![](https://csdnimg.cn/release/download_crawler_static/10555186/bg10.jpg)
xvi
expired, or about to expire. It displays appropriate warnings or error messages in
these cases.
■ The Distinguished Name (DN) in the user certificate no longer needs to match the
DN in Oracle Internet Directory. This feature is useful if your public key
infrastructure (PKI) certificate authority does not support the use of two common
names (cn) in the DN. This also enables you to restructure your Directory without
requiring new certificates for users or databases. See "Configuring Enterprise User
Security for SSL Authentication" on page 4-19 for more information.
Enterprise User Security 10g Release 2 (10.2) also introduces several new proxying
features that enhance both security and ease of use:
■ Proxy permissions for specific enterprise users (or lists of enterprise users) can
now be created and stored in Oracle Internet Directory. Formerly, proxy
permissions could be granted only to a shared schema, necessarily enabling any
enterprise user in that shared schema to proxy as the target user.
■ Establishing a proxy session results in a single-user session. Formerly, switching
from the original connected session to proxy as the target user created a second,
independent session, with the first one also remaining active.
■ Proxy access is now possible through SQLPLUS as well as Oracle Call Interface
(OCI). Formerly, proxy access could be established only through OCI.
New proxying features are described in "Enterprise User Proxy" on page 1-18.
Oracle Database 10g Release 1 (10.1) New Features in Enterprise User
Security
Enterprise User Security 10g Release 1 (10.1) included the following new features:
■ Kerberos Authenticated Enterprise Users
Kerberos-based authentication to the database is available for users managed in an
LDAP directory. This includes Oracle Internet Directory or any other third-party
directory that is synchronized to work with Oracle Internet Directory by using the
Directory Integration Platform. To use this feature, all directory users, including
those synchronized from third-party directories, must include the Kerberos
principal name attribute (krbPrincipalName attribute).
■ Public key infrastructure (PKI) Credentials No Longer Required for
Database-to-Oracle Internet Directory Connections
In this release, a database can bind to Oracle Internet Directory by using
password/SASL-based authentication, eliminating the overhead of setting up PKI
credentials for the directory and multiple databases. SASL (Simple Authentication
and Security Layer) is a standard defined in the Internet Engineering Task Force
RFC 2222. It is a method for adding authentication support to connection-based
protocols such as LDAP.
See Also: "Password Policies" on page 1-14 for more information on
password policies and their management
See Also: "Configuring Enterprise User Security for Kerberos
Authentication" on page 4-16 for configuration details