap.sh start
/opt/gpudb/httpd/openldapopenldap-init.sh

Note: Only run `/opt/gpudb/httpd/openldapopenldap-init.sh` once, the first time openldap is started.

LDAP Users

Once connected to an LDAP server, you can use LDAP users for all Kinetica administration. First you will need to create a user Kinetica user with administrative permissions that is tied to an LDAP user. To do this:

• Log into gadmin with the Kinetica administration account (admin/admin by default). If you have not yet set require_authentication to true, you can leave the username and password blank.
• From the Security menu, select Users
• Click the New button
• For Authentication, select External
• Enter an LDAP username, preceded by "@". This indicates to Kinetica that the user is an external LDAP user
• For System Level Permission, select System Admin

Note: Although you created the user with the username *@<username>*, the user will log in with their regular username, without the "@".