CODEWITHSUNDEEP
apiauthenticationoauth-2.0iis-10oracle-ords
JacquesB
JacquesB

Reputation: 37

ORDS authentication: username and password possible?

I'm using Oracle Rest Data Services (ORDS) to build APIs.

The client requires basic authentication (username and password). This does not seem to be supported by OAUTH2.

Is there another way I can protect the APIs by means of just a username and password?

EDIT: We are using IIS10 - is it possible to setup basic authentication from an IIS perspective?

Upvotes: 0

Views: 1670

Answers (1)

thatjeffsmith
thatjeffsmith

Reputation: 22427

Yes you can, but we don't recommend it.

You can create an ORDS user (use the user command), and assign a password and one or more roles.

You can fall back to database user/password auth. That authenticated user session is given a role called 'SQL Developer,' so if your REST API was protected via privilege that was also put into the 'SQL Developer' role, it would get authorized.

We don't recommend this for a few reasons.

One of the biggest is how much slower it is. We have to make an actual database connection to ensure your user/password combo are correct. That takes TIME.

Hence, we point folks to OAuth2, or something higher up the stack like an API Gateway.

Coming later this year, we'll have out-of-the-box support for OpenID. This will add tremendous amounts of flexibility without sacrificing security or performance.

Disclaimer: I work for Oracle and am a product manager for ORDS.

Upvotes: 3

Related Questions