驗證使用者 

驗證指的是對要使用資料、資源或應用程式的使用者、裝置或其它實體的身份進行驗證。通過對該身份進行驗證可建立一種信任關係，從而可進一步執行互動。通過驗證可將訪問和操作與特定的身份聯絡起來，從而實現可靠性。完成驗證後，驗證流程可允許或限制該實體許可的訪問和操作的級別。 

Oracle資料庫究竟使用OS認證還是口令檔案認證來進行管理取決於下面三個因素 
SQLNET.ORA引數檔案中的引數SQLNET.AUTHENTICATION_SERVICES設定
PFILE(SPFILE)引數檔案中的引數REMOTE_LOGIN_PASSWORDFILE設定擁有資料字典 
口令檔案orapw$SID(Linux) | PWD$SID.ora(Windows) 是否存SYSTEM 帳戶授予了 DBA 角色。 
Oracle許可權認證的基本順序
先由SQLNET.AUTHENTICATION_SERVICES的設定值來決定是使用OS認證還是口令檔案認證
如果使用口令檔案認證的話就要同時滿足下面兩個條件才能認證成功：
         1、REMOTE_LOGIN_PASSWORDFILE引數設定為非NONE
         2、口令檔案存在就能正常使用口令檔案認證，否則將會認證失敗

建立使用者時，必須確定要使用的驗證方法，以後可修改此方法。 
口令：又稱為 Oracle 資料庫驗證。建立的每一個使用者都有一個關聯口令，使用者嘗試建立連線時，必須提供這個口令。設定口令時，可以使該口令立即失效，這會強制使用者在首次登入後更改口令。如果決定要使使用者口令失效，請確保使用者能夠更改口令。有些應用程式不具備此功能。 
在（客戶機/伺服器之間和伺服器/伺服器之間）建立網路連線期間，系統總是先通過使用修改過的資料加密標準 (DES) 演算法，以自動透明方式對口令加密，然後通過網路傳送這些口令。

作業系統驗證：

conn / as sysdba既是作業系統認證，即使用作業系統使用者登入資料庫（root使用者不可以)，該使用者必須同時新增到dba組和oinstall中，如果只新增dba組也不可以

只能用在本地 因為資料庫軟體安裝在作業系統之上

密碼檔案驗證：

口令認證：必須啟動監聽，用於網路連線，否則認證失敗。

密碼檔案儲存的位置  $ORACLE_HOME/dbs/orapw$ORACLE_SID

實驗環境：

[[email protected] ~]$ id

uid=54321(oracle) gid=54321(oinstall) groups=54321(oinstall),54322(dba)
[[email protected]tyger ~]$ sqlplus / as sysdba


SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 09:15:35 2014


Copyright (c) 1982, 2005, Oracle.  All rights reserved.




Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options

[email protected]>select * from v$version;


BANNER
----------------------------------------------------------------
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod
PL/SQL Release 10.2.0.1.0 - Production
CORE    10.2.0.1.0      Production
TNS for Linux: Version 10.2.0.1.0 - Production

NLSRTL Version 10.2.0.1.0 - Production

SQLNET.AUTHENTICATION_SERVICES引數在SQLNET.ORA（位於$ORACLE_HOME/network/admin目錄中） 檔案中對於不同的作業系統SQLNET.AUTHENTICATION_SERVICES的取值會有些不一樣，通常我們會用到下面的一些設定值：
        linux下： none  all nts 不設定或BEQ 四種情況

第一種情況：

引數SQLNET.AUTHENTICATION_SERVICES不設定或設定為BEQ---------口令認證和作業系統認證都啟動 [[email protected]tygeradmin]$ pwd
/u01/app/oracle/product/10.2.0/db_1/network/admin
[[email protected] admin]$ ls
listener.ora  samples  shrept.lst  sqlnet.ora  tnsnames.ora
[[email protected] admin]$ vim sqlnet.ora 
NAME.DIRECTORY_PATH=(tnsnames,ezconnect)


SQLNET.AUTHENTICATION_SERVICES=(BEQ)
[[email protected] admin]$ lsnrctl status


LSNRCTL for Linux: Version 10.2.0.1.0 - Production on 28-FEB-2014 09:52:19


Copyright (c) 1991, 2005, Oracle.  All rights reserved.


Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=tyger )(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias                     LISTENER
Version                   TNSLSNR for Linux: Version 10.2.0.1.0 - Production
Start Date                28-FEB-2014 09:48:44
Uptime                    0 days 0 hr. 3 min. 34 sec
Trace Level               off
Security                  ON: Local OS Authentication
SNMP                      OFF
Listener Parameter File   /u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
Listener Log File         /u01/app/oracle/product/10.2.0/db_1/network/log/listener.log
Listening Endpoints Summary...
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=tyger )(PORT=1521)))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC0)))
Services Summary...
Service "ORCL" has 1 instance(s).
  Instance "ORCL", status READY, has 1 handler(s) for this service...
Service "ORCLXDB" has 1 instance(s).
  Instance "ORCL", status READY, has 1 handler(s) for this service...
Service "ORCL_XPT" has 1 instance(s).
  Instance "ORCL", status READY, has 1 handler(s) for this service...
Service "PLSExtProc" has 1 instance(s).
  Instance "PLSExtProc", status UNKNOWN, has 1 handler(s) for this service...
The command completed successfully
[[email protected] admin]$ sqlplus / as sysdba


SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 09:52:50 2014


Copyright (c) 1982, 2005, Oracle.  All rights reserved.




Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options


[email protected]>exit    
Disconnected from Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options
[[email protected] admin]$ cd /u01/app/oracle/product/10.2.0/db_1/dbs/
[[email protected] dbs]$ ls
hc_ORCL.dat  initdw.ora  init.ora  lkORCL  orapwORCL  spfileORCL.ora
[[email protected] dbs]$ sqlplus sys/[email protected] as sysdba


SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 09:53:51 2014


Copyright (c) 1982, 2005, Oracle.  All rights reserved.




Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options


[email protected]>
第二種情況： 引數SQLNET.AUTHENTICATION_SERVICES設定為 all  -----------------------遮蔽口令認證都啟用作業系統認證

[[email protected] admin]$ pwd
/u01/app/oracle/product/10.2.0/db_1/network/admin
[[email protected] admin]$ vim sqlnet.ora 
NAME.DIRECTORY_PATH=(tnsnames,ezconnect)

SQLNET.AUTHENTICATION_SERVICES=(ALL)

[[email protected] admin]$ sqlplus / as sysdba


SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 09:59:20 2014


Copyright (c) 1982, 2005, Oracle.  All rights reserved.




Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options


[email protected]>exit
Disconnected from Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options
[[email protected] admin]$ sqlplus sys/[email protected] as sysdba


SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 09:59:39 2014


Copyright (c) 1982, 2005, Oracle.  All rights reserved.


ERROR:
ORA-12641: Authentication service failed to initialize




Enter user-name: 
第三種情況： 引數SQLNET.AUTHENTICATION_SERVICES 設定為  NONE 或NTS ----------------遮蔽作業系統認證都啟用口令認證 [[email protected] admin]$ vim sqlnet.ora 
NAME.DIRECTORY_PATH=(tnsnames,ezconnect)


SQLNET.AUTHENTICATION_SERVICES=(NTS)
[[email protected] admin]$ sqlplus / as sysdba


SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 10:36:35 2014


Copyright (c) 1982, 2005, Oracle.  All rights reserved.


ERROR:
ORA-01031: insufficient privileges

[[email protected] admin]$ sqlplus sys/[email protected] as sysdba


SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 10:36:52 2014


Copyright (c) 1982, 2005, Oracle.  All rights reserved.




Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options


[email protected]>
第四種情況： 當資料庫遮蔽了作業系統認證，啟用口令認證方式的話，需要檢查remote_login_passwordfile引數，如果該引數設定為NONE,該值表示不使用口令檔案，因此，此時資料庫將不能登入 解決辦法：啟動作業系統認證，登入資料庫後將remote_login_passwordfile引數修改EXCLUSIVE，然後再遮蔽作業系統認證，啟用口令認證。 > remote_login_passwordfile引數可以設定為3個值 none、exclusive、shared  [[email protected] admin]$ cat sqlnet.ora 
NAME.DIRECTORY_PATH=(tnsnames,ezconnect)


SQLNET.AUTHENTICATION_SERVICES=(NTS)
[[email protected] admin]$ sqlplus sys/[email protected] as sysdba


SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 10:48:15 2014


Copyright (c) 1982, 2005, Oracle.  All rights reserved.




Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options


[email protected]>show parameter remote


NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
remote_archive_enable                string      true
remote_dependencies_mode             string      TIMESTAMP
remote_listener                      string
remote_login_passwordfile            string      EXCLUSIVE
remote_os_authent                    boolean     FALSE
remote_os_roles                      boolean     FALSE
[email protected]>alter system set remote_login_passwordfile=none scope=spfile;


System altered.

---靜態引數，重啟資料庫生效
[email protected]>shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
[email protected]>startup
ORA-12514: TNS:listener does not currently know of service requested in connect descriptor
[[email protected] admin]$ vim sqlnet.ora 


NAME.DIRECTORY_PATH=(tnsnames,ezconnect)


#SQLNET.AUTHENTICATION_SERVICES=(NTS)

[[email protected] admin]$ sqlplus / as sysdba


SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 10:57:25 2014


Copyright (c) 1982, 2005, Oracle.  All rights reserved.


Connected to an idle instance.


[email protected]>startup
ORACLE instance started.


Total System Global Area  285212672 bytes
Fixed Size                  1218992 bytes
Variable Size              96470608 bytes
Database Buffers          184549376 bytes
Redo Buffers                2973696 bytes
Database mounted.
Database opened.
[email protected]>show parameter remote


NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
remote_archive_enable                string      true
remote_dependencies_mode             string      TIMESTAMP
remote_listener                      string
remote_login_passwordfile            string      NONE
remote_os_authent                    boolean     FALSE
remote_os_roles                      boolean     FALSE
[email protected]>alter system set remote_login_passwordfile=exclusive scope=spfile;


System altered.
[email protected]>shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
[email protected]>startup
ORACLE instance started.


Total System Global Area  285212672 bytes
Fixed Size                  1218992 bytes
Variable Size              96470608 bytes
Database Buffers          184549376 bytes
Redo Buffers                2973696 bytes
Database mounted.
Database opened.
[email protected]>show parameter remote


NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
remote_archive_enable                string      true
remote_dependencies_mode             string      TIMESTAMP
remote_listener                      string
remote_login_passwordfile            string      EXCLUSIVE
remote_os_authent                    boolean     FALSE
remote_os_roles                      boolean     FALSE
[email protected]>exit
Disconnected from Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options
[[email protected] admin]$ sqlplus sys/[email protected] as sysdba


SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 11:04:16 2014


Copyright (c) 1982, 2005, Oracle.  All rights reserved.




Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options


[email protected]>