Which description accurately characterizes the use of external authentication for Vantage?

Teradata Vantage allows for the integration of user authorization with an external directory service, such as LDAP or Active Directory. This is accomplished by creating a database role and mapping it to a specific group within the directory using the AS EXTERNAL NAME clause. When a user who is a member of that external group authenticates to Vantage, they are automatically granted the permissions of the corresponding database role for the duration of their session. This feature centralizes user authorization management within the directory, simplifying administration.

A. The directory username must match a database username.

This is incorrect. A Teradata database user is mapped to an external user's Distinguished Name (DN), and the database username does not need to match the common name (cn) or user ID in the directory.

B. Single Sign-On is available with LDAP authentication.

This is misleading. Teradata's primary mechanism for Single Sign-On (SSO) is Kerberos. LDAP authentication in Vantage is a challenge-response mechanism, not an SSO implementation.

D. External authentication is not permitted for mainframe clients.

This is incorrect. Mainframe-attached clients can use supported external authentication mechanisms, such as Kerberos, to connect to Teradata Vantage. There is no general prohibition.

1. For Correct Answer (C) and Incorrect (A):

Teradata Vantage™ - Security Administration, Release 17.20, B035-1100-172K, December 2022.

Chapter 11: Directory-Based Authorization, "Overview of Directory Authorization" (Page 233): "You can associate a Teradata Database role with an external group defined in a directory... When a user who is a member of the external group logs on to the Teradata Database, the user is automatically granted membership in the associated database role for the duration of the logon session."

Chapter 10: Directory-Based Authentication, "Creating a User with an External Authentication" (Page 222): The CREATE USER syntax example shows CREATE USER useracct AS EXTERNAL NAME 'cn=accounting,ou=finance,o=teradata,c=us' ...;. This demonstrates that the database username (useracct) can be different from the directory common name (accounting).

2. For Incorrect Answer (B):

Teradata Vantage™ - Security Administration, Release 17.20, B035-1100-172K, December 2022.

Chapter 8: Single Sign-On and Kerberos Security, "Overview of Kerberos Authentication" (Page 153): This chapter details the use of Kerberos for SSO.

Chapter 10: Directory-Based Authentication, "Overview of Directory Authentication" (Page 221): "LDAP authentication is a challenge-response authentication mechanism that allows the Teradata Database to authenticate users against a central directory server." This description contrasts with the ticket-based SSO mechanism of Kerberos.

3. For Incorrect Answer (D):

Teradata® Call-Level Interface Version 2 Reference for Mainframe-Attached Systems, Release 17.10, B035-2417-171K, November 2020.

Chapter 2: DBCAREA and Function Arguments, "Logon String" (Page 61): The documentation lists MECHANISM 'KRB5' as a valid option for the logon string, confirming that mainframe clients can use Kerberos, a form of external authentication.