Skip Headers

# Oracle Database Proxy Authentication

Previous

Next

TopLink supports proxy authentication with the Oracle Database in JSE applications and JEE applications using OC4J native or managed data sources with Oracle JDBC driver release 10.1.0.2.0 or later and external connection pools (see "External Connection Pools") only.

Note: TopLink does not support Oracle Database proxy authentication with JTA.

Oracle Database proxy authentication delivers the following security benefits:

- A limited trust model, by controlling the users on whose behalf middle tiers can connect, and the roles the middle tiers can assume for the user.

- Scalability, by supporting user sessions through Oracle Call Interface (OCI) and thick JDBC, and eliminating the overhead of reauthenticating clients.

- Accountability, by preserving the identity of the real user through to the database, and enabling auditing of actions taken on behalf of the real user.

- Flexibility, by supporting environments in which users are known to the database, and in which users are merely "application users" of which the database has no awareness.

Note: Oracle Database supports proxy authentication in three-tiers only; it does not support it across multiple middle tiers.

For more information about authentication in an Oracle Database, see "Preserving User Identity in Multitiered Environments" in the Oracle Database Security Guide.

Configure your TopLink database login to use proxy authentication (see "Configuring Oracle Database Proxy Authentication") to do the following:

- address the complexities of authentication in a three-tier architecture (such as client-to-middle-tier and middle-tier-to-database authentication, and client reauthentication through the middle -tier to the database)

- enhance database audit information (for even triggers and stored procedures) by using a specific user for database operations, rather than the generic pool user

- simplify VPD/OLS configuration (see "Isolated Client Sessions and Oracle Virtual Private Database (VPD)") by using a proxy user, rather than setting user information directly in the session context with stored procedures