外部身份验证方法(os_authent_prefix和remote_os_authent)

--整理以前的学习笔记

参考资料：
http://biancheng.dnbcw.info/oracle/164652.html
http://hi.baidu.com/loveyurui/blog/item/1aafbba33a207e804710648a.html

在linux上创建账户erin
[root@mylinux ~]# useradd erin
[root@mylinux ~]# passwd erin
Changing password for user erin.
New UNIX password:
BAD PASSWORD: it is too short
Retype new UNIX password:
passwd: all authentication tokens updated successfully.

切换到oracle用户，启动实例
[root@mylinux ~]# su - oracle
[oracle@mylinux ~]$ sqlplus /nolog

SQL*Plus: Release 11.2.0.1.0 Production on Wed May 16 21:14:58 2012

Copyright (c) 1982, 2009, Oracle.  All rights reserved.

SQL> conn /as sysdba
Connected to an idle instance.
SQL> startup
ORACLE instance started.

Total System Global Area  497995776 bytes
Fixed Size                  1337464 bytes
Variable Size             373294984 bytes
Database Buffers          117440512 bytes
Redo Buffers                5922816 bytes
Database mounted.
Database opened.
SQL> show parameter os_authent_prefix

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
os_authent_prefix                    string      ops$
SQL> create user ops$erin identified externally;

User created.

SQL> grant create session to ops$erin;

Grant succeeded.

切换到erin账户
su - erin
export ORACLE_SID=orcl
export ORACLE_HOME=/u01/oracle
export PATH=/u01/oracle/bin:$PATH

[oracle@mylinux bin]$ ll oracle
-rwsr-s--x 1 oracle oinstall 173515991 Mar 13 05:39 oracle

确保/u01/oracle/bin/oracle有suid属性,这个suid的属性的意思是其他用户执行oracle这个档案的时候，可以暂时地得到

档案拥有人oracle的权限（suid详细资料，请参考鸟哥的linux私房菜）
如果没有的话，chmod +s oracle，试试看如果oracle没有s这个属性(chmod -s oracle)时，erin是否可以正常连接数据库

[erin@mylinux bin]$ env | grep ORA
ORACLE_SID=orcl
ORACLE_HOME=/u01/oracle
[erin@mylinux ~]$ echo $PATH
/u01/oracle/bin:/usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin:/home/erin/bin
[erin@mylinux ~]$ sqlplus /
SQL*Plus: Release 11.2.0.1.0 Production on Thu May 17 19:16:52 2012
Copyright (c) 1982, 2009, Oracle.  All rights reserved.
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
SQL> show user
USER is "OPS$ERIN"
SQL>
--erin用户不需要输入用户名和密码就能登录数据库，这是外部身份验证的一种(操作系统身份验证)，只要erin用户能登

录操作系统就能登录数据库，这与as sysdba身份的操作系统身份验证稍有不同，以as sysdba身份登录数据库的操作系统

用户需要加入DBA组

su - oracle切换到oracle用户，去掉oracle的suid属性
[oracle@mylinux ~]$ cd /u01/oracle/bin
[oracle@mylinux bin]$ ll oracle
-rwsr-s--x 1 oracle oinstall 173515991 Mar 13 05:39 oracle
[oracle@mylinux bin]$ chmod -s oracle
[oracle@mylinux bin]$ ll oracle
-rwxr-x--x 1 oracle oinstall 173515991 Mar 13 05:39 oracle

su - erin
[erin@mylinux ~]$ sqlplus /nolog
SQL*Plus: Release 11.2.0.1.0 Production on Thu May 17 19:23:23 2012
Copyright (c) 1982, 2009, Oracle.  All rights reserved.
SQL> conn /
ERROR:
ORA-12547: TNS:lost contact
发现账户erin就不能正常连接数据库了

下面试验一下remote_os_authent,在远程数据库上以操作系统验证来登录
我的客户端是一台windows机器
电脑名是windows，用户名是administrator
SQL> conn /as sysdba
Connected.
SQL> create user ops$administrator identified externally;
User created.
SQL> grant create session to ops$administrator;
Grant succeeded.
SQL> show parameter remote_os_authent;--remote_os_authent是静态参数，修改需要重启实例
NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
remote_os_authent                    boolean     FALSE
SQL> alter system set remote_os_authent=true scope=spfile;
System altered.
SQL> shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> startup
ORA-32004: obsolete or deprecated parameter(s) specified for RDBMS instance--重启的时候提示有参数已经废弃的或不赞成使用的开启了
ORACLE instance started.
Total System Global Area  497995776 bytes
Fixed Size                  1337464 bytes
Variable Size             373294984 bytes
Database Buffers          117440512 bytes
Redo Buffers                5922816 bytes
Database mounted.
Database opened.
SQL> show parameter remote_os_authent;

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
remote_os_authent                    boolean     TRUE

查看联机文档reference：
The REMOTE_OS_AUTHENT parameter is deprecated. It is retained for backward compatibility only.
--说明这个参数已经废弃，只是为了向后兼容

在windows客户端
C:\Documents and Settings\Administrator>sqlplus /nolog

SQL*Plus: Release 10.2.0.1.0 - Production on 星期四 5月 17 19:37:59 2012

Copyright (c) 1982, 2005, Oracle.  All rights reserved.

SQL> conn /@dedicated
已连接。
SQL> show user
USER 为 "OPS$ADMINISTRATOR"

远程连接成功

(
ORACLE_SID=orcl--实例名大小写很有关系的哦，我当时就是写错了，把小写写成了大写，一直出以下的错误
SQL> conn hr/hr
ERROR:
ORA-01034: ORACLE not available
ORA-27101: shared memory realm does not exist
Linux Error: 2: No such file or directory
Process ID: 0
Session ID: 0 Serial number: 0

TOM大师在Expert.Oracle.Database.Architecture这本书中的论述，描述了只有通过ORACLE_SID和ORACLE_HOME的哈希值才

能找到共享内存（SGA），所以如果ORACLE_SID和ORACLE_HOME设置错了自然会出现ORA-27101: shared memory realm does

not exist这个错误喽
For those who are unfamiliar with the term SID or ORACLE_SID, a full definition is called for. The SID is a
site identifier. It and ORACLE_HOME (where the Oracle software is installed) are hashed together in UNIX to

create a unique key name for creating or attaching a Shared Global Area (SGA) memory region. If your ORACLE_SID or
ORACLE_HOME is not set correctly, you’ll get the ORACLE NOT AVAILABLE error, since you can’t attach to a

shared memory segment that is identified by this unique key. On Windows, shared memory isn’t used in the same

fashion as on UNIX, but the SID is still important. You can have more than one database under the same ORACLE_HOME,

so you need a way to uniquely identify the instance associated with each one, along with their configuration files.
)

来自 “ ITPUB博客 ” ，链接：http://blog.itpub.net/26524307/viewspace-1061207/，如需转载，请注明出处，否则将追究法律责任。

转载于:http://blog.itpub.net/26524307/viewspace-1061207/