1.1

Agent is considered authenticated and any RMI client has access to the connected distributed system. For RMI
client authentication, use MX4J security.
See Using Java Management Extensions (JMX) on page 291 for more information.
User Names in Authentication and Authorization
When working with both user authentication and user authorization, you need to understand how user names
are treated by each system.
User Names and Authorization Identifiers
User names within the SQLFire system are known as authorization identifiers. The authorization identifier is a
string that represents the name of the user, if one was provided in the connection request.
For example, the built-in function CURRENT_USER returns the authorization identifier for the current user.
Once the authorization identifier is passed to the SQLFire system, it becomes an SQL92Identifier. A
SQL92Identifier is a kind of identifier that represents a database object such as a table or column. These
identifiers are case-insensitive (they are converted to all caps) unless delimited with double quotes, are limited
to 128 characters, and have other limitations.
User names must be valid authorization identifiers even if user authentication is turned off, and even if all users
are allowed access to all databases.
For more information about SQL92Identifiers, see Standard SQL Identifiers on page 457.
Conversion of User Name to Authorization Identifier
If an external authentication system is used, the conversion of the user's name to an authorization identifier does
not happen until after authentication has occurred but before user authorization. Imagine, for example, a user
named Fred.
• Within the user authentication system, Fred is known as FRed. Your external user authorization service is
case-sensitive, so Fred must always type his name that way.
connect client 'localhost:1527;user=FRed;password=flintstone';
• Within the SQLFire user authorization system, Fred becomes a case-insensitive authorization identifier. Fred
is known as FRED.
• When specifying which users are authorized to access the system, you must list Fred's authorization identifier,
FRED (which you can type as FRED, FREd, or fred, since the system automatically converts it to all-uppercase).
sqlfire.authz-full-access-users=sa,FRED,mary
Let's take a second example, where Fred has a slightly different name within the user authentication system.
• Within the user authentication system, Fred is known as Fred!. You must now put double quotes around the
name, because it is not a valid SQL92Identifier . (SQLFire knows to remove the double quotes when
passing the name to the external authentication system.)
connect client 'localhost:1527;user="Fred!";password=flintstone';
• Within the SQLFire user authorization system, Fred becomes a case-sensitive authorization identifier. Fred is
known as Fred!.
• When specifying which users are authorized to access the accounting database, you must list Fred's authorization
identifier, "Fred!" (which you must always delimit with double quotation marks).
sqlfire.authz-full-access-users=sa,"Fred!",manager
As shown in the first example, your external authentication system may be case-sensitive, whereas the authorization
identifier within SQLFire may not be. If your authentication system allows two distinct users whose names differ
245
Configuring Authentication and Authorization