Using Advanced Security And
OID To Create A Database SSO
Environment
"I am
in the process of
implementing oid and
security in
datawarehosuing
environemnt very similar
to whatever i have read
in ur fantastic paper. i
have asked and queried a
few oracle gururs who
come up with answers
that everything is
possible with oid w/o
really understanding the
shortfalls in the
product. ur paper was
very helpful and i
though i could ask you a
few clarifications on
this.
-
this is the scenario
i am dealing with
now. we have a few
databases with a big
set of user comunity.
i would like to
store the userids
and passwords for
all these users in a
single oid instance
so that it gives a
single-sign on
effect when users
access these
databases. so when
they have access to
tools like sqlplus
can this be
achieved?
-
and i understand
that u can have the
database use the
oid to store userid
and password and u
talk about syncing
up the userids and
passwords. here is
my question
-
i
have database
A,database B having
a common user C.
when C is created in
database A can his
password and
privileges be linked
to database B too.
that is the syncing
you are talking
about is it two-way
from database to oid
and oid to database
too.
can
you please tell me
whether you have any
other documentation on
setting up oid and the
usual gotchas that one
has to keep in mind when
testing them."
It looks
like what you're looking for
is the
'Advanced Security Option'
for the Oracle database.
The
"Oracle Advanced Security
Release 2 Factsheet" on
OTN gives a good overview of
this Oracle option.
In
particular, Advanced
Security can be used to set
up global users, roles and
accounts that can be used
across a set of Oracle
Database applications, with
full details of how these
are set up given in the OTN
document
"Oracle Advanced Security
: Enterprise User
Security"
Looking at
what Advanced Security does,
you wouldn't need to sync
the OID to the database
users and roles, as Advanced
Security would do this for
you. Also, you wouldn't need
to sync individual OIDs with
each other, as there's just
one OID instance per
enterprise. The only time
you'd need to sync OID
instances is if you want to
synchronise the Database
OID with the AS OID
instance (or indeed sync
either with the Oracle Apps
11i OID instance) to achieve
single sign-on across the
complete Oracle technology
stack.
In terms of
Gotchas - well, first of
all, bear in mind that
Advanced Security is a
pay-extra option for the
database. Also, be prepared
to spend a bit of time
getting it all set up. In
addition, whilst setting up
Advanced Security on your
database is a fairly
well-trodden path,
synchronising it with AS
or Oracle Apps is a far more
complex task (and with no
clear 'best practice' in
this area published by
Oracle), although I've been
told by Oracle support that
this whole area is much
simpler to set up with
Oracle Application Server
10g. Haven't tried it myself
though.
You can find
out more details on Oracle
Advanced Security on OTN's
Advanced Security product
page.
and include the URL for the page.
