Oracle is deprecating OS authentication according to the Oracle Database Security Guide, which says
Be aware that the REMOTE_OS_AUTHENT parameter was deprecated in Oracle Database 11g Release 1 (11.1), and is retained only for backward compatibility.
In addition, most security information and tools consider OS (external) authentication to be a security problem. I am trying to understand why this is the case. Here are some advantages I see of OS authentication:
- Without OS Authentication applications must store passwords in a variety of applications each with their own security model and vulnerabilities.
- Domain authentication already has to be secure because if it is not then database security just slows down access to the database, but cannot prevent it.
- Users that only have to remember one domain password can be made to create more secure domain passwords more easily than they can be made to create even less secure database passwords as the number of different databases they must connect to increases.