ALTER AUTHENTICATION
Modifies the settings for a specified authentication method.
Syntax
ALTER AUTHENTICATION auth_method_name { | { ENABLE | DISABLE } | { LOCAL | HOST [ { TLS | NO TLS } ] host_ip_address } | RENAME TO new_auth_method_name | METHOD value | SET param=value[,…] | PRIORITY value }
Parameters
Parameter Name | Description |
---|---|
auth_method_name
|
Name of the authentication method that you want to create. Type: VARCHAR |
ENABLE | DISABLE
|
Enable or disable the specified authentication method. Default: Enabled When you perform an upgrade and use Kerberos authentication, you must manually set the authentication to ENABLE as it is disabled by default. |
LOCAL | HOST [ { TLS | NO TLS } host_ip_address
|
Specify that the authentication method applies to local or remote ( For authentication methods that use LDAP, specify whether or not LDAP uses Transport Layer Security (TLS). For remote ( Vertica supports IPv4 and IPv6 addresses. |
RENAME TO new_auth_method_name
|
Rename the authentication record. Type: VARCHAR |
METHOD value
|
The authentication method you are altering. |
SET param=value
|
Set a parameter name and value for the authentication method that you are creating. Required only for LDAP and Ident authentication. ALTER AUTHENTICATION validates the parameters you enter. See parameters for specific authentication types in Client Authentication. |
PRIORITY value
|
If the user is associated with multiple authentication methods, the priority value specifies which authentication method Vertica tries first. Default: 0 Type: INTEGER Higher values indicate higher priorities. For example, a priority of 10 is higher than a priority of 5; priority 0 is the lowest possible value. For details, see Priorities for Client Authentication Methods. |
Privileges
Superuser
Examples
Enabling and Disabling Authentication Methods
This example uses ALTER AUTHENTICATION to disable the v_ldap
authentication method and then enable it again:
=> ALTER AUTHENTICATION v_ldap DISABLE; => ALTER AUTHENTICATION v_ldap ENABLE;
Renaming Authentication Methods
This example renames the v_kerberos
authentication method to K5
. All users who have been granted the v_kerberos
authentication method now have the K5
method granted instead.
=> ALTER AUTHENTICATION v_kerberos RENAME TO K5;
Modifying Authentication Parameters
This example sets the system user for ident1
authentication to user1
:
=> CREATE AUTHENTICATION ident1 METHOD 'ident' LOCAL; => ALTER AUTHENTICATION ident1 SET system_users='user1';
When you set or modify LDAP or Ident parameters using ALTER AUTHENTICATION, Vertica validates them.
This example changes the IP address and specifies the parameters for an LDAP authentication method named Ldap1
. Specify the bind parameters for the LDAP server. Vertica connects to the LDAP server, which authenticates the database client. If authentication succeeds, Vertica authenticates any users who have been associated with (granted) the Ldap1
authentication method on the designated LDAP server:
=> CREATE AUTHENTICATION Ldap1 METHOD 'ldap' HOST '172.16.65.196';
=> ALTER AUTHENTICATION Ldap1 SET host='ldap://172.16.65.177', binddn_prefix='cn=', binddn_suffix=',dc=qa_domain,dc=com';
The next example specifies the parameters for an LDAP authentication method named Ldap2
. Specify the LDAP search and bind parameters. Sometimes, Vertica does not have enough information to create the distinguished name (DN) for a user attempting to authenticate. In such cases, you must specify to use LDAP search and bind:
=> CREATE AUTHENTICATION Ldap2 METHOD 'ldap' HOST '172.16.65.196';
=> ALTER AUTHENTICATION Ldap2 SET basedn='dc=qa_domain,dc=com', binddn='cn=Manager,dc=qa_domain, dc=com',search_attribute='cn',bind_password='secret';
Changing the Authentication Method
This example changes the localpwd
authentication from hash to trust:
=> CREATE AUTHENTICATION localpwd METHOD 'hash' LOCAL;
=> ALTER AUTHENTICATION localpwd METHOD 'trust';
Set Multiple Realms
This example sets another realm for the authentication method krb_local:
=> ALTER AUTHENTICATION krb_local set realm = 'COMPANY.COM';