Configure Application Identities
Use the SQL statements in this chapter to create and drop application identities.
An application identity is a registered database identity that represents a trusted application or AI agent and maps to the application’s IAM client identifier. Although application users do not require database-resident identities, the application itself requires a registered identity when the database must distinguish one application from another, constrain which data roles the application can activate, or authorize database access for the application itself. Like an end user, an application identity does not own a database schema or database objects; the database derives its data authorization from the data roles associated with it.
Create an application identity to accomplish any of the following:
-
Confer common privileges to end users who connect through the application. Grant data roles that are locally managed to the application identity. At runtime, the database enables these data roles in the security context of each end user who connects through that application. Because the roles are held by the application identity, every user who connects through it inherits the same privileges, and no user can enable a data role that the application identity was not granted.
-
Elevate privileges for an end user. Allow trusted application code to temporarily enable additional data roles on behalf of a connected end user. See Privilege Elevation.
-
Establish the database connection for an application-mediated end-user flow. Allow the application to log on directly as its application identity (using its own database-access token) to create the initial connection, instead of using a connection pool user account. The database validates the token and first looks for a global schema mapped to the token’s subject (the application’s client ID). If no mapped schema exists, the database resolves the subject to the mapped application identity and creates a schema-less lightweight session for it. Subsequently, the application attaches the end-user security context payload to that session at request time. See Set Up IAM Integration for Application-Mediated Connections.
Note: For a configurable OAuth 2.0 provider as IAM, the application’s client identifier comes from the claim specified by
application_id_claimand can differ fromsub. -
Authorize the application or AI agent as itself. Allow an IAM-managed application or AI agent to log on directly as its application identity, using its own database-access token, and access data under its own authorization. The database establishes an end-user security context whose identity is the application identity, and enforces the data roles granted directly to the application identity together with the data roles mapped to the application’s IAM roles. See Applications Log On as Application Identities and Set Up IAM Integration for Logon as an Application Identity.
You can only grant data roles that are managed locally to an application identity. The database automatically enables data roles that are externally mapped based on the end-user token’s role claims (or the database-access token’s role claims when a separate end-user token is absent); you cannot grant these to an application identity.
Query the DBA_APPLICATION_IDENTITIES data dictionary view to see existing application identities.