Note
This parameter is deprecated starting from V4.2.5 BP2. You can query and modify this parameter, but the changes will not take effect.
Description
ob_ssl_invited_common_names specifies the list of application identities for the current tenant. These identities are obtained from the cn field (common name) in the subject of the client certificate used for SSL mutual authentication.
Privilege requirements
Query the parameter
The
systenant and all user tenants can use theSHOW PARAMETERSstatement or theGV$OB_PARAMETERSview to query this parameter.Modify the parameter
The
systenant and user tenants cannot modify this parameter.
Attributes
| Attribute | Description |
|---|---|
| Type | String |
| Default value | NONE |
| Modifiable | Yes. You can use the ALTER SYSTEM SET statement to modify the parameter. |
| Effective upon OBServer node restart | No. The setting takes effect immediately. |
Considerations
After the password of a user is verified when the user logs in to the server, the system checks whether the following three conditions are met. If they are, the login is restricted:
- The client has enabled SSL, and the client certificate uses mutual authentication.
- The server has configured an application allowlist, which is not empty.
- The
cnfield in the subject of the client certificate is not in the allowlist.
If any of the three conditions is not met, the allowlist check is skipped.
Examples
Set the value of the cn field in the client certificate to ALIPAY.
obclient> ALTER SYSTEM SET ob_ssl_invited_common_names = 'ALIPAY';