...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
| Table of Contents |
|---|
Proxy user connection
A proxy connection allows you to connect to a database as one user account and operate with the access and privileges of a different account.
It is typically used to share one database account that has required privileges to other database users without sharing its password. An example of this type of account sharing means that you can allow help desk support personnel to connect to the database using a "helpdesk" account that has correct roles and privileges without sharing the password for this account with them.
There are two terms you need to know when setting up the proxy connection—proxy user and client user.
A proxy user is a user who connects to the database on behalf of another user. This user connects with the username and password set up for him without knowing the client user password.
A client user is a user on behalf of whom the proxy user connects.
Let's imagine that you connect to the database as the owner and want your employee who has limited privileges to work with the same schemas and database links. Instead of granting all the permissions one by one, you can set up a proxy connection.
In this way, your employee signs into the database under your account with his credentials or by specifying the properties that depend on the connection type.
In this topic, we will discuss the following types:
Basic and proxy connection
TNS/LDAP and proxy connection
Kerberos and proxy connection
Setting up a proxy connection with BASIC and TNS/LDAP
Before setting up any proxy connection, you need to have two users:
The proxy user - the user that will initiate the connection under the proxy client user account.
The proxy client user - the user whose privileges, schema, and objects will be available for the session.
| Anchor | ||||
|---|---|---|---|---|
|
create user proxyuser_test identified by proxypasswordto create a database user accountAnchor _Hlk41552211 _Hlk41552211 grant create session to proxyuser_testto grant the permissions to create sessionalter user daticaltest grant connect through proxyuser_testto enable the client user, which is daticaltest account, to connect to the database using the proxy account.
Setting up a proxy connection with Kerberos
...
| Code Block |
|---|
SQLNET.KERBEROS5_CC_NAME=/tmp/kerbache SQLNET.AUTHENTICATION_SERVICES=(KERBEROS5PRE,KERBEROS5) SQLNET.KERBEROS5_CONF=/tmp/kerberos/krb5.conf TRACE_LEVEL_CLIENT=16 SQLNET.KERBEROS5_CONF_MIT = TRUE NAMES.DIRECTORY_PATH=(TNSNAMES) |
NOTE: WINDOWS use following services in sqlnet.ora: SQLNET.AUTHENTICATION_SERVICES=(BEQ,KERBEROS5)
3. Example krb5.conf file
| Code Block |
|---|
[libdefaults]
default_realm = TEST.DATICAL.NET
default_ccache_name = /tmp/kerbcache
[realms]
TEST.DATICAL.NET = {
kdc = test.datical.net
admin_server = test.datical.net
}
[domain_realm]
.test.datical.net = TEST.DATICAL.NET
test.datical.net = TEST.DATICAL.NET |
...
| Code Block |
|---|
kinit <ADusername>@TEST.DATICAL.NET example: kinit jnew@TEST.DATICAL.NET |
NOTE: For dblinks, you will need forwardable ticket, so use kinit -f instead.
5. Set up a proxy connection with Kerberos
...
There are four options you can choose to connect to your database:
BASIC proxy connection
BASIC and Kerberos proxy connection
TNS/LDAP proxy connection
TNS/LDAP and Kerberos proxy connection
The following table provides the format of credentials for each authentication method.
BASIC | TNS/LDAP | Kerberos | |
Username | proxy_user[proxy_client_user] | proxy_user[proxy_client_user] | [proxy_client_user] |
Password | proxypass | proxypass | <none> |
Here is the example of one of the ways to connect to your database:
By selecting Kerberos, you don't have to specify the proxy_user [proxy_client_user] format and can just enter [proxy_client_user]. If you clear the check box for Kerberos, you have to specify the username and password, so it takes the form proxy_user [proxy_client_user].