Overview

This guide provides step-by-step instructions for integrating OpenLDAP with IBM Db2 running on Red Hat OpenShift Container Platform. The integration enables centralised LDAP-based authentication, allowing Db2 databases to authenticate users against an external OpenLDAP directory server. This eliminates the need to manage separate user credentials within each Db2 instance and provides a unified authentication mechanism across your enterprise.

What you’ll accomplish:

- Set up an OpenLDAP server on RHEL 9/10.

- Configure LDAP directory structure with users and groups.

- Enable TLS/SSL encryption for secure communication.

- Integrate Db2 with external LDAP authentication.

- Test and verify the complete integration.

Key Benefits:

- Single Source of Truth: Manage all Db2 users and groups from one central LDAP directory

- Enhanced Security: Eliminate password sprawl by using LDAP credentials across multiple Db2 instances

- Simplified Administration: Add/remove users once in LDAP, automatically reflected in all Db2 databases

- Enterprise Integration: Leverage existing LDAP infrastructure for Db2 authentication

- Role-Based Access: Use LDAP groups to control admin vs. user access to Db2 databases

Architecture

Prerequisites

·      RHEL 9/10 server for OpenLDAP

·      OpenShift cluster with Db2 operator installed

·      Root access to servers

·      Network connectivity between Db2 pods and LDAP server

OpenLDAP Server Setup

Run these commands on: LDAP Server (RHEL 9/10)

1. Install EPEL Repository

# For RHEL 10
dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm

# For RHEL 9
dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm

2. Install OpenLDAP Packages

dnf install -y openldap-servers openldap-clients

3. Start and Enable SLAPD Service

systemctl enable --now slapd
systemctl status slapd

4. Configure Admin Password

# Generate password hash
ADMIN_HASH=$(slappasswd -s 'YourSecurePassword')

# Create configuration file
cat > /root/db.ldif << EOF
dn: olcDatabase={2}mdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=example,dc=com

dn: olcDatabase={2}mdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=example,dc=com

dn: olcDatabase={2}mdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: $ADMIN_HASH
EOF

# Apply configuration
ldapmodify -Y EXTERNAL -H ldapi:/// -f /root/db.ldif

5. Load Required Schemas

ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif

LDAP Directory Structure

Run these commands on: LDAP Server

1. Create Base Directory Structure

cat > /root/base.ldif << 'EOF'
dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: Example Organization
dc: example

dn: ou=users,dc=example,dc=com
objectClass: organizationalUnit
ou: users

dn: ou=groups,dc=example,dc=com
objectClass: organizationalUnit
ou: groups
EOF

ldapadd -x -D 'cn=Manager,dc=example,dc=com' -w 'YourSecurePassword' -f /root/base.ldif

2. Create Groups

cat > /root/groups.ldif << 'EOF'
dn: cn=db2admins,ou=groups,dc=example,dc=com
objectClass: posixGroup
cn: db2admins
gidNumber: 10001

dn: cn=db2users,ou=groups,dc=example,dc=com
objectClass: posixGroup
cn: db2users
gidNumber: 10002
EOF

ldapadd -x -D 'cn=Manager,dc=example,dc=com' -w 'YourSecurePassword' -f /root/groups.ldif

3. Create Users

# Generate password hashes
ADMIN_PASS=$(slappasswd -s 'AdminPassword')
USER_PASS=$(slappasswd -s 'UserPassword')

cat > /root/users.ldif << EOF
dn: uid=dbadmin,ou=users,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: dbadmin
cn: Database Administrator
sn: Administrator
uidNumber: 10001
gidNumber: 10001
homeDirectory: /home/dbadmin
loginShell: /bin/bash
userPassword: $ADMIN_PASS

dn: uid=dbuser,ou=users,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: dbuser
cn: Database User
sn: User
uidNumber: 10002
gidNumber: 10002
homeDirectory: /home/dbuser
loginShell: /bin/bash
userPassword: $USER_PASS
EOF

ldapadd -x -D 'cn=Manager,dc=example,dc=com' -w 'YourSecurePassword' -f /root/users.ldif

4. Add Users to Groups

cat > /root/add_members.ldif << 'EOF'
dn: cn=db2admins,ou=groups,dc=example,dc=com
changetype: modify
add: memberUid
memberUid: dbadmin

dn: cn=db2users,ou=groups,dc=example,dc=com
changetype: modify
add: memberUid
memberUid: dbuser
EOF

ldapmodify -x -D 'cn=Manager,dc=example,dc=com' -w 'YourSecurePassword' -f /root/add_members.ldif

TLS/SSL Configuration

Run these commands on: LDAP Server

1. Generate Self-Signed Certificate

mkdir -p /etc/openldap/certs
cd /etc/openldap/certs

openssl req -new -x509 -nodes -out server.crt -keyout server.key -days 3650 \
  -subj '/CN=ldap.example.com'

chown ldap:ldap /etc/openldap/certs/server.*
chmod 600 /etc/openldap/certs/server.key
chmod 644 /etc/openldap/certs/server.crt

2. Configure OpenLDAP to Use TLS

cat > /root/tls.ldif << 'EOF'
dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/server.crt
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/server.key
EOF

ldapmodify -Y EXTERNAL -H ldapi:/// -f /root/tls.ldif
systemctl restart slapd

3. Configure Firewall

firewall-cmd --permanent --add-service=ldap
firewall-cmd --reload

Db2 Configuration

Run these commands on: OpenShift Cluster (oc/kubectl client)

Option 1: New Db2 Instance Deployment

If you’re deploying a new Db2 instance, add the LDAP configuration to your Db2uInstance YAML:

spec:
  environment:
    authentication:
      ldap:
        admin: dbadmin
        enabled: true
        externalLdap:
          adminGroup: db2admins
          groupBaseDN: ou=groups,dc=example,dc=com
          port: "389"
          searcherDN: cn=Manager,dc=example,dc=com
          searcherPassword: YourSecurePassword
          server: ldap.example.com
          type: ldap
          userBaseDN: ou=users,dc=example,dc=com
          userGroup: db2users
  # ... other spec configurations

Deploy using:

oc apply -f Db2_instance.yaml

Option 2: Existing Db2 Instance

If Db2uInstance is already running, follow these steps:

Step 1: Edit the Db2uInstance

# Edit the existing instance
oc edit db2uinstance <instance-name> -n db2

Add or update the LDAP configuration under spec.environment.authentication:

spec:
  environment:
    authentication:
      ldap:
        admin: dbadmin
        enabled: true
        externalLdap:
          adminGroup: db2admins
          groupBaseDN: ou=groups,dc=example,dc=com
          port: "389"
          searcherDN: cn=Manager,dc=example,dc=com
          searcherPassword: YourSecurePassword
          server: ldap.example.com
          type: ldap
          userBaseDN: ou=users,dc=example,dc=com
          userGroup: db2users

Step 2: Wait for Instance to Become Ready

# Monitor the instance status
oc get db2uinstance <instance-name> -n db2 -w
# Wait until status shows "Ready"

Step 3: Restart all the db2 Pods

# Get all the Db2 pod names
RELEASE_NAME=""
db2_pods=$(oc get pods -n db2 -o name | grep ${RELEASE_NAME}-db2u)

# Delete all the pods to trigger restart
oc delete $(echo "$db2_pods")

# Monitor pod recreation
oc get pods -n db2 -w

Step 4: Grant Privileges to LDAP Groups

# Get the DB2 pod name
Db2_POD=$(oc get pods -n db2 -l app=db2u-instance -o jsonpath='{.items[0].metadata.name}')

# Connect to the database and grant privileges
oc exec -n db2 $Db2_POD -- su - db2inst1 -c 'db2 connect to bludb && \
  db2 "GRANT DBADM ON DATABASE TO GROUP db2admins" && \
  db2 "GRANT CONNECT ON DATABASE TO GROUP db2users" && \
  db2 "GRANT DATAACCESS ON DATABASE TO GROUP db2users"'

Testing and Verification

Run these commands on: OpenShift Cluster (oc/kubectl client)

1. Test LDAP Connectivity from Db2 Pod

# Get a Db2 pod name, here we are getting the 1st Db2 pod name
Db2_POD=$(oc get pods -n db2 -l app=Db2u-instance -o jsonpath='{.items[0].metadata.name}')

# Test LDAP connection
oc exec -n db2 $Db2_POD -- bash -c \
  'ldapsearch -x -H ldap://ldap.example.com -ZZ \
   -D "cn=Manager,dc=example,dc=com" \
   -w "YourSecurePassword" \
   -b "ou=groups,dc=example,dc=com" \
   "(objectClass=posixGroup)" cn memberUid'

Expected output should show groups with memberUid attributes:

dn: cn=db2admins,ou=groups,dc=example,dc=com
cn: db2admins
memberUid: dbadmin

dn: cn=db2users,ou=groups,dc=example,dc=com
cn: db2users
memberUid: dbuser

2. Test User Authentication

oc exec -n db2 $Db2_POD -- bash -c \
  'ldapwhoami -x -H ldap://ldap.example.com -ZZ \
   -D "uid=dbadmin,ou=users,dc=example,dc=com" \
   -w "AdminPassword"'

Expected output:

dn:uid=dbadmin,ou=users,dc=example,dc=com

3. Test Db2 Database Connection

# Connect as admin user
oc exec -n db2 $Db2_POD -- \
  su - db2inst1 -c 'db2 connect to bludb user dbadmin using AdminPassword'

# Connect as regular user
oc exec -n db2 $Db2_POD -- \
  su - db2inst1 -c 'db2 connect to bludb user dbuser using UserPassword'

Expected output:

   Database Connection Information

 Database server        = DB2/LINUXPPC64LE 12.1.4.0
 SQL authorization ID   = DBADMIN
 Local database alias   = BLUDB

Troubleshooting

Common Issues

1. LDAP Connection Fails

Run these commands on: OpenShift Cluster (oc/kubectl client)

Check network connectivity:

# From Db2 pod
oc exec -n db2 $Db2_POD -- ping ldap.example.com
oc exec -n db2 $Db2_POD -- telnet ldap.example.com 389

2. Authentication Fails

Run these commands on: LDAP Server

Verify user credentials:

ldapsearch -x -H ldap://ldap.example.com -ZZ \
  -D "uid=dbadmin,ou=users,dc=example,dc=com" \
  -w "AdminPassword" \
  -b "uid=dbadmin,ou=users,dc=example,dc=com"

3. Troubleshooting using Logs on the db2 Pod

Run these commands on: OpenShift Cluster (from Db2 pod)

a. Inspect the db2diag.log for any errors. It exists under:

${DIAGPATH}/NODE{NODE_NUM}/db2diag.<DIAG_NUM>.log

For example: ${DIAGPATH}/NODE0000/db2diag.0.log

b. Using the iam_trace method:

touch /tmp/iam_trace_on.cfg
db2 connect to bludb user dbuser using UserPassword
rm /tmp/iam_trace_on.cfg
vi /tmp/IAM_DEBUG.trc

Verification Commands

Run these commands on: LDAP Server

# Verify OpenLDAP is running
systemctl status slapd

# Check LDAP ports
ss -tlnp | grep 389

# Verify group membership
ldapsearch -x -LLL -H ldap://localhost \
  -D 'cn=Manager,dc=example,dc=com' \
  -w 'YourSecurePassword' \
  -b 'ou=groups,dc=example,dc=com' \
  '(objectClass=posixGroup)' cn gidNumber memberUid

Key Configuration Parameters

LDAP Server Configuration

Db2 Configuration

Security Best Practices

·      Use Strong Passwords: Never use default or weak passwords

·      CA-Signed Certificates: Replace self-signed certificates in production

·      Network Security: Restrict LDAP access using firewall rules

·      Regular Updates: Keep OpenLDAP and Db2 updated with security patches

·      Audit Logging: Enable comprehensive logging for both systems

·      Backup Strategy: Implement regular backups of LDAP directory

·      Access Control: Configure proper ACLs in OpenLDAP

·      Password Policies: Enforce strong password policies

References

·      IBM Db2 External LDAP Configuration

·      OpenLDAP Administrator’s Guide

Conclusion

This guide provides a streamlined approach to integrating OpenLDAP with IBM Db2 running on Red Hat OpenShift. Key takeaways:

·      OpenLDAP provides centralised authentication for Db2 users

·      TLS encryption is automatically handled by Db2 when connecting to LDAP

·      Groups use posixGroup object class with memberUid attribute for user membership

·      Existing Db2 instances require the instance to become Ready and pod restart after configuration changes

·      Proper testing ensures LDAP connectivity and authentication work correctly

Following these steps, LDAP users can successfully authenticate and connect to Db2 databases using their LDAP credentials.

About The Authors 

Mahesh Kumar G is a Software Test Developer within the Power Linux ISST Team at the IBM India Systems Development Lab and holds a BTech degree in Electronics and Communication from MSRIT Bengaluru. He has 12+ Years of IT experience in software and system testing, with focus on Automation. He can be reached at mahesh.kumar.g@ibm.com

Kostas Rakopoulos is a member of the Db2 Performance team at the IBM Toronto Lab and has a BSc in Computer Science from the University of Toronto. Since joining the Db2 Performance team in 2008, Kostas has worked on a wide range of Db2 offering types including Db2 pureScale (OLTP), Db2 Event Store (IoT) and Db2 Warehouse. Most recently, Kostas has been working on the Native Cloud Object Storage feature in Db2 Warehouse. Kostas can be reached at kostasr@ca.ibm.com.