Pete Finnigan's Oracle Security Forum


    
      
        Pete Finnigan's Oracle Security Forum
        (http://www.petefinnigan.com/forum/yabb/YaBB.cgi)
      

        Oracle Security >> Oracle Security >> Database Authentication
        
(Message started by: Pete Finnigan on Dec 11^th, 2009, 3:33pm)

Title: Database Authentication
Post by Pete Finnigan on Dec 11^th, 2009, 3:33pm

We are going over how to set up authentication for our Java/Oracle in house applications.

From a security standpoint, what is the best recommendation for database authentication?

1. Lightweight users? (No schema)
2. Database schema authentication (This is how we are currently set up)
3. Each user has a schema using LDAP authentication?

I have not looked that hard yet but was wondering what is the best method from an "Enterprise" standpoint.

Title: Re: Database Authentication
Post by Pete Finnigan on Dec 14^th, 2009, 9:46am

Hi,

I think some further questions must be asked. What are the users doing?, do they need to be identified for traceability?, does the application already indentify end users outside of the database connections, i.e. at the application layer?, how many users, are their performance/scalability/maintainability issues to solve?

It always comes to a compromise. For tracability, there is more chance to trace people if they have their own schemas but this is not perfect as end to end traceability is not guarenteed. For performance, connection pooling is a much better option and for maintainability lightweight users probably fits the bill better.

Have you thought about using Oracle connection pooling and proxy users? - this is a good compromise for tracability and performance but will depend on how many people (users) you need to deal with.

cheers

Pete

Title: Re: Database Authentication
Post by Pete Finnigan on Dec 14^th, 2009, 1:59pm

Thank you for your reply.

We don't have enough of a user base to require connection pooling in the past. Our users are not doing anything out of the ordinary, just some mild data entry and reporting.

We do have a heavy traceability requirement, we would probably have to have the applications audit connections manually if we removed the schema.

I will look into Proxy users and connection pooling. The other problem is no money if these require licenses above what we have then there would be a problem too.

The customer all of the sudden seems to want to eliminate user schema. I just want to be prepared for when that day comes.

Thanks

Neil Blevins

Title: Re: Database Authentication
Post by Pete Finnigan on Dec 14^th, 2009, 5:47pm

Hi Niel,

Thanks for your reply. I think proxy users/connection pooling is a good option for you. You will also need to ensure end-to-end tracability is included. All of these can be done with JDBC and you said its an inhouse application so you should be in a good position. These features are not cost options so you should be good to go on licenses.

Kind regards

Pete

Title: Re: Database Authentication
Post by Pete Finnigan on Dec 14^th, 2009, 5:57pm

Thank you. I will move that option to the top of the list to research.