Re: User and Security Management

orcastillo_at_aol.com (ORcastillo) writes:

> We have an application which we are in the process of moving to Oracle. It uses
> a client written in C++ and for now Paradox tables. We have a userlist table
> which has info pertaining to each user. We use this table to verify usernames
> and passwords. What is the best way to manage this in Oracle client/server
> implementation? We still want to keep the userlist table simply because is
> offers info needed at the client level.
> Should we have a superuser in the backgroung doing everything at the Oracle
> level or should we manually create many users in the Oracle Database while at
> the same time keeping track of them in the userlist table?
I would strongly suggest creating the users as Oracle users. Using a superuser can lead to problems because a programming error might cause the all-powerful user to execute an operation that it shouldn't. Separate users would limit the damage that could be done.

Using separate users would also permit greater accountabiltiy.

In addition, Oracle maintains its own encrypted passwords which would relieve you of the responsibility for maintenance of your password table.

                                        Hope this helps,
-- 
                                        Rick
                                        Rick Wessman
                                        Security and Directory Technologies
                                        Server Technologies
                                        Oracle Corporation
                                        rwessman_at_us.oracle.com