1

Is there any scenario where it is the best choice to make the Oracle installation/service account (oracle) an LDAP/AD account versus a local-only account?

More generally, is creating the Oracle account locally the best practice? I don't see this stated explicitly in their installation documentation.

|improve this question
  • Are you installing Oracle on Windows? – John Eisbrener Jun 13 '17 at 14:23
  • Linux, generally. I suppose the same question would apply to Windows. – LJKims Jun 13 '17 at 14:25
  • Not too often you see Linux properly tied into AD. You will just want to ensure the oracle account is in the proper groups on the Linux server. This account can be either local or managed within AD. Oracle doesn't really care, so long as it's group permissions are setup properly on the server. – John Eisbrener Jun 13 '17 at 14:40
  • I'm concerned about the pros/cons of putting the oracle account into AD (or LDAP). It seems that you would want the account local for times when access to the directory is unavailable. So I was wondering if there were benefits to centralizing the account that would outweigh this. – LJKims Jun 13 '17 at 15:01
  • To draw parallels from a different RDBMS, SQL Server deployments often use an AD account instead of a local user account to run as. Windows environments are often fully Microsoft homogeneous which is designed to tie in well with AD. Based on this, I recommend your approach be driven by your confidence in your LDAP directory to remain online and available to your Linux hosts. – John Eisbrener Jun 13 '17 at 15:09
0

I worked with an insurance company that used active directory on all of their Redhat Linux servers so that their DBA's could log in with their own credentials. The DBA's would then SUDO to Oracle which did not have a password. Hence, the upper management could track when DBA's logged into each server. Using AD can work well in Linux the manage authentication. It also makes for fewer passwords that the DBA's need to remember.

|improve this answer
  • You're right. Tying into AD is very convenient. In fact we are doing that for administrators with great success. The question, however, is whether it is a good (or bad) idea to also put the oracle (or any other service account) into AD (or LDAP). – LJKims Jun 13 '17 at 15:00
  • Some companies want their DBA's to log in using a unique account and sudo for Oracle. Hence in this case you don't need to be able to authenticate using the Oracle user directly. Hence, you might not want Oracle to be in AD. But if you only had one DBA and that DBA logged in only as Oracle, then sure you can authenticate Oracle using AD. – Gandolf989 Jun 13 '17 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.