Proxy User Overview Enabling and Configuring Proxy Users

9-12 Forms Services Deployment Guide establish communication with Reports Servers. For more information, see Oracle Fusion Middleware Publishing Reports to the Web with Oracle Reports Services.

9.6 Enabling and Configuring Proxy Users

This section contains the following: ■ Section 9.6.1, Proxy User Overview ■ Section 9.6.2, Enabling Proxy User Connections ■ Section 9.6.3, Enabling SSO in formsweb.cfg ■ Section 9.6.4, Accessing the Forms Application ■ Section 9.6.5, Changes in Forms Built-ins ■ Section 9.6.6, Reports Integration with Proxy Users

9.6.1 Proxy User Overview

Many large applications, including Oracles own E-Business Suite, use a single username for all connections. This makes it possible to manage users in a way that often suits large companies better but it creates a problem with auditing. All inserts, updates and removals of records appear, from the databases perspective, to have been done by a single user. To restore auditing, the application developers must write and implement customized auditing code in the database that requires a user name to be passed to the database from the application. This step not only takes development time, but also duplicates functionality that is already implemented in the Oracle Database. The second issue is security. If that single user access is ever compromised, the compromised user will have access to the entire application schema. To address these two issues, Oracle Database supports proxy user authentication, which allows a client user to connect to the database through an application server, as a proxy user. Figure 9–3 describes the authentication of a Forms proxy user. Figure 9–3 Proxy User Authentication Using Forms Services with Oracle Single Sign-On 9-13 ■ Oracle Forms authenticates the user through Oracle Internet Directory or LDAP, as shown in the center of the image. ■ Forms then connects as the proxy user with or without a password, passing in the real username from the Oracle Internet Directory repository. ■ Typically, the proxy user is configured with least set of privileges. In the following procedure, the proxy user has connect and create session privileges. ■ The database accepts the create session action for the proxy user and uses the real username in audits and access control. ■ The Oracle Internet Directory user cannot connect to the database independently without configuration of the proxy user account. ■ The proxy user account isolates the client from direct SQLPlus connections.

9.6.2 Enabling Proxy User Connections