Virtual Identity Dialogue

Comment/Question from my earlier post.

Question: "Hmmm. So requiring another license is semantically different than
requiring another product? I guess if everyone can't use it without
procuring something then he is correct. How about also supporting natively via LDAP without requiring either a license or another product?"

Answer: There is not a mere semantic difference here. I believe Mr. McGovern (whom I referenced in my first post but is not who asked the follow-up question) is confusing Enterprise User Security (EUS) as being the only way to integrate AD passwords with the database. EUS is functionality that makes it easier to manage users and roles in the database which also allows you to store your password verifiers (e.g. the password hashes normally stored in the database) in the directory. This allows simple username & password authentication to use passwords stored in the directory.

My point in my earlier post is that if you don't want EUS (and frankly if you just want password integration, EUS is probably not the option I would recommend since you're not getting any of the additional EUS features) - then you can use Kerberos or RADIUS.

However, I realized on my flight home that I left out one more option out that to to my knowledge doesn't require any other software or license - that is if both the Database Client and Oracle Database are running on Windows - then they will by default leverage "Windows Native Authentication" (WNA). The link is to the 11g docs but it is a feature that exists in at least 10g DB. WNA on the database can also allow you to use AD to maintain database roles.

But again this depends upon the database running on Windows & you needing to have enabled the Windows options on the database.

Again I don't believe WNA requires any additional license but I would suggest that you contact your account representative to confirm (I'm just the functional & technology guy - not licensing guru - in particular for products outside of my realm).

In another future post I will detail why the database works with LDAP via OID/OVD.

FYI - If you are interested in Database Security options - I would suggest reading David Knox's book on the subject - "Effective Oracle Database 10g Security by Design". David has spent most of his professional life dealing & implementing the subject plus is a really nice guy.