Project: YugabyteDB (App Definition and Development / Database)
File: ldap-authentication-ycql.md

title: LDAP authentication in YCQL headerTitle: LDAP authentication in YCQL linkTitle: LDAP authentication description: Configuring YugabyteDB to use an external LDAP authentication service using YCQL. menu: v2.18: identifier: ldap-authentication-2-ycql parent: authentication weight: 732 type: docs <ul class="nav nav-tabs-alt nav-tabs-yb"> <li > <a href="../ldap-authentication-ysql/" class="nav-link"> <i class="icon-postgres" aria-hidden="true"></i> YSQL </a> </li> <li > <a href="../ldap-authentication-ycql/" class="nav-link active"> <i class="icon-cassandra" aria-hidden="true"></i> YCQL </a> </li> </ul> The LDAP authentication method is similar to the password method, except that it uses LDAP to verify the password. Therefore, before LDAP can be used for authentication, the user must already exist in the database (and have appropriate permissions). LDAP Authentication for YCQL can be enabled in the YugabyteDB cluster by setting the LDAP configuration with a set of TServer gflags. YugabyteDB supports two modes for LDAP authentication for YCQL (described in detail below): simple-bind* mode search+bind* mode A prerequisite to using LDAP for YCQL is that the `usecassandraauthentication` flag should be set to true. A set of configuration gflags common to both modes are - | T-Server Gflag name | Default value | Description | | : | : | :- | | `ycqluseldap` | false | Enable LDAP for YCQL | | `ycqlldapuserstoskipcsv` | (empty) | Comma-separated list of users that are authenticated via the local password mechanism even if `ycqluse_ldap` is true. | | `ycqlldapserver` | (empty) | LDAP server endpoint of the form scheme://ip:port. Scheme can be `ldap` (or) `ldaps`. | | `ycqlldaptls` | false | (Not yet supported) Connect to LDAP server using TLS encryption | In simple-bind mode, YB-TServer will bind to the Distinguished Name ("DN") constructed with "prefix username suffix" format. Here is an example for Simple bind mode: ```sh --usecassandraauthentication=true --ycqluseldap=true --ycqlldapserver=ldap://ldap.yugabyte.com:389 --ycqlldapuserprefix=uid= --ycqlldapusersuffix=, ou=DBAs, dc=example, dc=com --ycqlldapuserstoskip_csv=cassandra ``` The configuration specific to simple bind mode. | T-Server Gflag name | Default value | Description | | : | : | :- | | `ycqlldapuser_prefix` | (empty) | String to prepend to the user name when forming the DN for binding to the LDAP server | | `ycqlldapuser_suffix` | (empty) | String to append to the user name when forming the DN for binding to the LDAP server | In `Search + Bind` mode, YB-Tserver will bind to the LDAP directory with a fixed username and password, specified with `ycqlldapbinddn` and `ycqlldapbindpasswd`, and performs a search for the user trying to log in to the database. This mode is commonly used by LDAP authentication schemes in other software. For Searching the LDAP directory if no fixed username and password is configured at YB-TServer, an anonymous bind will be attempted to the

The search will be performed over the subtree at `ycqlldapbasedn`, and will try to do an exact match of the attribute specified in `ycqlldapsearchattribute`. After the user has been found in this search, the server disconnects and re-binds to the directory as this user, using the password specified by the client, to verify that the login is correct. Here is an example for search + bind mode: ```sh --usecassandraauthentication=true --ycqluseldap=true --ycqlldapserver=ldap://ldap.yugabyte.com:389 --ycqlldapbasedn="dc=yugabyte, dc=com" --ycqlldapbinddn="cn=admin,dc=example,dc=org" --ycqlldapbindpasswd=admin --ycqlldapsearchattribute=uid ``` The configurations supported for search + bind mode. | T-Server Gflag name | Default value | Description | | : | : | :- | | `ycqlldapbase_dn` | (empty) | Base directory to begin the user name search | | `ycqlldapbind_dn` | (empty) | Username to perform the initial search when doing search + bind authentication | | `ycqlldapbind_passwd` | (empty) | Password for the username being used to perform the initial search when doing search + bind authentication | | `ycqlldapsearch_attribute` | `uid` attribute | Attribute to match against the username in the search when doing search + bind authentication. If no attribute is specified, the `uid` attribute is used. | | `ycqlldapsearch_filter` | (empty) | Search filter to use when doing search + bind authentication | To use LDAP password authentication on a new YugabyteDB cluster, follow these steps: Use TServer gflags to enable LDAP authentication on YB-TServer in simple bind mode. Use the below configuration to start a YugabyteDB cluster. ```sh --usecassandraauthentication=true --ycqluseldap=true --ycqlldapserver=ldap://ldap.forumsys.com:389 --ycqlldapuserprefix=uid= --ycqlldapusersuffix=, dc=example, dc=com --ycqlldapuserstoskip_csv=cassandra ``` {{< note title="Note" >}} In the above sample configuration, we are using an for setting up the LDAP authentication with YugabyteDB. {{< /note >}} The `--ycqlldapuserstoskip_csv=cassandra` gflag allows access to the user `cassandra` with password authentication. This allows the administrator to log in for setting up the roles (and permissions) for the LDAP users. Start the YugabyteDB cluster. Open the YCQL shell (ycqlsh), specifying the `cassandra` user and prompting for the password. ```sh $ ./ycqlsh -u cassandra ``` When prompted for the password, enter `cassandra` (default password of `cassandra` user). You should be able to log in and see a response similar to the following: ```output Connected to local cluster at 127.0.0.1:9042. [ycqlsh 5.0.1 | Cassandra 3.9-SNAPSHOT | CQL spec 3.4.2 | Native protocol v4] Use HELP for help. cassandra@ycqlsh> ``` Configure database role(s) for the LDAP user(s). We are creating a `ROLE` for username `riemann` supported by the test LDAP server. ```sql cassandra@ycqlsh> create role riemann with login=true; ``` Connect using LDAP authentication. Connect ycqlsh using the `riemann` LDAP user and password specified in the page. ```sh $ ./ycqlsh -u riemann ``` ```output Connected to local cluster at 127.0.0.1:9042. [ycqlsh 5.0.1 | Cassandra 3.9-SNAPSHOT | CQL spec 3.4.2 | Native protocol v4] Use HELP for help. riemann@ycqlsh>```