You are viewing a plain text version of this content. The canonical link for it is here.
Posted to derby-user@db.apache.org by Robert DiPietro <Ro...@accelrys.com> on 2012/01/13 19:40:56 UTC
Authentication and passwords in derby.properties
Hello!
I have been deving against a Derby DB on which requireAuthentication is true, the provider is built-in, and all users have been defined in the derby.properties file (so they are all system level users). This has been extremely convenient in development, however there are obvious concerns about having the password stored in plaintext in a file.
Is it possible to require authentication in built-in mode, but have no system level users defined in derby.properties, rather only defined at database level (stored internally on the database)?
For example, I have tried disabling requireAuthentication, logging in to the system, creating a db, and then creating a user against it using these commands:
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.database.propertiesOnly','true');
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.connection.requireAuthentication', 'true');
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.authentication.provider', 'BUILTIN');
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.user.username', 'password');
Which seems to work, but then if I enable requireAuthentication in derby.properties, I can no longer log in. I guess this makes sense since the system level property (and lack of user) overrides the database level property.
So back to my question, is it possible to access an instance in Derby using only database users without having a system level user in derby.properties in a way that prohibits people from connecting at a system level and doing whatever they like?
I'm working with Derby 10.8.x. Reading through the various documentation has left me a bit confused and I figured I would reach out to the experts. Thank you for any and all help.
Regards,
Rob DiPietro
Re: AZQRE: Authentication and passwords in derby.properties
Posted by Rick Hillegas <ri...@oracle.com>.
Hi Rob,
If I understand your needs correctly, you want to be able to do the
following:
1) Store credentials in a database managed by a Derby NetworkServer.
2) Prevent random users from creating databases on the server machine by
running ij from their client desktops.
Unfortunately, you don't have a lot of options with Derby's BUILTIN
authentication scheme. Either a) you expose the plaintext credentials in
system properties or the derby.properties file, or b) you store the
credentials in a Derby database where they can't be used to authenticate
system-wide operations like database creation and engine shutdown. I
believe that your options are:
A) Use LDAP authentication on the server machine. See
http://db.apache.org/derby/docs/10.8/devguide/devguide-single.html#cdevcsecure38522
B) Write your own custom authenticator which runs on the server machine
and stores credentials in a Derby database. See
http://db.apache.org/derby/docs/10.8/publishedapi/jdbc4/
C) Wait for release 10.9. In 10.9 we expect to introduce NATIVE
authentication. NATIVE authentication will store credentials in a Derby
database and let you use them to authenticate system-wide operations
like database creation and engine shutdown. For more information, see
the UserManagement.html spec attached to DERBY-866.
Hope this helps,
-Rick
On 1/17/12 12:06 PM, Robert DiPietro wrote:
> Thanks for your response Kristian.
>
> Following your ij session... it works and access to the 'mdb' instance is restricted to the 'mdb' database user. But someone can then still run ij and create other databases and users. This is what I am trying to avoid.
>
> I was hoping there was a way to do this without having a system level username/password defined in derby.properties in plain text.
>
> So is that possible?
>
> Thanks again,
>
> Rob DiPietro
>
> -----Original Message-----
> From: Kristian Waagan [mailto:kristian.waagan@oracle.com]
> Sent: Tuesday, January 17, 2012 1:52 AM
> To: derby-user@db.apache.org
> Subject: Re: Authentication and passwords in derby.properties
>
> On 16.01.12 16:05, Robert DiPietro wrote:
>> Hi Knut,
>>
>> Thanks for your response. I tried setting the properties with derby completely lowercase and still don't seem to be having much luck with what I am trying to do.
>>
>> I have tried this a few different ways. Let me try to step through what I'm doing (and trying to do) and maybe you'll catch where I am going wrong:
>>
>> Here's what my derby.properties looks like (with auth disabled and the system level user disabled).
>>
>> #derby.connection.requireAuthentication=true
>> #derby.authentication.provider=BUILTIN
>> #derby.user.adminuser=adminpass
>> derby.drda.portNumber=9947
>> derby.drda.host=0.0.0.0
>> derby.infolog.append=true
>> derby.stream.error.file=C:/logs/javaserver_derby.log
>>
>> We have Derby running inside of a Tomcat process/service. I use RazorSQL as my interface to Derby.
>>
>> So today I tried:
>>
>> 1. Create database/user via the connection string:
>> jdbc:derby://localhost:9947/mdb;create=true;user=mdb;password=mdb
>> without specifying a username/password in the RazorSQL connection profile. This works.
>>
>> 2. Modify the profile to use the mdb user/pass and remove the connection string parameters and connect. This works.
>>
>> 3. Issue the following to Derby while logged in as MasterDB:
>>
>> CALL
>> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.database.propertiesOnly'
>> ,'true'); CALL
>> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.connection.requireAuthen
>> tication', 'true'); CALL
>> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.authentication.provider'
>> , 'BUILTIN');
>>
>> This works, and I can still log in.
> Hi,
>
> When I perform the above steps, I'm not able to log into the database at all.
> If I additionally do
> CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.user.mdb', 'mdb'); , I can only connect with that user/pass.
>
> Here's from the ij session:
> ij> connect 'jdbc:derby:mdb;create=true;user=mdb;password=mdb';
>
> ij> CALL
> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.database.propertiesOnly','true');
>
> 0 rows inserted/updated/deleted
> ij> CALL
> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.connection.requireAuthentication',
> 'true');
> 0 rows inserted/updated/deleted
> ij> CALL
> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.authentication.provider',
> 'BUILTIN');
> 0 rows inserted/updated/deleted
> ij> CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.user.mdb',
> 'mdb');
> 0 rows inserted/updated/deleted
> ij> disconnect;
>
> ij> connect 'jdbc:derby:mdb;shutdown=true;user=mdb;password=mdb';
>
> ERROR 08006: Database 'mdb' shutdown.
> ij> connect 'jdbc:derby:mdb';
> ERROR 08004: Connection authentication failure occurred. Reason:
> Invalid authentication..
> ij> connect 'jdbc:derby:mdb;user=mdb;password=incorrect';
> ERROR 08004: Connection authentication failure occurred. Reason:
> Invalid authentication..
> ij> connect 'jdbc:derby:mdb;user=mdb;password=mdb';
> ij> disconnect;
> ij> connect 'jdbc:derby:mdb;shutdown=true';
> ERROR 08004: Connection authentication failure occurred. Reason:
> Invalid authentication..
> ij> connect 'jdbc:derby:mdb;shutdown=true;user=mdb;password=mdb';
> ERROR 08006: Database 'mdb' shutdown.
> ij>
>
>
> When using the BUILTIN scheme, users defined in derby.properties are
> system-wide, whereas users defined as database properties are specific
> to that database.
>
>
> Regards,
AZQRE: Authentication and passwords in derby.properties
Posted by Robert DiPietro <Ro...@accelrys.com>.
Thanks for your response Kristian.
Following your ij session... it works and access to the 'mdb' instance is restricted to the 'mdb' database user. But someone can then still run ij and create other databases and users. This is what I am trying to avoid.
I was hoping there was a way to do this without having a system level username/password defined in derby.properties in plain text.
So is that possible?
Thanks again,
Rob DiPietro
-----Original Message-----
From: Kristian Waagan [mailto:kristian.waagan@oracle.com]
Sent: Tuesday, January 17, 2012 1:52 AM
To: derby-user@db.apache.org
Subject: Re: Authentication and passwords in derby.properties
On 16.01.12 16:05, Robert DiPietro wrote:
> Hi Knut,
>
> Thanks for your response. I tried setting the properties with derby completely lowercase and still don't seem to be having much luck with what I am trying to do.
>
> I have tried this a few different ways. Let me try to step through what I'm doing (and trying to do) and maybe you'll catch where I am going wrong:
>
> Here's what my derby.properties looks like (with auth disabled and the system level user disabled).
>
> #derby.connection.requireAuthentication=true
> #derby.authentication.provider=BUILTIN
> #derby.user.adminuser=adminpass
> derby.drda.portNumber=9947
> derby.drda.host=0.0.0.0
> derby.infolog.append=true
> derby.stream.error.file=C:/logs/javaserver_derby.log
>
> We have Derby running inside of a Tomcat process/service. I use RazorSQL as my interface to Derby.
>
> So today I tried:
>
> 1. Create database/user via the connection string:
> jdbc:derby://localhost:9947/mdb;create=true;user=mdb;password=mdb
> without specifying a username/password in the RazorSQL connection profile. This works.
>
> 2. Modify the profile to use the mdb user/pass and remove the connection string parameters and connect. This works.
>
> 3. Issue the following to Derby while logged in as MasterDB:
>
> CALL
> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.database.propertiesOnly'
> ,'true'); CALL
> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.connection.requireAuthen
> tication', 'true'); CALL
> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.authentication.provider'
> , 'BUILTIN');
>
> This works, and I can still log in.
Hi,
When I perform the above steps, I'm not able to log into the database at all.
If I additionally do
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.user.mdb', 'mdb'); , I can only connect with that user/pass.
Here's from the ij session:
ij> connect 'jdbc:derby:mdb;create=true;user=mdb;password=mdb';
ij> CALL
SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.database.propertiesOnly','true');
0 rows inserted/updated/deleted
ij> CALL
SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.connection.requireAuthentication',
'true');
0 rows inserted/updated/deleted
ij> CALL
SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.authentication.provider',
'BUILTIN');
0 rows inserted/updated/deleted
ij> CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.user.mdb',
'mdb');
0 rows inserted/updated/deleted
ij> disconnect;
ij> connect 'jdbc:derby:mdb;shutdown=true;user=mdb;password=mdb';
ERROR 08006: Database 'mdb' shutdown.
ij> connect 'jdbc:derby:mdb';
ERROR 08004: Connection authentication failure occurred. Reason:
Invalid authentication..
ij> connect 'jdbc:derby:mdb;user=mdb;password=incorrect';
ERROR 08004: Connection authentication failure occurred. Reason:
Invalid authentication..
ij> connect 'jdbc:derby:mdb;user=mdb;password=mdb';
ij> disconnect;
ij> connect 'jdbc:derby:mdb;shutdown=true';
ERROR 08004: Connection authentication failure occurred. Reason:
Invalid authentication..
ij> connect 'jdbc:derby:mdb;shutdown=true;user=mdb;password=mdb';
ERROR 08006: Database 'mdb' shutdown.
ij>
When using the BUILTIN scheme, users defined in derby.properties are
system-wide, whereas users defined as database properties are specific
to that database.
Regards,
--
Kristian
>
> *However* what I want at this point is for no one else to be able to log in access this database or issue commands to Derby besides the "mdb" user that I created. My thought was to I enable authentication in derby.properties. However this then disallows access to the "mdb" user (I assume because the settings in derby.properies supercede the database level properties).
>
> So either I am doing something wrong, or what I want to do is not possible in Derby.
>
> Can I have a single database user that can log in and act against a single database schema without having a user declared in derby.properties in plain text. And can I deny access to Derby/schema to everyone else? If this is possible, can someone walk me through the steps to accomplish it.
>
> Thanks,
>
> Rob DiPietro
>
>
>
> -----Original Message-----
> From: Knut Anders Hatlen [mailto:knut.hatlen@oracle.com]
> Sent: Saturday, January 14, 2012 7:37 AM
> To: Derby Discussion
> Subject: Re: Authentication and passwords in derby.properties
>
> Robert DiPietro<Ro...@accelrys.com> writes:
>
>> Hello!
>>
>> I have been deving against a Derby DB on which requireAuthentication
>> is true, the provider is built-in, and all users have been defined in
>> the derby.properties file (so they are all system level users). This
>> has been extremely convenient in development, however there are
>> obvious concerns about having the password stored in plaintext in a
>> file.
>>
>> Is it possible to require authentication in built-in mode, but have no
>> system level users defined in derby.properties, rather only defined at
>> database level (stored internally on the database)?
>>
>> For example, I have tried disabling requireAuthentication, logging in
>> to the system, creating a db, and then creating a user against it
>> using these commands:
>>
>> CALL
>> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.database.propertiesOnly'
>> ,'true'); CALL
>> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.connection.requireAuthen
>> tication', 'true'); CALL
>> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.authentication.provider'
>> , 'BUILTIN'); CALL
>> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.user.username',
>> 'password');
>>
>> Which seems to work, but then if I enable requireAuthentication in
>> derby.properties, I can no longer log in.
>
> Hi Robert,
>
> The property names should start with 'derby' (all lowercase), not 'Derby'. Does it work as expected if you change the case of the initial letter?
>
> --
> Knut Anders
>
>
Re: Authentication and passwords in derby.properties
Posted by Kristian Waagan <kr...@oracle.com>.
On 16.01.12 16:05, Robert DiPietro wrote:
> Hi Knut,
>
> Thanks for your response. I tried setting the properties with derby completely lowercase and still don't seem to be having much luck with what I am trying to do.
>
> I have tried this a few different ways. Let me try to step through what I'm doing (and trying to do) and maybe you'll catch where I am going wrong:
>
> Here's what my derby.properties looks like (with auth disabled and the system level user disabled).
>
> #derby.connection.requireAuthentication=true
> #derby.authentication.provider=BUILTIN
> #derby.user.adminuser=adminpass
> derby.drda.portNumber=9947
> derby.drda.host=0.0.0.0
> derby.infolog.append=true
> derby.stream.error.file=C:/logs/javaserver_derby.log
>
> We have Derby running inside of a Tomcat process/service. I use RazorSQL as my interface to Derby.
>
> So today I tried:
>
> 1. Create database/user via the connection string:
> jdbc:derby://localhost:9947/mdb;create=true;user=mdb;password=mdb
> without specifying a username/password in the RazorSQL connection profile. This works.
>
> 2. Modify the profile to use the mdb user/pass and remove the connection string parameters and connect. This works.
>
> 3. Issue the following to Derby while logged in as MasterDB:
>
> CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.database.propertiesOnly','true');
> CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.connection.requireAuthentication', 'true');
> CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.authentication.provider', 'BUILTIN');
>
> This works, and I can still log in.
Hi,
When I perform the above steps, I'm not able to log into the database at
all.
If I additionally do
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.user.mdb', 'mdb');
, I can only connect with that user/pass.
Here's from the ij session:
ij> connect 'jdbc:derby:mdb;create=true;user=mdb;password=mdb';
ij> CALL
SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.database.propertiesOnly','true');
0 rows inserted/updated/deleted
ij> CALL
SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.connection.requireAuthentication',
'true');
0 rows inserted/updated/deleted
ij> CALL
SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.authentication.provider',
'BUILTIN');
0 rows inserted/updated/deleted
ij> CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.user.mdb',
'mdb');
0 rows inserted/updated/deleted
ij> disconnect;
ij> connect 'jdbc:derby:mdb;shutdown=true;user=mdb;password=mdb';
ERROR 08006: Database 'mdb' shutdown.
ij> connect 'jdbc:derby:mdb';
ERROR 08004: Connection authentication failure occurred. Reason:
Invalid authentication..
ij> connect 'jdbc:derby:mdb;user=mdb;password=incorrect';
ERROR 08004: Connection authentication failure occurred. Reason:
Invalid authentication..
ij> connect 'jdbc:derby:mdb;user=mdb;password=mdb';
ij> disconnect;
ij> connect 'jdbc:derby:mdb;shutdown=true';
ERROR 08004: Connection authentication failure occurred. Reason:
Invalid authentication..
ij> connect 'jdbc:derby:mdb;shutdown=true;user=mdb;password=mdb';
ERROR 08006: Database 'mdb' shutdown.
ij>
When using the BUILTIN scheme, users defined in derby.properties are
system-wide, whereas users defined as database properties are specific
to that database.
Regards,
--
Kristian
>
> *However* what I want at this point is for no one else to be able to log in access this database or issue commands to Derby besides the "mdb" user that I created. My thought was to I enable authentication in derby.properties. However this then disallows access to the "mdb" user (I assume because the settings in derby.properies supercede the database level properties).
>
> So either I am doing something wrong, or what I want to do is not possible in Derby.
>
> Can I have a single database user that can log in and act against a single database schema without having a user declared in derby.properties in plain text. And can I deny access to Derby/schema to everyone else? If this is possible, can someone walk me through the steps to accomplish it.
>
> Thanks,
>
> Rob DiPietro
>
>
>
> -----Original Message-----
> From: Knut Anders Hatlen [mailto:knut.hatlen@oracle.com]
> Sent: Saturday, January 14, 2012 7:37 AM
> To: Derby Discussion
> Subject: Re: Authentication and passwords in derby.properties
>
> Robert DiPietro<Ro...@accelrys.com> writes:
>
>> Hello!
>>
>> I have been deving against a Derby DB on which requireAuthentication
>> is true, the provider is built-in, and all users have been defined in
>> the derby.properties file (so they are all system level users). This
>> has been extremely convenient in development, however there are
>> obvious concerns about having the password stored in plaintext in a
>> file.
>>
>> Is it possible to require authentication in built-in mode, but have no
>> system level users defined in derby.properties, rather only defined at
>> database level (stored internally on the database)?
>>
>> For example, I have tried disabling requireAuthentication, logging in
>> to the system, creating a db, and then creating a user against it
>> using these commands:
>>
>> CALL
>> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.database.propertiesOnly'
>> ,'true'); CALL
>> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.connection.requireAuthen
>> tication', 'true'); CALL
>> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.authentication.provider'
>> , 'BUILTIN'); CALL
>> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.user.username',
>> 'password');
>>
>> Which seems to work, but then if I enable requireAuthentication in
>> derby.properties, I can no longer log in.
>
> Hi Robert,
>
> The property names should start with 'derby' (all lowercase), not 'Derby'. Does it work as expected if you change the case of the initial letter?
>
> --
> Knut Anders
>
>
RE: Authentication and passwords in derby.properties
Posted by Robert DiPietro <Ro...@accelrys.com>.
Hi Knut,
Thanks for your response. I tried setting the properties with derby completely lowercase and still don't seem to be having much luck with what I am trying to do.
I have tried this a few different ways. Let me try to step through what I'm doing (and trying to do) and maybe you'll catch where I am going wrong:
Here's what my derby.properties looks like (with auth disabled and the system level user disabled).
#derby.connection.requireAuthentication=true
#derby.authentication.provider=BUILTIN
#derby.user.adminuser=adminpass
derby.drda.portNumber=9947
derby.drda.host=0.0.0.0
derby.infolog.append=true
derby.stream.error.file=C:/logs/javaserver_derby.log
We have Derby running inside of a Tomcat process/service. I use RazorSQL as my interface to Derby.
So today I tried:
1. Create database/user via the connection string:
jdbc:derby://localhost:9947/mdb;create=true;user=mdb;password=mdb
without specifying a username/password in the RazorSQL connection profile. This works.
2. Modify the profile to use the mdb user/pass and remove the connection string parameters and connect. This works.
3. Issue the following to Derby while logged in as MasterDB:
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.database.propertiesOnly','true');
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.connection.requireAuthentication', 'true');
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.authentication.provider', 'BUILTIN');
This works, and I can still log in.
*However* what I want at this point is for no one else to be able to log in access this database or issue commands to Derby besides the "mdb" user that I created. My thought was to I enable authentication in derby.properties. However this then disallows access to the "mdb" user (I assume because the settings in derby.properies supercede the database level properties).
So either I am doing something wrong, or what I want to do is not possible in Derby.
Can I have a single database user that can log in and act against a single database schema without having a user declared in derby.properties in plain text. And can I deny access to Derby/schema to everyone else? If this is possible, can someone walk me through the steps to accomplish it.
Thanks,
Rob DiPietro
-----Original Message-----
From: Knut Anders Hatlen [mailto:knut.hatlen@oracle.com]
Sent: Saturday, January 14, 2012 7:37 AM
To: Derby Discussion
Subject: Re: Authentication and passwords in derby.properties
Robert DiPietro <Ro...@accelrys.com> writes:
> Hello!
>
> I have been deving against a Derby DB on which requireAuthentication
> is true, the provider is built-in, and all users have been defined in
> the derby.properties file (so they are all system level users). This
> has been extremely convenient in development, however there are
> obvious concerns about having the password stored in plaintext in a
> file.
>
> Is it possible to require authentication in built-in mode, but have no
> system level users defined in derby.properties, rather only defined at
> database level (stored internally on the database)?
>
> For example, I have tried disabling requireAuthentication, logging in
> to the system, creating a db, and then creating a user against it
> using these commands:
>
> CALL
> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.database.propertiesOnly'
> ,'true'); CALL
> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.connection.requireAuthen
> tication', 'true'); CALL
> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.authentication.provider'
> , 'BUILTIN'); CALL
> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.user.username',
> 'password');
>
> Which seems to work, but then if I enable requireAuthentication in
> derby.properties, I can no longer log in.
Hi Robert,
The property names should start with 'derby' (all lowercase), not 'Derby'. Does it work as expected if you change the case of the initial letter?
--
Knut Anders
Re: Authentication and passwords in derby.properties
Posted by Knut Anders Hatlen <kn...@oracle.com>.
Robert DiPietro <Ro...@accelrys.com> writes:
> Hello!
>
> I have been deving against a Derby DB on which requireAuthentication
> is true, the provider is built-in, and all users have been defined in
> the derby.properties file (so they are all system level users). This
> has been extremely convenient in development, however there are
> obvious concerns about having the password stored in plaintext in a
> file.
>
> Is it possible to require authentication in built-in mode, but have no
> system level users defined in derby.properties, rather only defined at
> database level (stored internally on the database)?
>
> For example, I have tried disabling requireAuthentication, logging in
> to the system, creating a db, and then creating a user against it
> using these commands:
>
> CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.database.propertiesOnly','true');
> CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.connection.requireAuthentication', 'true');
> CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.authentication.provider', 'BUILTIN');
> CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('Derby.user.username', 'password');
>
> Which seems to work, but then if I enable requireAuthentication in
> derby.properties, I can no longer log in.
Hi Robert,
The property names should start with 'derby' (all lowercase), not
'Derby'. Does it work as expected if you change the case of the initial
letter?
--
Knut Anders