Configuring Oracle Database Proxy Authentication

Using Java

You configure Oracle Database proxy authentication by customizing your session in your Java code, such as through a SessionCustomizer when using the sessions.xml file. You can wrap a configured TopLink DatasourceLogin JNDIConnector with a TopLink proxy connector instance (from oracle.toplink.platform.database.oracle) appropriate for your JDBC driver and to configure proxy authentication properties.

If you are using the Oracle JDBC OCI driver, use the OracleOCIProxyConnector and property constants defined in oracle.jdbc.pool.OracleOCIConnectionPool.

If you are using the Oracle JDBC Thin driver, use the OracleJDBC10_1_0_2ProxyConnector and the property constants defined in oracle.jdbc.OracleConnection.

The properties to set are shown in Tables a through d.

login.setProperty(
    "proxytype", Integer.toString(OracleConnection.PROXYTYPE_USER_NAME));

To configure TopLink to use Oracle Database proxy authentication, do the following:

1. Decide on the proxy type you want to use and create appropriate users and roles.

   1. User Name Authentication:

      To authenticate a proxy user sarah by user name only, create the user account on the Oracle Database using the following:

      alter user sarah grant connect through dbadminuser
          with roles clerk, reports;
      
      

      In this case, you will need to set the proxy properties shown in Table 83-2.

      Table 83-2 Proxy Properties for User Name Authentication

      Property Name	Property Value
      "proxytype"	PROXYTYPE_USER_NAME
      PROXY_USER_NAME	"sarah"
      PROXY_ROLES	String[] {"role1", "role2", ...}

      
      

   2. User Name and Password Authentication:

      To authenticate a proxy user sarah by user name and password, create the user account on the Oracle Database using the following:

      alter user sarah grant connect through dbadminuser
          authenticated using password
          with roles clerk, reports;
      
      

      In this case, you will need to set the proxy properties shown in Table 83-3.

      Table 83-3 Proxy Properties for User Name and Password Authentication

      Property Name	Property Value
      "proxytype"	PROXYTYPE_USER_NAME
      PROXY_USER_NAME	"sarah"
      PROXY_PASSWORD	"passwordforsarah"
      PROXY_ROLES	String[] {"role1", "role2", ...}

      
      

   3. Distinguished Name Authentication:

      To authenticate a proxy user sarah by globally unique distinguished name, create the user account on the Oracle Database using the following:

      create user sarah identified globally as
          'CN=sarah,OU=americas,O=oracle,L=city,ST=ca,C=us';
      alter user sarah grant connect through dbadminuser
          authenticated using distinguished name
          with roles clerk, reports;
      
      

      In this case, you will need to set the proxy properties shown in Table 83-4.

      Table 83-4 Proxy Properties for Distinguished Name Authentication

      Property Name	Property Value
      "proxytype"	PROXYTYPE_DISTINGUISHED_NAME
      PROXY_DISTINGUISHED_NAME	"CN=sarah,OU=americas,O=oracle,L=city,ST=ca,C=us"
      PROXY_ROLES	String[] {"role1", "role2", ...}

      
      

   4. Certificate Authentication:

      To authenticate a proxy user sarah by encrypted distinguished name, create the user account on the Oracle Database using the following:

      alter user sarah grant connect through dbadminuser
          authenticated using certificate
          with roles clerk, reports;
      
      

      In this case, you will need to set the proxy properties shown in Table 83-2.

      Table 83-5 Proxy Properties for User Name Authentication

      Property Name	Property Value
      "proxytype"	PROXYTYPE_CERTIFICATE
      PROXY_CERTIFICATE	byte[] {<EncryptedCertificate>}
      PROXY_ROLES	String[] {"role1", "role2", ...}

      
      

2. Configure your session login using Java code. Do this through a SessionCustomizer when using the sessions.xml file.

   The following example demonstrates how you can wrap the already specified JNDIConnector with the appropriate TopLink proxy authentication connector. You can set the server session's default connection policy to the same proxy authenticated login.

   If you use Oracle VPD (ref VPD), you should set the connection policy to use exclusive connections, and the descriptor for secured data to isolated (ref isolated).

   Login login = server.getDatasourceLogin();
   // Make sure that external connection pooling is used
   login.setUsesExternalConnectionPooling(true);
   // Wrap JNDIConnector with either
   // OracleOCIProxyConnector or OracleJDBC10_1_0_2ProxyConnector
   login.setConnector(
       new OracleOCIProxyConnector(
           ((JNDIConnector)login.getConnector()).getName()));
   ConnectionPolicy policy = server.getDefaultConnectionPolicy();
   policy.setPoolName(null);
   policy.setLogin(login);
   // If using Oracle VPD support,set the connection policy to exclusive 
   policy.setShouldUseExclusiveConnection(true);
   
   

3. Acquire a proxy-authenticated client session through specifying a ConnectionPolicy with this user's credentials.

   ConnectionPolicy policy = 
       (ConnectionPolicy)server.getDefaultConnectionPolicy().clone();
   Login login = (Login)policy.getLogin().clone;
   // Set proxy properties into connection policy's login
   login.setProperty("proxytype" , OracleOCIConnectionPool.PROXYTYPE_USER_NAME);
   login.setProperty(OracleOCIConnectionPool.PROXY_USER_NAME ,"sarah");
   policy.setLogin(login);
   Session session = server.acquireClientSession(policy);