You are misreading what external is -- it just passes the auth that is submitted to oracle from a client to the OS for verification instead of using its internal user db. Or in the case of a local client (running on the same server as oracle server) then it allows users that have already authed to that server to use the databse (the OP states that there will be remote clients). from your link: If a user with an operating system account named tsmith is to connect to an Oracle database and be authenticated by the operating system... This means you are still passing username and password from the client perl script -- however on the oracle server side instead of authing against its own internal user db, it passes to the OS. There is nothing here that makes it magically not need a user or password on/in the client script.