Database Only Authentication

Posted in 2015

Topics: Security, Permissions & Auditing, Platform-Specific Issues

DAN MUELLER — Tue, 13 Jan 2015 15:59:13 — source: IIUG Forums & Mailing Lists

AIX 6.1 11.70.FC8XB8 Folks, I know that Informix historically relied on Unix access to a server to authenticate access to the database. I also know that LDAP access allows for userid/password or challenge authentication to the database. What I do not know is if there is a database only authentification access method to the database or if there ever will be. Can someone on here please provide those answers to me and the way to do it if in deed it does exist? Thanx, Dan

↪ replying to DAN MUELLER

Fernando Nunes — Tue, 13 Jan 2015 16:23:07 — source: IIUG Forums & Mailing Lists

With newer versions you can. Check the CREATE USER/ALTER USER documentation. You'll need to also setup MAPPED USERS becuase for some activities we need a real user ID: 1- To execute SYSTEM statements in procedures 2- To generate EXPLAIN files 3- To generate SPL trace/debug files 4- ??? Please add if I'm missing something.... These are the good news. The bad news in my humble opinion is that the implementation is relatively poor. From my perspective we're missing: 1- Password strength validation 2- Password expiration rules 3- Account locking after repeatedly invalid access attempts This was introduced in some 11.70 fixpack, not sure if it was FC1, but almost sure no later than FC3... HTH Regards On Tue, Jan 13, 2015 at 3:59 PM, DAN MUELLER <ddmueller@intercall.com> wrote: > AIX 6.1 > 11.70.FC8XB8 > > Folks, > > I know that Informix historically relied on Unix access to a server to > authenticate access to the database. I also know that LDAP access allows > for > userid/password or challenge authentication to the database. What I do not > know is if there is a database only authentification access method to the > database or if there ever will be. Can someone on here please provide those > answers to me and the way to do it if in deed it does exist? > > Thanx, > Dan > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > -- Fernando Nunes Portugal http://informix-technology.blogspot.com My email works... but I don't check it frequently... --001a11c2f49a8af9ff050c8b099a

↪ replying to DAN MUELLER

GREG DEWINTER — Tue, 13 Jan 2015 21:34:27 — source: IIUG Forums & Mailing Lists

Dan, Do a search in the 11.70 info center for "internally authenticated users" or following this link (if is pastes correctly) http://www-01.ibm.com/support/knowledgecenter/SSGU8G_11.70.0/com.ibm.sec.doc/ids _am_049.htm Greg