KB46043: How to setup Teradata database server to authenticate against LDAP and setup warehouse pass-through on MicroStrategy Intelligence Server when using LDAP authentication

If the Teradata Server is configured to use the external LDAP directory server for authentication, Strategy users can take advantage of the Teradata-LDAP integration. The users can authenticate against Strategy using LDAP authentication, and then pass-though the same credentials for authentication when connecting to the database during report execution. Steps to establish this setup are explained in this document.
 
Setup on Teradata
The following steps need to be implemented on the Teradata database server to establish communication with the LDAP Server for authentication. Administrators should note that the following steps have been provided as a rough guideline for the setup. For specific implementation details, Teradata Support should be contacted.
 
Note: The steps provided below will only work for Active Directory as the LDAP Server and will not work for other LDAP Servers such as Sun, Novell, etc.

1. The LDAP Server's IP address and name should be added to the hosts file of the Teradata server if the LDAP Server cannot be resolved on the DNS.
2. Validate that the Teradata DB Server can communicate with the LDAP server by running a command line search for users or groups using the ldapsearch utility.
    
   
   Sample Code/Error
   ./ldapsearch -Y DIGEST-MD5 -U eric1 -H ldap:// labs-dc3-was.labs.Strategy.com -b "dc= ldap:// labs-dc3-was,dc=Strategy,dc=com" -s sub "(samaccountname=eric1)" dn samaccountnam
   
     
   
3. Run the TDGSSCONFIG utility.
   
1. Active Directory integration requires configuration of the TDGSS subsystem LDAP mechanism. Administrator should edit the TdgssUserConfigFile.xml file to specify the full qualified domain name of the LDAP Server. The TdgssUserConfigFile.xml is located by default under the folder: /opt/teradata/tdat/tdgss/site. A sample configuration information is attached at the end of the document. The following properties are required to be set.
    
   
1. Modify Authorization Supported="yes" TO AuthorizationSupported="no"
2. Set the LdapServerName and LdapServerPort as per the LDAP Server configuration
3. It is not necessary to set the LdapSystemFQDN entry and it is sufficient to set the entry LdapBaseFQDN="". This parameter should be set to the Base DN for the LDAP Search root for the users.
2.  After saving the changes to the configuration file, from the TDGSS bin folder (/opt/teradata/tdgss/bin), run the command:
   ./run_tdgssconfig 
    
   
4. From the TDGSS bin folder, run the following command. ldapusername is the network user ID that exists on the Active Directory. The user is prompted for the password and the domain account password should be entered here. If the command is successful, user should see the FQDN, GUID and Audit trail at the end of the output.
    
   ./tsbind -u ldapusername 
    
   
5. Once the tdsbind is working, the administrator should perform a TPA reset. Refer to the following Teradata documentation for more information: http://www.info.teradata.com/HTMLPubs/DB_TTU_14_00/index.html#page/Utilities/B035_1102_111A/Tpareset.59.1.html
   
6. Create a new user on the Teradata server. An example command is below. 
   
   Sample Code/Error
   create user TEST as perm=1000, password=pwd
   
    
   
7. Grant logon to the newly created user:
   
   Sample Code/Error
   GRANT LOGON ON ALL TO <username> WITH NULL PASSWORD
   
    
   
8.  Check DBCControl to ensure that external authentication is allowed. Test with BTEQ to make sure that LDAP authentication is working on the database. In the following commands, <system> should be substituted with the name of the database for the system and the <ldapusername> should be substituted with the required LDAP user (used in Step 4) and when prompted for a password, the domain password should be entered. If the setup is correct, user should be able to logon successfully at this point.
   
   Sample Code/Error
   .logmech ldap
   .logon <system>/<ldapusername>
   
    
   

Setup of ODBC DSN used on Strategy 
In the DSN definition, the connection mechanism should be specified as 'ldap' as shown below.  This change can be made by editing the DSN from the 32-bit Windows ODBC Administrator.
 

 
 
For Strategy Intelligence Server Universal installations on UNIX/Linux operating systems, the following parameter needs to be added to the DSN entry in the odbc.ini file.
 
Sample Code/Error
MechanismName=ldap
 
 
Setup on Strategy

1. Configure Strategy Intelligence Server for LDAP authentication. This can be setup from the Strategy Intelligence Server Configuration editor > LDAP. For details on setting this up, refer to the 'System Administration' product manual or the following Strategy Knowledge Base document.
   KB18562: Understanding LDAP integration with the MicroStrategy Intelligence Server 9.x and newer
   

• Complete the configuration so that users can successfully authenticate into Strategy using LDAP as the authentication mechanism.
• When the option to import LDAP users is checked, when the user logs in to Strategy for the first time, a user object gets created in the metadata under the LDAP Users group. This user object will have the LDAP DN populated, as shown below. It is also possible for administrators to bulk import LDAP users into the metadata. 
   
  

• The administrator can manually populate the credentials for warehouse pass-through in the user editor as shown below.
  

•  
  Alternatively, it is possible for the warehouse pass-through credentials to get populated automatically when a user successfully logs in to Strategy using LDAP. This can be configured by enabling the option under security policy settings, as shown below:
   
  

• Edit the project's warehouse DB Instance > DB Connection > DB Login and provide the domain user's username and password. Note that in the screen-shot below, the username seen is the same as the Teradata username. However, this always need not be the case and the network username can be different from the Teradata username. Make sure to provide the domain username and password here.
   
  

• Edit the project configuration and go to database instances > authentication > warehouse. Make sure that the option 'Use warehouse pass-through credentials from User Editor.......for warehouse execution is checked' and choose the 2nd option 'For selected database instances...'and select the required Teradata database instance.