| Oracle FAQ | Your Portal to the Oracle Knowledge Grid | |
 |
 | |||
| Oracle FAQ | Your Portal to the Oracle Knowledge Grid | |
|
| |||
Home -> Community -> Mailing Lists -> Oracle-L -> Re: oracle authentication from windows
Try authenticating with the domain\userid. When you create the user account in the database, use the domain\userid. Set SQLNET.AUTHENTICATION_SERVICES = (NTS) in the sqlnet.ora file. Check out MetaLink note 60634.1 on how to set up domain authenticated users. Also set the registry entry OSAUTH_PREFIX_DOMAIN and create userids in the form of OPS$<domain>\<user> . For users on the local server, their domain would be the local server. All others domains would be their actual NT domain. Check out the MetaLink document for more details.
RWB
Reginald W. Bailey
IBM Global Services - ETS SW GDSD - Database Management
Your Friendly Neighborhood DBA
713-216-7703 (Office) 281-798-5474 (Mobile) 713-415-5410 (Pager)
[EMAIL PROTECTED]
dia.net.in To: [EMAIL PROTECTED]
Sent by: cc:
[EMAIL PROTECTED] Subject: Re: oracle authentication
from windows
com
06/21/2003 08:49
PM
Please respond to
ORACLE-L
Thank you very much Arup , very lucid and detailed explanation.
In the last point you said :
:3) If remote_os_authent is false, but the database has a user
OPS$BULBUL
: identified externally; a user named bulbul on the _server_ can login
as
: "sqlplus /", but a user named BULBUL on a remote machine will not be
able
: to.
That is the problem , as I said I am not able to log in even the
database server's operating system users ( who are identified
externally ) unless I set remote_os_authent= true ; But then as you
said any remote client could authenticate the externally identified
user in whatever means, and then they could log in. I mean
create user scott identified externally;
grant create session to scott ;
If on the client machine there is an operating system user called
scott, then he can log in to the scott schema.
Any ideas how to restrict the externally identified users so that they
have to log in to the database server to access their oracle schemas.?
Another doubt is from what you said about
sqlnet_authentication_services :
: You are using (none) because you do not want to rely on the
authentication
: service provided by others.
:
So this means that the database will not recognise the authentication
done by some other means ( like the white house guards refusing to
recognize the authentication provided by the people on the hill).
Then how will someone log in if he is identified externally ?
Once again thanks for the excellent response, thanks for taking time out to explain the physical significance of these parameters in a very nice way.
: (2) remote_os_authent means the user is authenticated in whatever
manner in
: the _client_ operating system, not the server. The user may have no
account
: with the server.
:
: (3) If remote_os_authent is false, but the database has a user
OPS$BULBUL
: identified externally; a user named bulbul on the _server_ can login
as
: "sqlplus /", but a user named BULBUL on a remote machine will not be
able
: to.
:
: Hope this helps.
:
: Arup Nanda
: www.proligence.com
:
: ----- Original Message -----
: To: "Multiple recipients of list ORACLE-L" <[EMAIL PROTECTED]>
: Sent: Saturday, June 21, 2003 2:19 AM
:
:
: > Arup , the procedure you gave is correct and works fine.
: > I tried it out on win32 with 9.2.0.1.0.
: > But I had to set SQLNET.AUTHENTICATION_SERVICES= (none) in
sqlnet.ora
: > My fundamentals are really weak , so please forgive the stupid
: > questions : These steps create a database user who will be
: > authenticated by the operating system , right ? I assume that the
: > authenticating os is the one which runs the database and not the
os
: > running on the remote client machine . If yes , then this would
mean
: > that all these externally identified users would have to somehow
log
: > onto the os of the database server.
: >
: >
: > However why does this procedure work only when
remote_os_authent=true
: > ?
: > I had posted this same question a while ago , did not get any
: > satisfactory answers , though people told me that
: > remote_os_authent=true is a security problem.
: >
: > But it doesn't seem to work without that.
: > Any ideas of enabling "sqlplus /" without remote_os_authent=true ?
: > Wouldn't remote_os_authent=true allow remote client machines to
: > authenticate their users which can then log in to the database as
: > long as they know the name of the externally authenticated
username
: > and value of os_authent_prefix
: >
: > ----- Original Message -----
: > To: "Multiple recipients of list ORACLE-L" <[EMAIL PROTECTED]>
: > Sent: Friday, June 20, 2003 01:15
: >
: >
: > Sure.
: >
: > Just declare these in your init.ora
: >
: > os_authent_prefix=OPS$
: > remote_os_authent=TRUE
: >
: > bounce the database, add a user called OPS$<the Windows username>,
: > e.g. OPS$AK if your Windows login id is AK as
: >
: > create user ops$ak identified externally
: >
: > From windows connect as "/@servicename", e.g. sqlplus /@service1
: >
: > If it doesn't work, the OS user may be different. Use this query
while
: > connected to the database from Windows cleint.
: >
: > SQL> select sys_context('USERENV','OS_USER') from dual;
: >
: > See what OS username comes up; use that instead.
: >
: > HTH.
: >
: > Arup Nanda
: > www.proligence.com
: >
: >
: > ----- Original Message -----
: > From: AK
: > To: Multiple recipients of list ORACLE-L
: > Sent: Thursday, June 19, 2003 1:10 PM
: > Subject: oracle authentication from windows
: >
: >
: > We want our client users ( forms user ) to just enter windows
: > password and then automatically able to get in to oracle .Is there
a
: > way oracle can authenticate from windows ( or active directory ) .
: > enbadding password in runform.exe not an option .
: >
: > thanks,
: > -ak
:
-- Please see the official ORACLE-L FAQ: http://www.orafaq.net -- Author: <[EMAIL PROTECTED] INET: [EMAIL PROTECTED] Fat City Network Services -- 858-538-5051 http://www.fatcity.com San Diego, California -- Mailing list and web hosting services --------------------------------------------------------------------- To REMOVE yourself from this mailing list, send an E-Mail message to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing). -- Please see the official ORACLE-L FAQ: http://www.orafaq.net -- Author: INET: [EMAIL PROTECTED] Fat City Network Services -- 858-538-5051 http://www.fatcity.com San Diego, California -- Mailing list and web hosting services --------------------------------------------------------------------- To REMOVE yourself from this mailing list, send an E-Mail message to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing).Received on Mon Jun 23 2003 - 08:24:24 CDT
 |
 |