Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:37565
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain oracle.com from 141.146.126.228 cause and error)
Message-ID: <482437A0.8080504@oracle.com>
Date: Fri, 09 May 2008 04:38:08 -0700
User-Agent: Thunderbird 2.0.0.14 (X11/20080505)
MIME-Version: 1.0
To: Michael B Allen <ioplex@gmail.com>
CC: internals@lists.php.net
References: <48234048.4060708@oracle.com> <78c6bd860805081407h57457a17k30154843dd9cf1b3@mail.gmail.com>
In-Reply-To: <78c6bd860805081407h57457a17k30154843dd9cf1b3@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Supporting External Authentication in the Oracle OCI8
 Extension
From: christopher.jones@oracle.com (Christopher Jones)



Michael B Allen wrote:
> On Thu, May 8, 2008 at 2:02 PM, Christopher Jones
> <christopher.jones@oracle.com> wrote:
>>  I've had a couple of recent requests for the OCI8 extension to support
>>  "External Authentication" (aka OS authentication).  I also recall a
>>  discussion or two in the past, and there is at least one bug logged on
>>  it.
>>
>>  Having external authentication would allow things like Kerberos to be
>>  used for OCI8 authentication.  This need is clearly growing but I'm not
>>  in favor of having it always enabled in every web environment - I feel
>>  another php.ini parameter looming :(
>>
>>  If anyone wants to be throw in some comments or help me re-evaluate
>>  the pros and cons, drop me a line.
>>
>>  Some Oracle documentation discussing External Authentication is in:
>>
>> http://download.oracle.com/docs/cd/B28359_01/network.111/b28531/authentication.htm#CHDEGIFB
>>
>>  Chris
> 
> Hi Chris,
> 
> That's interesting but the scenario that is becoming more common and
> is the case I'm interested in is using an existing credential to
> initiate authentication with Oracle.
> 
> For example, using our extension a PHP script can acquire a Kerberos
> credential either through delegation (eg. during SPNEGO
> authentication), explicitly with a username and password (ie. get a
> TGT) or implicitly from the HTTP service account keytab file. The
> mod_auth_kerb module for Apache can also save the user's delegated
> Kerberos credential if present. Then Kerberos aware clients (e.g.
> pgsql_connect) look at the KRB5CCNAME environment variable and use
> that ccache file to acquire credentials for the desired resource.
> 
> Does the PHP oci8 extension handle this scenario?
> 
> Mike
> 

Without adding external authentication support, there is no support
for Kerberos at all.

Thanks for the use case.

Chris

-- 
Christopher Jones, Oracle
Email: christopher.jones@oracle.com    Tel:  +1 650 506 8630
Blog:  http://blogs.oracle.com/opal/   Free PHP Book: http://tinyurl.com/f8jad