Oracle Distributed Systems

Authentication Methods

One of the DBA’sobjectives in a distributed environment is to provide easy database access to valid users, while thwarting (or at least discouraging) unauthorized access to the database and network traffic to it (which may contain sensitive information such as passwords). There are three distinct means of authenticating users of an Oracle database, corresponding to three different types of accounts:

Database authentication

This method corresponds to accounts made with the CREATE USER command. Users must provide a valid username/password, which the database validates with information stored in the data dictionary.

Operating system authentication

These are Oracle accounts that correspond to operating system accounts. If a user can log in to the operating system, she is permitted to log in to the database. We often refer to these accounts as OPS$ (pronounced “ops dollar”) because the corresponding database usernames are in the form OPS$os_username by default.

External authentication

These are accounts that are validated by some external means, such as a fingerprint scanner or a network authentication mechanism such as Kerberos.

The sections that follow examine the considerations for each of these methods in a distributed environment and discuss implementation options.

Database Authentication

Database authenticated accounts are the type with which we are most familiar. Every Oracle database has at least two such accounts: SYS and SYSTEM. In an ideal world, you can also ...