Note
The parameter is deprecated starting from V4.2.5 BP2 because the related feature has been modified. You can query and modify the parameter, but the parameter will not take effect.
Description
ob_ssl_invited_common_names is used to record the list of application identities running on the current tenant. These identities come from the cn (common name) field in the subject of the client certificate during SSL mutual authentication.
Privilege requirements
Query the parameter
Both the
systenant and all user tenants can use theSHOW PARAMETERSstatement or theGV$OB_PARAMETERSview to query this parameter.Modifying the parameter
Neither the
systenant nor user tenants can modify this parameter.
Attributes
| Attribute | Description |
|---|---|
| Parameter type | String |
| Default value | NONE |
| Modifiable | Yes, can be modified using the ALTER SYSTEM SET statement. |
| Effective upon OBServer node restart | No |
Considerations
After the user's password verification is completed when logging into the server, login will be restricted if all of the following three conditions are met:
- The client has SSL enabled, and the CA, certificate, or private key on the client side uses mutual authentication.
- The server has configured an application whitelist, and the whitelist is not empty.
- The
cnfield in the subject of the client certificate is not in the whitelist.
If any of the above three conditions are not met, the whitelist check is invalid and will be ignored.
Examples
Set the CN field value of the client certificate to ALIPAY.
obclient> ALTER SYSTEM SET ob_ssl_invited_common_names = 'ALIPAY';