Kingbasees Security Guide for Jincang database -- 6.1 introduction to strong authentication

6.1.  Introduction to strong authentication

6.1.1.  About strong authentication

When a user accesses a system , The system usually requires users to provide some information to mark their identity and the ability to use the system . The system verifies this information to determine whether users are allowed to access 、 What functions can users access . This is the process of user authentication . When the number of users of the system is huge , The management and use of system account information will be a complex problem . Dealing with this problem within the system may deviate from the functions that the system itself should provide , Therefore, it is a better solution to separate it and hand it over to another service .

Identity authentication is the process that the database server establishes the identity of the client , And the server decides whether the client application is allowed to connect with the requested database user name .KingbaseES Provide a variety of different identity authentication methods . Password is the most common way of authentication ,KingbaseES Strong authentication is also enabled by supporting a variety of third-party authentication services .

6.1.2.  How strong authentication works

Third party authentication server and database , Use with client , The basic working principle is as follows ：

1. client （ Or the user running the client application ） Provide information such as passwords or tokens to the authentication server ;

2. The authentication server verifies the user's identity and returns the credentials to the client ;

3. The client passes these credentials and service requests to the database server ;

4. The database server sends the credentials to the authentication server to request authentication ;

5. The authentication server checks the credentials and notifies the database server of the authentication results . If the authentication server accepts credentials , The authentication is successful . If the authentication server rejects the credentials , Then the client's request will be rejected ;

6.1.3.  Strong authentication methods supported

KingbaseES The database supports a variety of third-party service authentication methods , As shown in the following table ：

surface 6.1.3  Strong authentication

authentication	explain
scram-sha-256	perform SCRAM-SHA-256 Authenticate to verify the user's password
md5	perform SCRAM-SHA-256 or MD5 Authenticate to verify the user's password
Kerberos	Kerberos It is a trusted third-party authentication system that relies on shared secrets , Support use keberos The server performs centralized identity authentication
ldap	LDAP It's a kind of passing IP The protocol provides directory information for access control and maintenance of distributed information , Support use LDAP Server authentication
radius	RADIUS It's a client / Security protocol of server , Support use LDAP Server authentication
cert	Use SSL Client certificate authentication
gss	use GSSAPI Authenticated user . Only right TCP/IP Connection available .
sspi	use SSPI To authenticate users . Only in Windows Available on the .
ident	Allow specific operating system users on the client to connect to the database .Ident Certification can only be done in TCIP/IP Use... On the connection .
peer	The operating system user who obtains the client from the operating system , And check that it matches the requested database user name . This is only available for local connections .
pam	Using the pluggable authentication module service provided by the operating system （PAM） authentication
bsd	Use... Provided by the operating system BSD Authentication services to authenticate

The configuration and use of specific authentication methods will be described in detail in subsequent chapters .