User Access, Roles, and LDAP/SSO Integration
Users, roles, permissions
Guardium separates authentication from authorization. Local users or LDAP-authenticated users are assigned roles-such as Admin, User, and Auditor-that bundle permissions. Auditors get read-only access to reports and audit trails; admins manage configuration. Keep a break-glass local admin account for recovery.
LDAP and SSO
LDAP configuration needs server, base DN, bind DN and password, and a group-to-role mapping. Test the bind before enabling. SAML 2.0 SSO makes Guardium the service provider: exchange metadata and certificates with the identity provider, map IdP groups to Guardium roles, and keep local login available. Clock skew and expired certificates break SSO.
Worked example
The security team wants auditors to log in with corporate credentials. Create an LDAP config, test the bind, map cn=guardium-auditors to the Auditor role, and have a test user log in. Confirm the user sees reports but cannot edit policies. Then enable SAML for the same group after metadata exchange and verify both paths.
Traps
Mapping every LDAP user to Admin; nested groups the directory does not return; forgetting the local fallback; SSO certificate expiry; assuming LDAP authentication grants permissions without a role mapping.