1

I'm writing a sqplus-like program. I assume the connect string contains the password if it contains a slash, e.g. scott/tiger or scott/tiger@orcl.

if connect string does not contain "/":
    prompt for password entry

Is there ever a case where a user could have a connect string scott or scott@orcl and not need to be prompted for a password?

Improve this question

2 Answers 2

Reset to default
6

Possible solutions:

  1. Use a Secure External Password Store (Oracle Wallet): http://docs.oracle.com/database/121/DBSEG/authentication.htm#CHDHGAIJ

You can use the stored credentials without specifying a username or password. Connection string: /@orcl.

  1. REMOTE_OS_AUTHENT: http://docs.oracle.com/cd/E18283_01/server.112/e17110/initparams208.htm

Not recommended, insecure, mentioned just for completeness, do not use it.

  1. Kerberos Authentication: http://docs.oracle.com/database/121/DBSEG/asokerb.htm

You can use your directory credentials for logging in without specifying your username or password. Connection string: /@orcl.

  1. SSL Authentication: http://docs.oracle.com/database/121/DBSEG/asossl.htm

You own a certificate and you will be authenticated by that, without specifying a username or password. Connection string: /@orcl.

  1. Operating system authentication based on group membership. Works only locally, and for privileged users. Connection string: / as sysdba, / as sysoper, / as sysbackup, / as sysdg, / as syskb.
Improve this answer
1
  • This is great, thanks! For my particular application, I've decided not to "intelligently" scan the string... instead it will connect, and if it gets a "bad passwd" error prompt the user and connect with the entered passwd.
    – Mark Harrison
    Aug 6, 2015 at 17:56
0

Oracle does not allow you to create a user without a password.

SQL> create user marco;
create user marco
               *
ERROR at line 1:
ORA-01938: IDENTIFIED BY must be specified for CREATE USER


SQL>

If you want to login without entering a password then you need oracle to use an external authentication (the OS for example).

Improve this answer
4
  • check that syntax diagram in the manual. identified by is not necessary.
    – miracle173
    Aug 6, 2015 at 7:51
  • The identified clause is necessary. It must be followed by by, externally, or globally. The text for error message ORA-01938 is perhaps not 100% correct but you need to specify how the user must 'prove' that it knows a password.
    – Marco
    Aug 6, 2015 at 8:07
  • you are right. My comment should be "check that syntax diagram in the manual. a password is not necessary."
    – miracle173
    Aug 6, 2015 at 9:22
  • Depends on how you look at it. The password does not need to be stored together with the user in the oracle database. Oracle can trust another authentication service. In that case you first need to identify yourself there. I am sure that that service wants some proof in the form of a password or certificate.
    – Marco
    Aug 6, 2015 at 9:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.