Database Authentication of Users

Database authentication of users entails using information within the database itself to perform the authentication.

About Database Authentication of Users
Oracle AI Database can authenticate users attempting to connect to a database by using information stored in that database itself.
Advantages of Database Authentication
There are three advantages of using the database to authenticate users.
Creating Users Who Are Authenticated by the Database
When you create a user who is authenticated by the database, you assign this user a password.

About Database Authentication of Users

Oracle AI Database can authenticate users attempting to connect to a database by using information stored in that database itself.

To configure Oracle AI Database to use database authentication, you must create each user with an associated password. If you want the user’s password to use National Language Support (NLS), then you must configure the database to run with an NLS character set. Otherwise, the user would not be able to log in properly. Both user names and passwords can use the NLS character format, and follow the same syntax rules as identifiers in the database. Remember that double quotation mark characters can only be used as the delimiters of an identifier, so Oracle AI Database passwords cannot contain double quotation mark characters. The user must provide this user name and password when attempting to establish a connection.

Oracle AI Database generates a one-way hash of the user’s password and stores it for use when verifying the provided login password. In order to support older clients, Oracle AI Database can be configured to generate the one-way hash of the user’s password using a variety of different hashing algorithms. The resulting password hashes are known as password versions, which have the short names 10G (no longer supported as of Oracle AI Database 26ai), 11G, and 12C. The short names 10G, 11G, and 12C serve as abbreviations for the details of the one-way password hashing algorithms, which are described in more detail in the documentation for the PASSWORD_VERSIONS column of the DBA_USERS view. To find the list of password versions for any given user, query the PASSWORD_VERSIONS column of the DBA_USERS view.

Note: Starting with Oracle AI Database 26ai, the SHA-1 verifier introduced with Oracle Database 11g is deprecated.The salted multi-round SHA-512 password hash (also known as “verifier”) introduced with Oracle Database 12c provides enhanced security for your password. If 11g verifiers (11G) are still being used in your database, then Oracle recommends resetting them so they can be upgraded to the 12c (12C) de-optimized PBKDF2-based verifier.

By default, there are currently two versions of the one-way hashing algorithm in use in Oracle AI Database: the salted SHA-1 hashing algorithm, and the salted PKBDF2 SHA-2 SHA-512 hashing algorithm. The salted SHA-1 hashing algorithm generates the hash that is used for the 11G password version. The salted PKBDF2 SHA-2 SHA-512 hashing algorithm generates the hash that is used for the 12C password version. This hash generation takes place for the same password; that is, both algorithms run for the same password. Oracle AI Database records these password versions in the DBA_USERS data dictionary view. When you query this view, you will see two password versions. For example:

SELECT USERNAME, PASSWORD_VERSIONS FROM DBA_USERS;

USERNAME  PASSWORD_VERSIONS
--------  -----------------
ADAMS     11G, 12C
SYS       11G, 12C
...

To specify the authentication protocol to allow during authentication of a client or of a database server acting as a client, you can explicitly set the following parameters in the server’s sqlnet.ora file:

The SQLNET.ALLOWED_LOGON_VERSION_SERVER parameter sets the minimum authentication protocol that is permitted when connecting to Oracle AI Database instances.
The SQLNET.ALLOWED_LOGON_VERSION_CLIENT parameter configures the authentication protocol that is used when the server is “acting as a client” (for example, when the server is authenticating a database link). Setting SQLNET.ALLOWED_LOGON_VERSION_CLIENT in the server sqlnet.ora file enables its client configuration to be changed independently of its server configuration, that is, without affecting the authentication protocol used when the server is “acting as a server” (which is configured using SQLNET.ALLOWED_LOGON_VERSION_SERVER).

Each connection attempt is tested, and if the client or server does not meet the client ability requirements specified by its partner, authentication fails with an ORA-28040 No matching authentication protocol error in the “Ability Required of the Client” in the “SQLNET.ALLOWED_LOGON_VERSION_SERVER Settings” table under the description of the SQLNET.ALLOWED_LOGON_VERSION_SERVER parameter in Oracle AI Database Net Services Reference. The parameter can take the values 12a, 12, 11, 10, 9, or 8. The default value is 12, which is Exclusive Mode. These values represent the version of the authentication protocol. Oracle recommends the value 12. However, be aware that if you set SQLNET.ALLOWED_LOGON_VERSION_SERVER and SQLNET.ALLOWED_LOGON_VERSION_CLIENT to 11, then pre-Oracle Database Release 11.1 client applications including JDBC thin clients cannot authenticate to the Oracle AI Database using password-based authentication.

To enhance security when using database authentication, Oracle recommends that you use password management, including account locking, password aging and expiration, password history, and password complexity verification.

If you are not using external authentication and only using local database password authentication, then set AUTHENTICATION_SERVICES=(none) in the client sqlnet.ora file. This setting improves performance because the client will bypass the external authentication checks and go directly to database password authentication.

Related Topics

Advantages of Database Authentication

There are three advantages of using the database to authenticate users.

These advantages are as follows:

User accounts and all authentication are controlled by the database. There is no reliance on anything outside of the database.

If you are using Oracle Automatic Storage Management (Oracle ASM), then the password file can reside in Oracle ASM. In this case, administrative authentication (for example, logging on using AS SYSDBA) would rely on Oracle ASM if the database was configured with its password file in Oracle ASM.
Oracle Database provides strong password management features to enhance security when using database authentication.
It is easier to administer when there are small user communities.

Creating Users Who Are Authenticated by the Database

When you create a user who is authenticated by the database, you assign this user a password.

To create a user who is authenticated by the database, include the IDENTIFIED BY clause when you create the user.

For example, the following SQL statement creates a user who is identified and authenticated by Oracle Database. User sebastian must specify the assigned password whenever they connect to Oracle Database.

CREATE USER sebastian IDENTIFIED BY password;

Related Topics