G Entrust-Enabled SSL Authentication

G.2.1.1 Entrust Authority Security Manager

Entrust Authority Security Manager is the centerpiece of Entrust's PKI technology. It performs core certificate authority, certificate, and user management functions, such as creating users and user profiles containing the user's credentials.

Entrust Authority Security Manager supports unattended login, also called Server Login, which eliminates the need for a Database Administrator (DBA) to repeatedly enter a password for the Entrust profile on the server. With unattended login, the DBA need only enter a password once to open the Entrust profile for the server to authenticate itself to multiple incoming connections.

G.2.1.2 Entrust Authority Self-Administration Server

Entrust Authority Self-Administration Server is the administrator's secure interface to Entrust Authority Security Manager.

G.2.1.3 Entrust Entelligence Desktop Manager

Entrust Entelligence Desktop Manager provides support for user key management and single sign-on functionality on both clients and server by enabling Oracle Database server process access to incoming SSL connections.

G.4.1.1 Administrator-Created Entrust Profiles

Administrators create Entrust profiles as follows:

1. The Entrust administrator adds the Entrust user using the Entrust Authority Self-Administration Server.

   
   

   See Also: The Entrust administration documentation for information about creating Entrust Users

   
   

2. The administrator enters the user's name and password.

3. The Entrust Authority creates the profile, or.epf file.

4. The administrator securely sends all profile-related files to the user. The preset password can be changed by the user.

G.4.1.2 User-Created Entrust Profiles

Entrust users create their own Entrust profiles as follows:

1. The Entrust administrator adds the Entrust user using the Entrust Authority Self-Administration Server. In the New User dialog box, the Create Profile option should be deselected.

   
   

   See Also: The Entrust administration documentation for information about creating Entrust profiles

   
   

2. The user receives a secure e-mail notification from the administrator that contains a reference number, authorization code, and expiration date.

3. The user navigates to the Create Entrust Profiles screen in Entrust Entelligence Desktop Manager as follows:

   Start, Programs, Entrust, Entrust Profiles, Create Entrust Profiles

4. The user enters the reference number, authorization code, and expiration date provided in the e-mail notification, creating a profile, or.epf file, and the Entrust initialization file.

G.4.4.1 Configuring Entrust on a UNIX Client

If the client resides on a non-Windows platform, perform the following steps:

1. Set the JAVA_HOME variable to the JDK or JRE location.

   For example:

   >setenv JAVA_HOME $ORACLE_HOME/JRE
   
   

2. Set WALLET_LOCATION in the sqlnet.ora file.

   For example:

   WALLET_LOCATION=
   

(SOURCE=

(METHOD=entr)
(METHOD_DATA = 
    (PROFILE=profile_location)
    (INIFILE=initialization_file_location)
)

)

G.4.4.2 Configuring Entrust on a Windows Client

If the client resides on a Windows platform, ensure that the Entrust Entelligence Desktop Manager component is installed on the client and perform the following steps to set up the Entrust credentials.

1. Set the WALLET_LOCATION parameter in the sqlnet.ora file.

   For example:

   WALLET_LOCATION=
   

(SOURCE=

(METHOD=entr)
(METHOD_DATA= 
    (INIFILE=initialization_file_location)
)

)

where initialization_file_location is the path to the.ini file.

2. Select the Entrust icon on the system tray to open the Entrust_Login dialog box.

3. Log on to Entrust by entering the profile name and password.

G.4.5.1 Configuring Entrust on a UNIX Server

If the server is a UNIX platform, ensure that the Entrust/Server Login Toolkit component is installed on the server and perform the following steps:

1. Stop the Oracle database instance.

2. Set the WALLET_LOCATION parameter in the sqlnet.ora and listener.ora files to specify the paths to the server's profile and the Entrust initialization file:

   WALLET_LOCATION =
     (SOURCE =
         (METHOD = ENTR)
         (METHOD_DATA = 
             (PROFILE = profile_location)
             (INIFILE = initialization_file_location)
         )
     )
   

3. Set the CLASSPATH environment variable to include the following paths:

$ORACLE_HOME/JRE/lib/rt.jar
$ORACLE_HOME/JRE/lib/i18n.jar
$ORACLE_HOME/jlib/ewt*.jar
$ORACLE_HOME/jlib/help*.jar
$ORACLE_HOME/jlib/share*.jar
$ORACLE_HOME/jlib/swingall*.jar
$ORACLE_HOME/network/jlib/netentrust.jar

4. Enter the etbinder command to create unattended login credentials, or.ual files by using the following steps:

   1. Set the PATH environment variable to include the path to the etbinder command, which is located in the /bin directory where the Server Login Toolkit is installed.

   2. Set the LD_LIBRARY_PATH to include the path to the Entrust libraries.

   3. Set the SSL_ENTRUST_INI environment variable to include the full path to the Entrust initialization file.

   4. Enter the command as follows:

      etbinder
      
      

   5. When prompted to enter the location of the profile file, enter the full path name, including the name of the file. Then, when prompted, type in the password.

      A message displays indicating that the credentials file (filename.ual) has been created.

      
      

      Note: Ensure that the listener has a TCPS listening endpoint, then start the listener.

      
      

5. Start the Oracle database instance.

G.4.5.2 Configuring Entrust on a Windows Server

If the server is on a Windows platform, perform the following steps:

1. Stop the Oracle database instance.

2. Set the WALLET_LOCATION parameter in the sqlnet.ora and listener.ora files to specify the paths to the server's profile and the Entrust initialization file:

   WALLET_LOCATION =
   

(SOURCE =

(METHOD = ENTR)
(METHOD_DATA = 
    (PROFILE = profile_location)
    (INIFILE = initialization_file_location)
)

)

3. Run the Entrust binder command to create unattended login credentials, which are files with a.ual extension. Ensure that the owner of the.ual file is the same as the owner of the Oracle service.

   To run the binder command Select

   Start, Programs, Entrust Toolkit, Server Login, Entrust Binder

   Enter the path to the profile, the password, and the path to the Entrust initialization file. A message informs you that you have successfully created a credential file.

4. Start the Oracle database instance.

   
   

   Note: For all Windows environments, Oracle Corporation recommends that you do not install Entrust Entelligence Desktop Manager on the server computer.

   
   

G.6.3.1 Checklist for Entrust Installations on Windows

The following checklist items apply only to Entrust installations on the Windows platform.

1. Ensure that you are logged into Entrust Entelligence Desktop Manager and retry.

2. Select Windows, then Control Panel, and click Services to confirm that the Entrust Login Interface service has started and is running.

3. Confirm that the Entrust initialization file location is specified in the SSL_ENTRUST_INI_FILE parameter of the sqlnet.ora file. However, if you select not to specify the location there, then the Entrust initialization file must reside in c:\WINNT.

4. Ensure that you are not running Entrust Entelligence Desktop Manager if your database is running on a Microsoft platform. If this is the case, then only the.ual file, which enables unattended login, is required.

   
   

   See Also: Step 4 of "Configuring Entrust on a Windows Server" for information about creating a.ual file with the Entrust binder command.

   
   

5. Confirm that Entrust Authority, as specified in the Entrust Initialization file, is accessible and running.

6. Confirm that the profile password is correctly entered.

7. If an Oracle database server fails to log in to Entrust, confirm that the unattended login credential file (.ual) is generated using a valid password. Also, confirm that the versions for Entrust Server Login toolkit and Entrust IPSEC Negotiator toolkit match (that is, that the IPSec Toolkit 6.0 works with Server Login Toolkit 6.0).

8. Ensure that the Entrust initialization file has the following entry in the first section, Entrust Settings:

   IdentityLibrary = location
   
   

   where location is the location of libidapi.so, including the file name.