RE: Ids and passwords for application users

  The DBA usually does not get to decide how the application is developed in most of the cases. We have to manage what's out there. There are some products which use one login for all users and manage security within the application. If the applications is web enabled, the changes are the DBA will have no way of figuring out the client machine/user when troubleshooting issues. In this case I would suggest using dbms_application_info maybe within a database logon trigger to set the username. Whether it's possible depends on the application. I was merely suggesting a way out, not recommending that it be done this way ;)

Regards,
Denny

Quoting Jacques Kilchoer <Jacques.Kilchoer_at_quest.com>:

> > -----Original Message-----
> > From: groups_at_koovakattu.com [mailto:groups_at_koovakattu.com]
> >
> > If a common login is used (which is the case with most
> > applications),
> > dbms_application_info can be used to set the actual username
> > in either the
> > module or action. As long as the application is not using
> > dbms_application_info
> > to set both, you should be able to get the info from v$session.
>
> Sure, but I will repeat what I said before:
> a) It's easier to write code if the user is determined by the Oracle
> userid
> rather than by
> v$session.client_info. Trigger example:
> create trigger orders_set_user
> before insert or update on orders
> for each row
> begin
> :new.last_upd_user := user ;
> end orders_set_user ;
> /
>
> b) How do you plan on hiding the password from the user, or, more
> importantly, changing the
> password if it becomes compromised?
>

-- 
Please see the official ORACLE-L FAQ: http://www.orafaq.com
-- 
Author: 
  INET: groups_at_koovakattu.com

Fat City Network Services    -- (858) 538-5051  FAX: (858) 538-5051
San Diego, California        -- Public Internet access / Mailing Lists
--------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from).  You may
also send the HELP command for other information (like subscribing).