Configuring NATIVE authentication

Derby's simplest authentication mechanism is NATIVE authentication.

When you use NATIVE authentication, user names and encrypted passwords are stored in a database. You can specify a dedicated credentials database for this purpose, or you can store the credentials in the same database you use for your application data. The credentials are stored in the SYSUSERS system table of the database.

To configure NATIVE authentication, follow these steps.

1. Use the SYSCS_UTIL.SYSCS_CREATE_USER system procedure to add credentials for the Database Owner. Remember that the Database Owner is the user who created the database.
2. Add credentials for other users.
3. Shut down the database, then reboot it. When the database reboots, NATIVE authentication is enabled.

For example, you can issue the following commands:

java org.apache.derby.tools.ij
ij version 10.11
ij> connect 'jdbc:derby:testdb;create=true;user=tquist';
ij> -- the Database Owner must be the first user you create
call SYSCS_UTIL.SYSCS_CREATE_USER( 'tquist', 'tquist' );
0 rows inserted/updated/deleted
ij> -- now add other users
call SYSCS_UTIL.SYSCS_CREATE_USER( 'thardy', 'thardy' );
0 rows inserted/updated/deleted
ij> call SYSCS_UTIL.SYSCS_CREATE_USER( 'jhallett', 'jhallett' );
0 rows inserted/updated/deleted
ij> call SYSCS_UTIL.SYSCS_CREATE_USER( 'mchrysta', 'mchrysta' );
0 rows inserted/updated/deleted
ij> -- shut down the database in order to turn on NATIVE authentication
connect 'jdbc:derby:testdb;shutdown=true';
ERROR 08006: Database 'testdb' shutdown.
ij> -- these connection attempts fail because of bad credentials
connect 'jdbc:derby:testdb;user=tquist';
ERROR 08004: Connection authentication failure occurred.  Reason: Invalid authentication..
ij> connect 'jdbc:derby:testdb;user=thardy;password=tquist';
ERROR 08004: Connection authentication failure occurred.  Reason: Invalid authentication..
ij> -- these connection attempts present good credentials, so they succeed
connect 'jdbc:derby:testdb;user=tquist;password=tquist';
ij(CONNECTION1)> connect 'jdbc:derby:testdb;user=thardy;password=thardy';
ij(CONNECTION2)> connect 'jdbc:derby:testdb;user=jhallett;password=jhallett';
ij(CONNECTION3)> connect 'jdbc:derby:testdb;user=mchrysta;password=mchrysta';

• Enabling NATIVE authentication explicitly
  You can turn on NATIVE authentication explicitly by using a property.
• Working with a credentials database
  With NATIVE authentication, a database can become a credentials database in any of several ways.
• NATIVE authentication and other database properties
  When NATIVE authentication is enabled, Derby behaves as if the derby.connection.requireAuthentication and derby.database.sqlAuthorization properties are also set.
• Managing users and passwords
  To manage users and passwords, Derby provides a group of system procedures.
• Converting an existing database to use NATIVE authentication
  If you wish to apply NATIVE authentication to a database that was created without it, the procedure is slightly different depending on whether you specify NATIVE:credentialsDB or NATIVE:credentialsDB:LOCAL.