Oracle教程

Oracle 参数 LDAP_DIRECTORY_ACCESS 官方解释，作用，如何配置最优化建议

本站中文解释

LDAP_DIRECTORY_ACCESS

LDAP_DIRECTORY_ACCESS参数用于控制Operating System (OS)使用Oracle LDAP目录服务器时的权限。

设置方法：

1、首先，在Oracle Net服务器上编辑$ORACLE_HOME/hs/admin/opldap.ora文件，确保LDAP_DIRECTORY_ACCESS参数已正确设置，设置方式如下：

DIRECTORY_ACCESS =[(a1) access_method=ldap]

a1 表示LDAP服务器的名称，access_method表示接入的方式，它的取值只能是ldap。

2、接着编辑dn2name.ora文件，设置以下参数：

# To convert LDAP distinguished name to Oracle
# database user name (oracle_user)

# 将LDAP辨识名称转换为Oracle数据库用户名（oracle_user）

ORACLE_USER =oracle_user

# The LDAP distinguished name of the user
# LDAP辨识名称的用户

LDAP_DN =cn=oracle_user, ldap_spec=ldap_spec

3、最后，启动服务器，检查是否能正常使用LDAP服务。

官方英文解释

LDAP_DIRECTORY_ACCESS specifies whether Oracle refers to Oracle Internet Directory for user authentication information.

Property Description

Parameter type

String

Syntax

LDAP_DIRECTORY_ACCESS = { NONE | PASSWORD | SSL }

Default value

NONE

Modifiable

ALTER SYSTEM

Modifiable in a PDB

Yes

Basic

No

If directory access is turned on, then this parameter also specifies how users are authenticated.

Values

  • NONE

    Oracle does not refer to Oracle Internet Directory for Enterprise User Security information.

  • PASSWORD

    Oracle tries to connect to the enterprise directory service using the database password stored in the database wallet. If that fails, then the Oracle Internet Directory connection fails and the database will not be able to retrieve enterprise roles and schema mappings upon enterprise user login.

  • SSL

    Oracle tries to connect to Oracle Internet Directory using SSL.

See Also:

Oracle Database Enterprise
User Security Administrator’s Guide for more information on Enterprise User Security

Using LDAP_DIRECTORY_ACCESS with PDBs

PDBs can use password or SSL authentication with Oracle Internet Directory for EUS, or Microsoft Active Directory for CMU, when the parameter value is set accordingly.

The LDAP_DIRECTORY_ACCESS initialization parameter is PDB-specific and can be set as follows:

  • When you use the ALTER SYSTEM command to set the value of LDAP_DIRECTORY_ACCESS while connected to the CDB root:

    • If you specify the CONTAINER=ALL clause, then the setting applies to the CDB root and all PDBs.
    • If you omit the CONTAINER=ALL clause, or specify the CONTAINER=CURRENT clause, then the setting applies only to the CDB root.

  • When you use the ALTER SYSTEM command to set the value of LDAP_DIRECTORY_ACCESS while connected to a PDB, the setting applies only to that PDB.

  • When you set the value of LDAP_DIRECTORY_ACCESS in an initialization parameter file, the setting applies only to the CDB root; it does not apply to the PDBs.

For a CDB, if the wallet location is not specified in sqlnet.ora, then the default database wallet path is:

ORACLE_BASE/admin/db-unique-name/pdb-GUID/wallet (if ORACLE_BASE is set)

or:

ORACLE_HOME/admin/db-unique-name/pdb-GUID/wallet (if ORACLE_BASE is not set)

The exception is for the root database, which has a default wallet path of:

ORACLE_BASE/admin/db-unique-name/wallet (if ORACLE_BASE is set)

or:

ORACLE_HOME/admin/db-unique-name/wallet (if ORACLE_BASE is not set)

All PDBs in a CDB have the same database unique name. By placing wallets in the default location, each PDB can have its own identity.

Note that because there is only one sqlnet.ora file for a CDB, the wallet location in sqlnet.ora is only used by the CDB root container. Because each PDB must have its own wallet, a PDB wallet will be specified by the pdb-GUID under the wallet location in sqlnet.ora.

For the root container of a CDB, the wallet location is:

WALLET_LOCATION_specified_in_sqlnet.ora

For each PDB of the CDB, the wallet location is:

WALLET_LOCATION_specified_in_sqlnet.ora/pdb-GUID/

Note:

Oracle databases are registered with Oracle Internet Directory using Database Configuration Assistant (DBCA). For registration with Oracle Internet Directory to work, all the PDBs for a CDB must be registered using DBCA.

Using LDAP_DIRECTORY_ACCESS with Non-CDBs

For non-CDBs, if the wallet location is not specified in sqlnet.ora, then the default database wallet path is:

ORACLE_BASE/admin/db-unique-name/wallet (if ORACLE_BASE is set)

or:

ORACLE_HOME/admin/db-unique-name/wallet (if ORACLE_BASE is not set)

See Also:

Oracle Database Enterprise
User Security Administrator’s Guide for an example of setting the value of this parameter to SSL in the server parameter file using ALTER SYSTEM


数据运维技术 » Oracle 参数 LDAP_DIRECTORY_ACCESS 官方解释，作用，如何配置最优化建议
分享到：

相关推荐