Skip Headers

# Using Java

Previous

Next

You configure Oracle Database proxy authentication by customizing your session in your Java code, such as through a `SessionCustomizer` when using the `sessions.xml` file. You can wrap a configured TopLink `DatasourceLogin` `JNDIConnector` with a TopLink proxy connector instance (from `oracle.toplink.platform.database.oracle`) appropriate for your JDBC driver and to configure proxy authentication properties.

If you are using the Oracle JDBC OCI driver, use the `OracleOCIProxyConnector` and property constants defined in `oracle.jdbc.pool.OracleOCIConnectionPool`.

If you are using the Oracle JDBC Thin driver, use the `OracleJDBC10_1_0_2ProxyConnector` and the property constants defined in `oracle.jdbc.OracleConnection`.

The properties to set are shown in Tables a through d.

Note:

Property constant names and values are consistent between the two classes except for `PROXYTYPE_` constants (such as `PROXYTYPE_USER_NAME`). In `OracleOCIConnectionPool` these are of type `String` and in `OracleConnection` they are of type `int`. If you are using the Oracle JDBC Thin driver and `OracleJDBC10_1_0_2ProxyConnector`, you must always set these properties as a `String`. For example:

    login.setProperty(
        "proxytype", Integer.toString(OracleConnection.PROXYTYPE_USER_NAME));

To configure TopLink to use Oracle Database proxy authentication, do the following:

1. Decide on the proxy type you want to use and create appropriate users and roles.

   1. User Name Authentication:

      To authenticate a proxy user `sarah` by user name only, create the user account on the Oracle Database using the following:

          alter user sarah grant connect through dbadminuser
              with roles clerk, reports;

      In this case, you will need to set the proxy properties shown in Table: Proxy Properties for User Name Authentication.

      Proxy Properties for User Name Authentication

      Property Name | Property Value
      --- | ---
      "proxytype" | PROXYTYPE_USER_NAME
      PROXY_USER_NAME | "sarah"
      PROXY_ROLES | String[] {"role1", "role2", ...}

   2. User Name and Password Authentication:

      To authenticate a proxy user `sarah` by user name and password, create the user account on the Oracle Database using the following:

          alter user sarah grant connect through dbadminuser
              authenticated using password
              with roles clerk, reports;

      In this case, you will need to set the proxy properties shown in Table: Proxy Properties for User Name and Password Authentication.

      Proxy Properties for User Name and Password Authentication

      Property Name | Property Value
      --- | ---
      "proxytype" | PROXYTYPE_USER_NAME
      PROXY_USER_NAME | "sarah"
      PROXY_PASSWORD | "passwordforsarah"
      PROXY_ROLES | String[] {"role1", "role2", ...}

   3. Distinguished Name Authentication:

      To authenticate a proxy user `sarah` by globally unique distinguished name, create the user account on the Oracle Database using the following:

          create user sarah identified globally as
              'CN=sarah,OU=americas,O=oracle,L=city,ST=ca,C=us';
          alter user sarah grant connect through dbadminuser
              authenticated using distinguished name
              with roles clerk, reports;

      In this case, you will need to set the proxy properties shown in Table: Proxy Properties for Distinguished Name Authentication.

      Proxy Properties for Distinguished Name Authentication

      Property Name | Property Value
      --- | ---
      "proxytype" | PROXYTYPE_DISTINGUISHED_NAME
      PROXY_DISTINGUISHED_NAME | "CN=sarah,OU=americas,O=oracle,L=city,ST=ca,C=us"
      PROXY_ROLES | String[] {"role1", "role2", ...}

   4. Certificate Authentication:

      To authenticate a proxy user `sarah` by encrypted distinguished name, create the user account on the Oracle Database using the following:

          alter user sarah grant connect through dbadminuser
              authenticated using certificate
              with roles clerk, reports;

      In this case, you will need to set the proxy properties shown in Table: Proxy Properties for User Name Authentication.

      Proxy Properties for User Name Authentication

      Property Name | Property Value
      --- | ---
      "proxytype" | PROXYTYPE_CERTIFICATE
      PROXY_CERTIFICATE | byte[] {<EncryptedCertificate>}
      PROXY_ROLES | String[] {"role1", "role2", ...}

2. Configure your session login using Java code. Do this through a `SessionCustomizer` when using the `sessions.xml` file.

   The following example demonstrates how you can wrap the already specified `JNDIConnector` with the appropriate TopLink proxy authentication connector. You can set the server session's default connection policy to the same proxy authenticated login.

   If you use Oracle VPD (ref VPD), you should set the connection policy to use exclusive connections, and the descriptor for secured data to isolated (ref isolated).

       Login login = server.getDatasourceLogin();
       // Make sure that external connection pooling is used
       login.setUsesExternalConnectionPooling(true);
       // Wrap JNDIConnector with either
       // OracleOCIProxyConnector or OracleJDBC10_1_0_2ProxyConnector
       login.setConnector(
           new OracleOCIProxyConnector(
               ((JNDIConnector)login.getConnector()).getName()));
       ConnectionPolicy policy = server.getDefaultConnectionPolicy();
       policy.setPoolName(null);
       policy.setLogin(login);
       // If using Oracle VPD support,set the connection policy to exclusive
       policy.setShouldUseExclusiveConnection(true);

3. Acquire a proxy-authenticated client session through specifying a `ConnectionPolicy` with this user's credentials.

       ConnectionPolicy policy =
           (ConnectionPolicy)server.getDefaultConnectionPolicy().clone();
       Login login = (Login)policy.getLogin().clone;
       // Set proxy properties into connection policy's login
       login.setProperty("proxytype" , OracleOCIConnectionPool.PROXYTYPE_USER_NAME);
       login.setProperty(OracleOCIConnectionPool.PROXY_USER_NAME ,"sarah");
       policy.setLogin(login);
       Session session = server.acquireClientSession(policy);