title: What are the advantages to each approach for mapping application end users to database users?
body: <p>There seems to be three common approaches for mapping an application end user to a database user.  </p>
  
  <ol>
  <li><strong>One to One Mapping:</strong>  Each Application user (bob, nancy and fred) also get a corresponding database user account (bob nancy and fred).</li>
  <li><strong>N to M mapping:</strong>  Each application user is mapped to a database user that represents their role. bob and nancy are mapped to the 'clerk' database user while fred is mapped to the 'manager' database user.</li>
  <li><strong>N to 1 mapping:</strong>  Each application user is mapped to a single database user (app_user) and identity is only managed at the application tier.</li>
  </ol>
  
  <p>It seems that #3 is the most common in web application development.  <strong>Why is there not a greater emphasis on the other two options?</strong></p>
  
  <p>Oracle encourages techniques like #2 using its proxy authentication features for the following reason:</p>
  
  <p><strong>Limited trust model</strong>-controlling the users on whose behalf middle tiers can connect, and the roles the middle tiers can assume for the user</p>
  
  <p><strong>Scalability</strong>-by supporting lightweight user sessions and eliminating the overhead of re-authenticating clients</p>
  
  <p><strong>Accountability</strong>, by preserving the identity of the real user through to the database, and enabling auditing of actions taken on behalf of the real user</p>
  
  <p><a href="http://download.oracle.com/docs/cd/B28359_01/java.111/b31224/proxya.htm" rel="nofollow noreferrer">Oracle's Proxy Authentication documentation</a></p>