Note
Due to feature adjustments, this parameter is deprecated starting from V4.4.1. You can query and modify this parameter, but the changes will not take effect.
Description
ob_ssl_invited_common_names specifies the list of application identities for the current tenant. The identities are obtained from the cn field (common name) in the subject of the client certificate used in SSL mutual authentication.
Privilege requirements
Query the parameter
The
systenant and all user tenants can use theSHOW PARAMETERSstatement or theGV$OB_PARAMETERSview to query this parameter.Modify the parameter
The
systenant and user tenants cannot modify this parameter.
Attributes
| Attribute | Description |
|---|---|
| Type | String |
| Default value | NONE |
| Modifiable | Yes. You can use the ALTER SYSTEM SET statement to modify the parameter. |
| Effective upon OBServer node restart | No. The setting takes effect immediately. |
Considerations
After the password of a user is verified when the user logs in to the server, the login is restricted if all of the following conditions are met:
- SSL is enabled on the client, and the client certificate is used for mutual authentication.
- The server has an application allowlist that is not empty.
- The
cnfield in the subject of the client certificate is not in the allowlist.
If any of the three conditions is not met, the allowlist check is skipped.
Examples
Set the CN field of the client certificate to ALIPAY.
obclient> ALTER SYSTEM SET ob_ssl_invited_common_names = 'ALIPAY';