- ORDSが管理するファイル・ベースのユーザー作成と、そのユーザーによるBasic認証による保護。
- データベースに作成したユーザーと、そのユーザによるOAuth2.0のクライアントクレデンシャル認証（Client Credentials Grant）による保護。
- データベースに作成したユーザーと、そのユーザによるOAuth2.0の認可コード認証（Authorization Code Grant）による保護。
The OAuth 2.1 Authorization Framework
- サーバーからORDSのRESTサービスを呼び出すときは、クライアントクレデンシャル認証が使えます。
- クライアントの権限でORDSのRESTサービスを呼び出すときは、JWTプロファイルを使うことになります。JWTプロファイルについては、同じDeveloper's Guideの2.9 JWT Profile and JWT Profile RBACに記載されています。
RESTサービスの準備
create user ordstest identified by [パスワード] default tablespace users temporary tablespace temp;
grant db_developer_role to ordstest;
alter user ordstest quota unlimited on users;% sql sys/********@localhost/freepdb1 as sysdba
SQLcl: 金 6月 06 10:33:32 2025のリリース24.4 Production
Copyright (c) 1982, 2025, Oracle. All rights reserved.
接続先:
Oracle Database 23ai Free Release 23.0.0.0.0 - Develop, Learn, and Run for Free
Version 23.7.0.25.01
SQL> create user ordstest identified by ********* default tablespace users temporary tablespace temp;
User ORDSTESTは作成されました。
SQL> grant db_developer_role to ordstest;
Grantが正常に実行されました。
SQL> alter user ordstest quota unlimited on users;
User ORDSTESTが変更されました。
SQL> exit
Oracle Database 23ai Free Release 23.0.0.0.0 - Develop, Learn, and Run for Free
Version 23.7.0.25.01から切断されました
%
select id, name, uri_prefix from user_ords_modules where name = 'example';
select id, module_id, uri_template from user_ords_templates where uri_template = 'currentuser';
select id, template_id, source_type, method, source from user_ords_handlers where template_id = (select id from user_ords_templates where uri_template = 'currentuser');% sql ordstest/********@localhost/freepdb1
SQLcl: 金 6月 06 10:40:49 2025のリリース24.4 Production
Copyright (c) 1982, 2025, Oracle. All rights reserved.
接続先:
Oracle Database 23ai Free Release 23.0.0.0.0 - Develop, Learn, and Run for Free
Version 23.7.0.25.01
SQL> @sample-rest-service.sql
PL/SQLプロシージャが正常に完了しました。
SQL> select id, name, uri_prefix from user_ords_modules where name = 'example';
ID NAME URI_PREFIX
________ __________ _____________
10083 example /example/
SQL> select id, module_id, uri_template from user_ords_templates where uri_template = 'currentuser';
ID MODULE_ID URI_TEMPLATE
________ ____________ _______________
10084 10083 currentuser
SQL> select id, template_id, source_type, method, source from user_ords_handlers where template_id = (select id from user_ords_templates where uri_template = 'currentuser');
ID TEMPLATE_ID SOURCE_TYPE METHOD SOURCE
________ ______________ ______________ _________ ___________________________________________________
10085 10084 plsql/block GET declare
l_response json_object_t := json_object_t();
l_response_clob clo
SQL> exit
Oracle Database 23ai Free Release 23.0.0.0.0 - Develop, Learn, and Run for Free
Version 23.7.0.25.01から切断されました
%
{"current_user":"no user","Authorization":"no authorization header"}
% curl -i http://localhost:8181/ords/ordstest/example/currentuser
HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
ETag: "sWHiIhReqYdcWo/KOFXgxgndWr0bbgjZZt1KMGxnROqzVE20Mk07XBBqmORReJhN+iglTG3wP6WiOBEAujonEw=="
Transfer-Encoding: chunked
{"current_user":"no user","Authorization":"no authorization header"}
%
select id, label, name from user_ords_privileges where name = 'example.tester';
select module_id, module_name, privilege_name from user_ords_privilege_modules where privilege_name = 'example.tester';
select id, name from user_ords_roles where name = 'Tester Role';
select privilege_id, privilege_name, role_id, role_name from user_ords_privilege_roles where privilege_name = 'example.tester';% sql ordstest/*********@localhost/freepdb1
SQLcl: 金 6月 06 10:57:18 2025のリリース24.4 Production
Copyright (c) 1982, 2025, Oracle. All rights reserved.
接続先:
Oracle Database 23ai Free Release 23.0.0.0.0 - Develop, Learn, and Run for Free
Version 23.7.0.25.01
SQL> @sample-rest-protection.sql
PL/SQLプロシージャが正常に完了しました。
SQL> select id, label, name from user_ords_privileges where name = 'example.tester';
ID LABEL NAME
________ _______________ _________________
10087 Current User example.tester
SQL> select module_id, module_name, privilege_name from user_ords_privilege_modules where privilege_name = 'example.tester';
MODULE_ID MODULE_NAME PRIVILEGE_NAME
____________ ______________ _________________
10083 example example.tester
SQL> select id, name from user_ords_roles where name = 'Tester Role';
ID NAME
________ ______________
10086 Tester Role
SQL> select privilege_id, privilege_name, role_id, role_name from user_ords_privilege_roles where privilege_name = 'example.tester';
PRIVILEGE_ID PRIVILEGE_NAME ROLE_ID ROLE_NAME
_______________ _________________ __________ ______________
10087 example.tester 10086 Tester Role
SQL> exit
Oracle Database 23ai Free Release 23.0.0.0.0 - Develop, Learn, and Run for Free
Version 23.7.0.25.01から切断されました
%
% curl -i http://localhost:8181/ords/ordstest/example/currentuser
HTTP/1.1 401 Unauthorized
Content-Type: application/problem+json
Content-Length: 182
{
"code": "Unauthorized",
"message": "Unauthorized",
"type": "tag:oracle.com,2020:error/Unauthorized",
"instance": "tag:oracle.com,2020:ecid/oFO6DMKBX6mqmmF-SMe6kw"
}
%
ORDSに作成したユーザーによるBasic認証
podman exec -it apex-ords bash
ords --config /etc/ords/config config user add tester "Tester Role"
exit
podman restart apex-ords
% podman exec -it apex-ords bash
[oracle@apex ords]$ ords --config /etc/ords/config config user add tester "Tester Role"
ORDS: Release 25.1 Production on Fri Jun 06 02:12:22 2025
Copyright (c) 2010, 2025, Oracle.
Configuration:
/etc/ords/config
Enter the password for tester: ********
Confirm password: ********
Created user tester in file /etc/ords/config/global/credentials
[oracle@apex ords]$ exit
exit
% podman restart apex-ords
apex-ords
%
[oracle@apex ords]$ cat /etc/ords/config/global/credentials
tester;{SSHA-512}R7cATDYV6Zabh6ryiS/2tqGS72ETJqdzF+Ubtg1oXINmnSUzErakhYe964PwWvPGHNIa05bUSybpyjB+PfbfPs5WPNY/+bzS;Tester Role
[oracle@apex ords]$
curl -i -u tester:[パスワード] http://localhost:8181/ords/ordstest/example/currentuser
レスポンスとして以下が返され、ユーザーtesterで認証されてRESTサービスにアクセスできていることが確認できます。
{"current_user":"tester","Authorization":"Basic dGVzdGVyOnRlc3Rlcg=="}
% curl -i -u tester:****** http://localhost:8181/ords/ordstest/example/currentuser
HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
ETag: "8IE0ooG0h49SrS5g6HYfKP2+cV9S9mrqllYnbDo6LPXdDgKCVPiPmyO6aIJemUjPHpytKt+/OX1KvPTFeWcOWA=="
Transfer-Encoding: chunked
{"current_user":"tester","Authorization":"Basic dGVzdGVyOnRlc3Rlcg=="}
%
OAuth2.0のクライアントクレデンシャル認証
% sql ordstest/********@localhost/freepdb1
SQLcl: 金 6月 06 13:24:46 2025のリリース24.4 Production
Copyright (c) 1982, 2025, Oracle. All rights reserved.
接続先:
Oracle Database 23ai Free Release 23.0.0.0.0 - Develop, Learn, and Run for Free
Version 23.7.0.25.01
SQL> @create-oauth-client-client-credentials.sql
Client Credentials Example created.
client_id: 9A0HhMMUt1YVrMm_U_qq_Q..
client_secret: c6aagkaaZwYoyygPjP7SXA..
PL/SQLプロシージャが正常に完了しました。
SQL>
select id, name, client_id, client_secret from user_ords_clients where name = 'Client Credentials Example';
select * from user_ords_client_roles where client_name = 'Client Credentials Example';SQL> select id, name, client_id, client_secret from user_ords_clients where name = 'Client Credentials Example';
ID NAME CLIENT_ID CLIENT_SECRET
________ _____________________________ ___________________________ ________________
10150 Client Credentials Example 9A0HhMMUt1YVrMm_U_qq_Q.. ********
SQL>
SQL> select * from user_ords_client_roles where client_name = 'Client Credentials Example';
CLIENT_ID CLIENT_NAME ROLE_ID ROLE_NAME
____________ _____________________________ __________ ______________
10150 Client Credentials Example 10086 Tester Role
SQL>
SQL> exit
Oracle Database 23ai Free Release 23.0.0.0.0 - Develop, Learn, and Run for Free
Version 23.7.0.25.01から切断されました
%
% curl -i -u 9A0HhMMUt1YVrMm_U_qq_Q..:c6aagkaaZwYoyygPjP7SXA.. --data "grant_type=client_credentials" http://localhost:8181/ords/ordstest/oauth/token
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-cache, no-store, max-age=0
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
{"access_token":"qjzIbIY64O-pQ8yP7z0aZA","token_type":"bearer","expires_in":3600}
%
% curl -i -H "Authorization: Bearer qjzIbIY64O-pQ8yP7z0aZA" http://localhost:8181/ords/ordstest/example/currentuser
HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
ETag: "oInXCooX/Bu9/E2p9OjzaYAoK50gwin/oP6DQMY/+0C1KETn8aNhqlGBa7fVbQ1M9WWCXkMHBM0004OQZIsMBA=="
Transfer-Encoding: chunked
{"current_user":"9A0HhMMUt1YVrMm_U_qq_Q..","Authorization":"Bearer qjzIbIY64O-pQ8yP7z0aZA"}
%
OAuth2.0の認可コード認証
% sql ordstest/********@localhost/freepdb1
SQLcl: 金 6月 06 13:49:07 2025のリリース24.4 Production
Copyright (c) 1982, 2025, Oracle. All rights reserved.
接続先:
Oracle Database 23ai Free Release 23.0.0.0.0 - Develop, Learn, and Run for Free
Version 23.7.0.25.01
SQL> @create-oauth-client-client-authorization-code.sql
Authorization Code Example created.
client_id: kw-gSKLOc6dGeOYZn8eT3Q..
client_secret: It8zNj0WuVloOESohhfO4A..
PL/SQLプロシージャが正常に完了しました。
SQL>
select id, name, client_id, client_secret from user_ords_clients where name = 'Authorization Code Example';
select * from user_ords_client_roles where client_name = 'Authorization Code Example';SQL> select id, name, client_id, client_secret from user_ords_clients where name = 'Authorization Code Example';
ID NAME CLIENT_ID CLIENT_SECRET
________ _____________________________ ___________________________ ________________
10157 Authorization Code Example kw-gSKLOc6dGeOYZn8eT3Q.. ********
SQL> select * from user_ords_client_roles where client_name = 'Authorization Code Example';
CLIENT_ID CLIENT_NAME ROLE_ID ROLE_NAME
____________ _____________________________ __________ ______________
10157 Authorization Code Example 10086 Tester Role
SQL> exit
Oracle Database 23ai Free Release 23.0.0.0.0 - Develop, Learn, and Run for Free
Version 23.7.0.25.01から切断されました
%
http://localhost:8181/ords/ordstest/oauth/auth?response_type=code&client_id=[client_id]&state=[任意の文字列]
% curl -i -u kw-gSKLOc6dGeOYZn8eT3Q..:It8zNj0WuVloOESohhfO4A.. --data "grant_type=authorization_code&code=NUBFF2QxcCY6oOqq8r7OUw" http://localhost:8181/ords/ordstest/oauth/token
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-cache, no-store, max-age=0
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
{"access_token":"SQn8Ad0cVGdF7svoRTmu5Q","token_type":"bearer","expires_in":3600,"refresh_token":"lFk6RZoyBZ_qmlDQP19_Yg"}
%
curl -i -H "Authorization: Bearer アクセス・トークン" http://localhost:8181/ords/ordstest/example/currentuser
% curl -i -H "Authorization: Bearer SQn8Ad0cVGdF7svoRTmu5Q" http://localhost:8181/ords/ordstest/example/currentuser
HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
ETag: "2blAi7qSZV56Q9U+bRlQ5yeBFsanlDchMsvpinigKBYkrJfVxi4WPiGRMbhYycU4hLkIdjqD/l0afWDywJNUXA=="
Transfer-Encoding: chunked
{"current_user":"tester","Authorization":"Bearer SQn8Ad0cVGdF7svoRTmu5Q"}
%
以上で、ORDSのユーザーによるBasic認証、OAuth2.0のクライアントクレデンシャル認証および認可コード認証の動作確認は完了です。
