Add roles for LDAP users

A role manager assigns a Hyper-Converged Database (HCD) role by matching the username provided for authentication with an HCD role name. Create a role for each LDAP user who needs to access the database.

The LDAP username attribute is defined in ldap_user_search_filter, such as the UID (Open LDAP) or SamAccountName (Microsoft Active Directory).

Create a role with the LOGIN option that matches the LDAP username.

Don’t set a password.
```
CREATE ROLE LDAP_USER_ROLE WITH LOGIN = true;
```
Replace LDAP_USER_ROLE with the name of the LDAP user. The username is passed from the authenticator to the role manager. The string is exactly as the user entered it at login, including case.

SUPERUSER is a reserved word for the SUPERUSER option that grants a role full database access. For more information, see Restrict access to data.

WITH LOGIN is required for basic database access.
Optional: Grant another role permission to alter or drop the new role:
```
GRANT ALTER ON ROLE LDAP_USER_ROLE TO MANAGEMENT_ROLE;
GRANT DROP ON ROLE LDAP_USER_ROLE TO MANAGEMENT_ROLE;
```
Replace the following:
- LDAP_USER_ROLE: The name of the LDAP user role.
- MANAGEMENT_ROLE: The name of the role that will manage the LDAP user role.
All superusers have ALTER, DROP, AUTHORIZE, and DESCRIBE permissions on all roles automatically. The role that created a role is also granted all permissions on that role.

Next steps

Assign permissions to the role.

Add roles for LDAP users

Next steps

Was this helpful?

Give Feedback

Add roles for LDAP users

Create a login role

Next steps

Was this helpful?