1.1.1

JMX and Authentication
If you use the SQLFire JMX Agent to administer and manage an authentication-enabled distributed system, the
agent must provide security credentials. Security properties cannot be passed to a JMX Agent on the command
line, but they can be supplied at startup by adding the security-specific Java system properties (-D properties).
With the properties specified, the call to Agent.connectToSystem causes the agent to be authenticated with the
distributed system. SQLFire security does not manage RMI clients to the JMX Agent. Once connected, the JMX
Agent is considered authenticated and any RMI client has access to the connected distributed system. For RMI
client authentication, use MX4J security.
See Using Java Management Extensions (JMX) on page 295 for more information.
User Names in Authentication and Authorization
When working with both user authentication and user authorization, you need to understand how user names
are treated by each system.
User Names and Authorization Identifiers
User names within the SQLFire system are known as authorization identifiers. The authorization identifier is a
string that represents the name of the user, if one was provided in the connection request.
For example, the built-in function CURRENT_USER returns the authorization identifier for the current user.
Once the authorization identifier is passed to the SQLFire system, it becomes an SQL92Identifier. A
SQL92Identifier is a kind of identifier that represents a database object such as a table or column. These
identifiers are case-insensitive (they are converted to all caps) unless delimited with double quotes, are limited
to 128 characters, and have other limitations.
User names must be valid authorization identifiers even if user authentication is turned off, and even if all users
are allowed access to all databases.
For more information about SQL92Identifiers, see Standard SQL Identifiers on page 471.
Conversion of User Name to Authorization Identifier
If an external authentication system is used, the conversion of the user's name to an authorization identifier does
not happen until after authentication has occurred but before user authorization. Imagine, for example, a user
named Fred.
• Within the user authentication system, Fred is known as FRed. Your external user authorization service is
case-sensitive, so Fred must always type his name that way.
connect client 'localhost:1527;user=FRed;password=flintstone';
• Within the SQLFire user authorization system, Fred becomes a case-insensitive authorization identifier. Fred
is known as FRED.
• When specifying which users are authorized to access the system, you must list Fred's authorization identifier,
FRED (which you can type as FRED, FREd, or fred, since the system automatically converts it to all-uppercase).
sqlfire.authz-full-access-users=sa,FRED,mary
Let's take a second example, where Fred has a slightly different name within the user authentication system.
• Within the user authentication system, Fred is known as Fred!. You must now put double quotes around the
name, because it is not a valid SQL92Identifier . (SQLFire knows to remove the double quotes when
passing the name to the external authentication system.)
connect client 'localhost:1527;user="Fred!";password=flintstone';
249
Configuring Authentication and Authorization