Note
Due to feature adjustments, this parameter is deprecated starting from V4.4.1. You can query and modify this parameter, but the changes will not take effect.
Description
ob_ssl_invited_common_names specifies the list of application identities for the current tenant. These identities are obtained from the cn field in the subject of the client certificate used in SSL mutual authentication.
Privilege requirements
Query the parameter
The
systenant and all user tenants can query this parameter by using theSHOW PARAMETERSstatement or theGV$OB_PARAMETERSview.Modify the parameter
The
systenant and user tenants cannot modify this parameter.
Attributes
| Attribute | Description |
|---|---|
| Type | String |
| Default value | NONE |
| Modifiable | Yes. You can use the ALTER SYSTEM SET statement to modify the parameter. |
| Effective upon OBServer node restart | No. The setting takes effect immediately. |
Considerations
After the password of a user is verified, the system checks whether the following three conditions are met. If so, the user is denied from logging in.
- The client has enabled SSL, and the client certificate and private key use mutual authentication.
- The server has configured an application allowlist, which is not empty.
- The
cnfield in the subject of the client certificate is not in the allowlist.
If any of the three conditions is not met, the allowlist check is skipped.
Examples
Set the value of the cn field in the client certificate to ALIPAY.
obclient> ALTER SYSTEM SET ob_ssl_invited_common_names = 'ALIPAY';