Copyright
License
About this guide
Purpose of this guide
Audience
How this guide is organized
Part One: Introduction to database security
Why databases need security
Vulnerabilities of unsecured databases
Threats to unsecured databases
Defenses against security threats
Derby defenses against threats
Defenses outside of Derby
Defenses mapped to threats
Designing safer Derby applications
Security terminology
Part Two: Configuring security for Derby
Basic security configuration tasks
Configuring security in an embedded environment
Configuring security in a client/server environment
Network Server security
Configuring database encryption
Requirements for Derby encryption
Working with encryption
Encrypting databases on creation
Encrypting an existing unencrypted database
Creating a boot password
Specifying an alternate encryption provider
Specifying an alternate encryption algorithm
Encrypting databases with a new key
Encrypting databases with a new boot password
Encrypting databases with a new external encryption key
Booting an encrypted database
Decrypting an encrypted database
Using signed jar files
Configuring SSL/TLS
Creating a client key pair and certificate
Creating a server key pair and certificate
Importing certificates
Booting the server and connecting to it
Key and certificate handling
Starting the server with SSL/TLS
Running the client with SSL/TLS
Other server commands
Understanding identity in Derby
Users and authorization identifiers
Authorization identifiers, user authentication, and user authorization
User names and schemas
Exceptions when using authorization identifiers
Database Owner
Configuring user authentication
Configuring LDAP authentication
Booting an LDAP server
Setting up Derby to use your LDAP directory service
Guest access to search for DNs
LDAP performance issues
LDAP restrictions
JNDI-specific properties for external directory services
Configuring NATIVE authentication
Enabling NATIVE authentication explicitly
Working with a credentials database
NATIVE authentication and other database properties
Managing users and passwords
Converting an existing database to use NATIVE authentication
Specifying authentication with a user-defined class
Example of setting a user-defined class
List of user authentication properties
Programming applications for Derby user authentication
Login failure exceptions with user authentication
Configuring Network Server authentication in special circumstances
Configuring Network Client authentication without SSL/TLS
Configuring Network Server authentication without SSL/TLS
Configuring user authorization
Configuring coarse-grained user authorization
Read-only and full access permissions
Setting the default connection access mode
User authorization exceptions
Configuring fine-grained user authorization
Using fine-grained user authorization
Privileges on views, triggers, constraints, and generated columns
Using SQL roles
Upgrading an old database to use SQL standard authorization
SQL standard authorization exceptions
NATIVE authentication and SQL authorization example
Configuring Java security
Basic engine security policy template
Basic server security policy template
Basic client security policy template
Basic tools security policy template
Sample customized Java security policy file
Using a Java security policy file
Running the Network Server with a security manager
Running the Network Server without a security manager
Restricting file permissions
Putting it all together
Starting a secured Network Server
Creating and using a secure database
Stopping the secured Network Server
Trademarks