Before accessing information in the LDAP directory, an application or user is authenticated by the LDAP server. The authentication process is called binding to the LDAP server.
When accessing LDAP for the first time, DB2 detects which LDAP server is being used and dynamically loads the LDAP support code using the appropriate LDAP client. If the LDAP server is IBM eNetwork Directory, the IBM LDAP client is used. The information about the server is saved in the local registry to allow the same library to be used the next time.
It is important to apply access control on the information stored in the LDAP directory to prevent anonymous users from adding, deleting, or modifying the information.
Access control is managed by the LDAP server.
Access control is inherited by default and can be applied at the container level. When a new object is created, it inherits the same security attribute as the parent object. An administration tool available for the LDAP server can be used to define access control for the container object.
By default, access control is defined as follows:
| Note: | The authorization check is always performed by the LDAP server and not by DB2. The LDAP authorization check is not related to DB2 authorization. An account or auth ID that has SYSADM authority may not have access to the LDAP directory. |