Overview

IBM Db2 Genius Hub represents a significant advancement in database management, delivering an AI-powered experience that transforms Db2 towards autonomous database through its agentic capabilities. As organizations scale their database operations, managing user access and authentication becomes increasingly critical. This guide provides step-by-step instructions for installing and configuring OpenLDAP on Ubuntu and integrating it with Db2 Genius Hub (Db2GH) for user authentication and authorization.

Db2 Genius Hub supports multiple authentication types for user management:

• Setup Admin: Default local administrator authentication
• LDAP: Centralized directory-based authentication (covered in this guide)
• Repository: Database repository authentication
• Azure Entra ID: Microsoft Azure Active Directory authentication

This guide focuses exclusively on LDAP authentication, which enables centralized user management through OpenLDAP. LDAP provides a standardized way to manage users and groups across multiple applications, making it ideal for enterprise environments where user credentials need to be synchronized across different systems.

By implementing LDAP authentication for Db2 Genius Hub, you can:

• Centralize user account management in one location
• Enforce consistent password policies across applications
• Simplify user provisioning and deprovisioning
• Maintain group-based access control

This configuration creates three user groups with three users each:

• Administrator Group: Full administrative access to Db2 Genius Hub
• Database Administrator Group: Database management privileges
• User Group: Standard database access

LDAP Directory Hierarchy

The following directory structure will be created:

dc=example,dc=com (Base DN)
│
├── cn=ldapbind (Bind Account)
│   └── Used by Db2 Genius Hub to authenticate and query LDAP
│
├── ou=users (Users Organizational Unit)
│   ├── uid=admin1 (Administrator User 1)
│   ├── uid=admin2 (Administrator User 2)
│   ├── uid=admin3 (Administrator User 3)
│   ├── uid=dba1 (Database Administrator User 1)
│   ├── uid=dba2 (Database Administrator User 2)
│   ├── uid=dba3 (Database Administrator User 3)
│   ├── uid=user1 (Standard User 1)
│   ├── uid=user2 (Standard User 2)
│   └── uid=user3 (Standard User 3)
│
└── ou=groups (Groups Organizational Unit)
    ├── cn=admin_group (Administrator Group)
    │   ├── uniqueMember: uid=admin1,ou=users,dc=example,dc=com
    │   ├── uniqueMember: uid=admin2,ou=users,dc=example,dc=com
    │   └── uniqueMember: uid=admin3,ou=users,dc=example,dc=com
    │
    ├── cn=dba_group (Database Administrator Group)
    │   ├── uniqueMember: uid=dba1,ou=users,dc=example,dc=com
    │   ├── uniqueMember: uid=dba2,ou=users,dc=example,dc=com
    │   └── uniqueMember: uid=dba3,ou=users,dc=example,dc=com
    │
    └── cn=user_group (Standard User Group)
        ├── uniqueMember: uid=user1,ou=users,dc=example,dc=com
        ├── uniqueMember: uid=user2,ou=users,dc=example,dc=com
        └── uniqueMember: uid=user3,ou=users,dc=example,dc=com

Hierarchy Explanation:

• Base DN (dc=example,dc=com): Root of the directory tree, derived from your domain name
• Bind Account (cn=ldapbind): Service account used by Db2 Genius Hub for LDAP queries
• Users OU (ou=users): Container for all user accounts (9 users total)
• Groups OU (ou=groups): Container for all group definitions (3 groups total)
• Group Membership: Each group contains exactly 3 users via uniqueMember attributes

Prerequisites

• Ubuntu server with sudo access
• Network connectivity to LDAP server
• Basic understanding of LDAP concepts (DN, OU, objectClass)

1. Installing and Configuring OpenLDAP

Install OpenLDAP Packages

Install the required LDAP server and client utilities:

sudo apt-get update
sudo apt-get install ldap-utils slapd

Package descriptions:

• slapd: The standalone LDAP daemon (server)
• ldap-utils: Command-line utilities for LDAP operations

Configure LDAP Server

Reconfigure the LDAP server with your domain settings:

sudo dpkg-reconfigure slapd

During configuration, provide the following information:

Note: The DNS domain name is converted to a Base DN. For example:

• Domain: example.com becomes Base DN: dc=example,dc=com
• Domain: company.local becomes Base DN: dc=company,dc=local

Start and Enable LDAP Service

# Start the LDAP service
sudo systemctl start slapd.service
# Enable service to start on boot
sudo systemctl enable slapd.service
# Verify service status
sudo systemctl status slapd.service

Configure Firewall

Allow LDAP traffic through the firewall:

sudo ufw allow ldap

This opens port 389 (LDAP) for incoming connections.

2. Create LDAP Directory Structure

Create Bind Account

A bind account is a service account that Db2 Genius Hub uses to connect to the LDAP server. When a user attempts to log into Db2GH with their LDAP credentials, Db2GH first authenticates itself to the LDAP server using the bind account. Once authenticated, Db2GH can then search the LDAP directory to:

• Verify the user's credentials
• Retrieve user information (username, email, etc.)
• Check group memberships to determine access levels
• Validate user permissions

Think of the bind account as Db2GH's "key" to read the LDAP directory. Without it, Db2GH cannot query LDAP to authenticate users or check their group memberships.

Create bind_user.ldif:

dn: cn=ldapbind,dc=example,dc=com
objectClass: organizationalPerson
objectClass: top
cn: ldapbind
sn: Bind User
userPassword: bind_password
description: Bind user for Db2GH LDAP authentication

Field descriptions:

• dn: Distinguished Name - unique identifier for this entry
• cn: Common Name - the bind username
• sn: Surname - required by organizationalPerson objectClass
• userPassword: Password for bind authentication

Add the bind account:

ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f bind_user.ldif

Db2GH Configuration Values:

• Bind DN: cn=ldapbind,dc=example,dc=com
• Bind Password: bind_password

3. Create Users Organizational Unit

Organizational Units (OUs) are containers that provide a hierarchical structure for organizing LDAP entries, similar to folders in a file system. They help logically separate different types of entries (users, groups, devices, etc.) within the LDAP directory. By creating a dedicated OU for users, we establish a clear location where all user accounts will reside, making it easier to:

• Manage and locate user accounts
• Apply policies to all users at once
• Set permissions and access controls
• Perform bulk operations on users
• Keep the directory organized and maintainable

Create ou_users.ldif:

dn: ou=users,dc=example,dc=com
objectClass: organizationalUnit
ou: users
description: Container for all user accounts

Add the users OU:

ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f ou_users.ldif

Db2GH Configuration Values:

• User Base DN: ou=users,dc=example,dc=com

4. Add User Entries

Create three users for each group (9 users total). Each user has a unique identifier (uid), full name (cn), and email address.

Create users.ldif:

# Administrator Group Users
dn: uid=admin1,ou=users,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: top
uid: admin1
cn: Admin User One
sn: One
userPassword: admin1_password
mail: admin1@example.com
description: Administrator user 1
dn: uid=admin2,ou=users,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: top
uid: admin2
cn: Admin User Two
sn: Two
userPassword: admin2_password
mail: admin2@example.com
description: Administrator user 2
dn: uid=admin3,ou=users,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: top
uid: admin3
cn: Admin User Three
sn: Three
userPassword: admin3_password
mail: admin3@example.com
description: Administrator user 3
# Database Administrator Group Users
dn: uid=dba1,ou=users,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: top
uid: dba1
cn: DBA User One
sn: One
userPassword: dba1_password
mail: dba1@example.com
description: Database administrator user 1
dn: uid=dba2,ou=users,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: top
uid: dba2
cn: DBA User Two
sn: Two
userPassword: dba2_password
mail: dba2@example.com
description: Database administrator user 2
dn: uid=dba3,ou=users,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: top
uid: dba3
cn: DBA User Three
sn: Three
userPassword: dba3_password
mail: dba3@example.com
description: Database administrator user 3
# Standard User Group Users
dn: uid=user1,ou=users,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: top
uid: user1
cn: Standard User One
sn: One
userPassword: user1_password
mail: user1@example.com
description: Standard user 1
dn: uid=user2,ou=users,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: top
uid: user2
cn: Standard User Two
sn: Two
userPassword: user2_password
mail: user2@example.com
description: Standard user 2
dn: uid=user3,ou=users,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: top
uid: user3
cn: Standard User Three
sn: Three
userPassword: user3_password
mail: user3@example.com
description: Standard user 3

ObjectClass descriptions:

• inetOrgPerson: Provides email and other organizational attributes
• organizationalPerson: Basic person attributes (cn, sn, telephoneNumber)
• top: Abstract base class for all LDAP entries

Add all users:

ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f users.ldif

Db2GH Configuration Values:

• User Login Attribute Type: uid

5. Create Groups Organizational Unit

Groups in LDAP define collections of users who share common access rights and permissions. Just as we created an OU for users, we need a separate OU to store all group definitions. This organizational structure keeps groups separate from users and other directory objects, making it easier to manage access control policies and group memberships. The groups OU will contain all the groups that define different access levels in Db2 Genius Hub.

Create ou_groups.ldif:

dn: ou=groups,dc=example,dc=com
objectClass: organizationalUnit
ou: groups
description: Container for all group definitions

Add the groups OU:

ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f ou_groups.ldif

6. Create Groups and Assign Members

Groups are the foundation of role-based access control (RBAC) in Db2 Genius Hub. Instead of assigning permissions to individual users, we assign permissions to groups, and then add users as members of those groups. This approach provides several benefits:

• Simplified Management: Change a user's access level by moving them between groups
• Consistency: All users in a group have identical permissions
• Scalability: Easy to onboard new users by adding them to appropriate groups
• Audit Trail: Clear visibility of who has what level of access

In this configuration, we create three groups with three users each, representing different access levels in Db2GH:

• admin_group: Full administrative control over Db2GH
• dba_group: Database administration capabilities
• user_group: Standard database access for end users

Create groups.ldif:

# Administrator Group - Full administrative access
dn: cn=admin_group,ou=groups,dc=example,dc=com
objectClass: groupOfUniqueNames
cn: admin_group
description: Db2GH administrators with full system access
uniqueMember: uid=admin1,ou=users,dc=example,dc=com
uniqueMember: uid=admin2,ou=users,dc=example,dc=com
uniqueMember: uid=admin3,ou=users,dc=example,dc=com
# Database Administrator Group - Database management privileges
dn: cn=dba_group,ou=groups,dc=example,dc=com
objectClass: groupOfUniqueNames
cn: dba_group
description: Database administrators with database management privileges
uniqueMember: uid=dba1,ou=users,dc=example,dc=com
uniqueMember: uid=dba2,ou=users,dc=example,dc=com
uniqueMember: uid=dba3,ou=users,dc=example,dc=com
# Standard User Group - Standard database access
dn: cn=user_group,ou=groups,dc=example,dc=com
objectClass: groupOfUniqueNames
cn: user_group
description: Standard users with database access
uniqueMember: uid=user1,ou=users,dc=example,dc=com
uniqueMember: uid=user2,ou=users,dc=example,dc=com
uniqueMember: uid=user3,ou=users,dc=example,dc=com

Group structure explanation:

• groupOfUniqueNames: LDAP objectClass for groups with unique member DNs
• uniqueMember: Attribute containing the full DN of each group member
• Each group has exactly 3 members for this configuration

Add all groups:

ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f groups.ldif

Db2GH Configuration Values:

7. Configure LDAP in Db2GH

Now that the LDAP directory is set up with users and groups, we need to configure Db2 Genius Hub to use LDAP for authentication. This involves telling Db2GH:

• Where the LDAP server is located (hostname and port)
• How to authenticate to LDAP (bind credentials)
• Where to find users and groups in the directory
• Which attributes to use for matching users and group memberships

This configuration establishes the connection between Db2GH and your LDAP server, enabling centralized authentication.

Connection Settings

Navigate to Db2GH authentication settings and configure LDAP:

Server Connection:

• Host name: ldap-server.example.com (your LDAP server hostname or IP)
• Port: 389 (standard LDAP port)

• Bind DN: cn=ldapbind,dc=example,dc=com
• Bind Password: bind_password

User & Group Configuration

User Information:

• User Base DN: ou=users,dc=example,dc=com
• User Login Attribute Type: uid

This tells Db2GH where to find users and which attribute to use for login (username).

Administrator Group:

• Group DN: cn=admin_group,ou=groups,dc=example,dc=com
• Member Attribute Type: uniqueMember
• User ID Attribute Type: dn
• Members: admin1, admin2, admin3

Database Administrator Group:

• Group DN: cn=dba_group,ou=groups,dc=example,dc=com
• Member Attribute Type: uniqueMember
• User ID Attribute Type: dn
• Members: dba1, dba2, dba3

User Group:

• Group DN: cn=user_group,ou=groups,dc=example,dc=com
• Member Attribute Type: uniqueMember
• User ID Attribute Type: dn
• Members: user1, user2, user3

Test User Login

After configuration, test authentication with any user:

• Username: admin1 (or any configured user)
• Password: admin1_password (corresponding user password)

8. Automated LDAP Setup Script

Manually running ldapadd commands for each LDIF file can be time-consuming and error-prone, especially when setting up multiple LDAP servers or recreating environments. This automated script streamlines the process by:

• Processing all LDIF files in the correct dependency order
• Checking if files exist before attempting to add them
• Providing clear success/failure feedback for each step
• Handling errors gracefully without stopping the entire process

This is particularly useful for:

• Initial LDAP setup in development/testing environments
• Creating consistent LDAP configurations across multiple servers
• Training and demonstration purposes

#!/bin/bash
# LDAP Automated Setup Script
# This script adds all LDAP entries in the correct order
# Define the LDAP admin credentials
LDAP_ADMIN="cn=admin,dc=example,dc=com"
# Prompt for password securely
read -sp "Enter LDAP admin password: " LDAP_PASS
echo
# Array of LDIF files in dependency order
LDIF_FILES=(
    "bind_user.ldif"      # Bind account for Db2GH
    "ou_users.ldif"       # Users organizational unit
    "users.ldif"          # All 9 user accounts
    "ou_groups.ldif"      # Groups organizational unit
    "groups.ldif"         # All 3 groups with members
)
# Process each LDIF file
for LDIF_FILE in "${LDIF_FILES[@]}"; do
    echo "Processing $LDIF_FILE..."
    if [ ! -f "$LDIF_FILE" ]; then
        echo "ERROR: $LDIF_FILE not found!"
        continue
    fi
    ldapadd -x -D "$LDAP_ADMIN" -f "$LDIF_FILE" -w "$LDAP_PASS"
    if [ $? -eq 0 ]; then
        echo "SUCCESS: $LDIF_FILE added successfully"
    else
        echo "FAILED: Could not add $LDIF_FILE"
    fi
    echo "---"
done
echo "LDAP setup completed"

Usage:

1. Save all LDIF files in the same directory
2. Save the script as setup_ldap.sh
3. Make it executable: chmod +x setup_ldap.sh
4. Run: ./setup_ldap.sh

9. Verification Commands

After setting up LDAP and configuring Db2GH, it's crucial to verify that everything is working correctly before relying on it for production use. These verification steps help you:

• Confirm the LDAP service is running and accessible
• Validate that all users and groups were created correctly
• Test authentication mechanisms
• Troubleshoot any configuration issues early

The verification process is divided into three categories: service verification, directory queries, and authentication testing.

Verify LDAP Service

# Check service status
sudo systemctl status slapd
# Check listening port
sudo netstat -tlnp | grep 389
# or
sudo ss -tlnp | grep 389

Query LDAP Directory

# List all entries
ldapsearch -x -D "cn=admin,dc=example,dc=com" -W -b "dc=example,dc=com"
# List all users
ldapsearch -x -D "cn=admin,dc=example,dc=com" -W -b "ou=users,dc=example,dc=com" "(objectClass=inetOrgPerson)"
# List all groups
ldapsearch -x -D "cn=admin,dc=example,dc=com" -W -b "ou=groups,dc=example,dc=com" "(objectClass=groupOfUniqueNames)"
# Check specific user
ldapsearch -x -D "cn=admin,dc=example,dc=com" -W -b "ou=users,dc=example,dc=com" "(uid=admin1)"
# Check group membership
ldapsearch -x -D "cn=admin,dc=example,dc=com" -W -b "ou=groups,dc=example,dc=com" "(cn=admin_group)"

Test User Authentication

# Test bind as a user
ldapwhoami -x -D "uid=admin1,ou=users,dc=example,dc=com" -W

10. Troubleshooting

Even with careful configuration, issues can arise when integrating LDAP with Db2 Genius Hub. This section covers the most common problems encountered during LDAP setup and integration, along with their solutions. Understanding these issues helps you quickly diagnose and resolve problems, minimizing downtime and ensuring smooth authentication operations.

Common Issues

Issue: Cannot connect to LDAP server

• Verify slapd service is running: systemctl status slapd
• Check firewall allows port 389: sudo ufw status
• Verify network connectivity: telnet ldap-server 389

Issue: Authentication fails

• Verify bind DN and password are correct
• Check user exists: ldapsearch -x -b "ou=users,dc=example,dc=com" "(uid=username)"
• Verify password: ldapwhoami -x -D "uid=username,ou=users,dc=example,dc=com" -W

Issue: User not in group

• Verify group membership: ldapsearch -x -b "ou=groups,dc=example,dc=com" "(cn=groupname)"
• Check uniqueMember attribute contains correct user DN

Log Files

# View LDAP logs (Ubuntu)
sudo journalctl -u slapd -f
# View system logs
sudo tail -f /var/log/syslog | grep slapd

11. Security Recommendations

1. Use Strong Passwords: Set complex passwords for all users and the admin account
2. Enable TLS/SSL: Configure LDAPS (port 636) for encrypted connections
3. Restrict Bind Account: Give bind account minimal read-only permissions
4. Regular Backups: Backup LDAP database regularly
5. Access Control: Implement LDAP ACLs to restrict who can read/modify entries
6. Monitor Access: Review LDAP logs for unauthorized access attempts

12. Summary

References

• OpenLDAP Documentation
• IBM Db2GH LDAP Configuration