| Oracle® Database Enterprise User Administrator's Guide 10g Release 2 (10.2) Part Number B14269-01 |
|
|
View PDF |
| Oracle® Database Enterprise User Administrator's Guide 10g Release 2 (10.2) Part Number B14269-01 |
|
|
View PDF |
This chapter describes configuring Enterprise User Security by a sequence of steps. They include the initial database and directory preparation through connecting to the database as an enterprise user, where authentication can use passwords, Kerberos tickets, or SSL. A troubleshooting section helps you when you test your Enterprise User Security implementation.
This chapter contains the following topics:
Preparing the Directory for Enterprise User Security (Phase One)
Configuring Enterprise User Security Objects in the Database and the Directory (Phase Two)
Configure Enterprise User Security for the Authentication Method You Require (Phase Three)
Configuring Enterprise User Security means creating shared schemas and global roles in databases that you want accessible to enterprise users. You configure the identity management realm in the directory to reflect those database roles and schemas, and then associate directory users with them. These steps apply regardless of the authentication method you choose: password, Kerberos, or SSL.
The primary configuration differences among the authentication types are in network connection configuration. You must consider the following three connection types:
Client-to-database
Database-to-directory
Database-to-database (current user database links can be secured by SSL only)
Enterprise User Security supports many combinations of authentication types between databases, directories, and clients. The three most common implementations of Enterprise User Security, described in this chapter, use the following authentication methods for client-database and database-directory connections:
Passwords for both connections
SSL for both connections
Kerberos for client-database connections and passwords for database-directory connections
You decide which of these to choose based primarily on your network environment, because the security and integrity of your enterprise data depend on creating secure network connections. Typical network environments can have all clients, databases, and directories residing within the same network behind a firewall, or distributed across several networks and perhaps exposed to the Internet. Different environments can dictate what authentication types you choose, in order to secure your Enterprise User Security network connections.
A second consideration in making such choices is the fact that more rigorous authentication types, such as SSL and Kerberos, require greater configuration complexity, additional software, and ongoing maintenance.
Figure 3-1 shows the configuration process for Enterprise User Security. It is a step-by-step process with decision points based on your implementation and how your users are authenticated. The configuration steps represented with broken lines are optional.
Figure 3-1 Enterprise User Security Configuration Flow Chart
For brevity, some product names and features have been abbreviated in this flow chart. The following table lists the abbreviations used and the meaning of each:
| Abbreviation | Meaning |
|---|---|
| DBCA | Database Configuration Assistant |
| ESM | Enterprise Security Manager |
| IM Realm | Identity Management Realm |
| Netmgr | Oracle Net Manager |
| ODM | Oracle Directory Manager |
| OID | Oracle Internet Directory |
| OWM | Oracle Wallet Manager |
| SQL | SQL*Plus |
|
See Also: Chapter 1, "Getting Started with Oracle Database Enterprise User Security" for information about the realm Oracle Context, its administrative groups, and entries that pertain to Enterprise User Security |
This section provides detailed descriptions of the configuration steps that Figure 3-1 illustrates. They should be performed in the following order:
"Preparing the Directory for Enterprise User Security (Phase One)"
"Configuring Enterprise User Security Objects in the Database and the Directory (Phase Two)"
"Configure Enterprise User Security for the Authentication Method You Require (Phase Three)", which completes your Enterprise User Security configuration by establishing your chosen authentication method as one of the following three:
This configuration phase must be performed before you can configure any other part of Enterprise User Security.
Enterprise User Security for 10g Release 1 (10.1) requires Release 9.0.4 (or later) version of Oracle Internet Directory, which installs with the required version of the Oracle schema. This schema is backward compatible. After you have installed Oracle Internet Directory, perform the following directory usage configuration tasks:
Task 1: (Optional) Create an identity management realm in the directory
Task 5: (Optional) Configure your Oracle home for directory usage
Task 1: (Optional) Create an identity management realm in the directory
If necessary, use Oracle Internet Directory Self-Service Console (Delegated Administration Service) to create an identity management realm in the directory. You can use Oracle Internet Directory Configuration Assistant to upgrade an Oracle9i Oracle Context to a 9.0.4 or higher version Identity Management Realm.
You must have version 9.0.4 (or later) identity management realm to use Oracle Database 10g or Oracle Database 10g Release 2 (10.2). Version 9.0.4 realms are backward compatible to Oracle9i, so you can register Oracle9i and Oracle Database 10g Release 2 (10.2) in the same realm and place them in the same domain, if desired.
Task 2: (Optional) Set identity management realm properties
Table 3-1 shows the defaults for a version 9.0.4 identity management realm.
Table 3-1 Identity Realm Defaults
| User Search Base | Group Search Base | Login Name Attribute (nickname) |
|---|---|---|
| cn=Users,<realm_DN> | cn=Groups,<realm_DN> | uid, the user id |
If you want different settings, then use Enterprise Security Manager Console to set the user search base, group search base, and login name attribute (nickname). You can also set up the necessary context administrators in the identity management realm you plan to use in the directory.
To perform this task, see "Setting Properties of an Identity Management Realm".
|
Note:
|
Task 3: Identify administrative users in the directory
Identify administrative users in the directory who are authorized to perform the following tasks:
Register databases
Administer database security
Create and manage enterprise domains
If administrative users do not already exist who can perform these tasks, then see Chapter 4, "Administering Enterprise User Security" to create them.
|
Note: Although one administrator can perform all Enterprise User Security administrative tasks, you can create many different kinds of administrators so security tasks can be assigned to different people. Separating security tasks in this way results in a more secure enterprise environment, but this requires coordination among the different administrators. |
Task 4: (Optional) Set the default database-to-directory authentication type for the identity management realm
By default, the database-to-directory authentication type for the identity management realm is set to passwords. If you want a different default setting, then use Enterprise Security Manager to change it. For example, if you are using a public key infrastructure (PKI), then you would need to set the authentication type to SSL. See "Setting the Default Database-to-Directory Authentication Type for an Identity Management Realm".
|
Note:
|
Task 5: (Optional) Configure your Oracle home for directory usage
This step is optional because users of Domain Name System (DNS) discovery (automatic domain name lookup to locate the directory on a network) do not need to perform this step. (See Oracle Internet Directory Administrator's Guide for information about DNS server discovery.)
If you are not using DNS discovery, then you must use Oracle Net Configuration Assistant to create an ldap.ora file for your Oracle home. This configuration file specifies the directory host and port information, and the location of the identity management realm so the database can connect to the directory. (See "Starting Oracle Net Configuration Assistant")
To create an ldap.ora file for your Oracle home:
In the Oracle Net Configuration Assistant welcome page, choose Directory Service Usage Configuration, and click Next.
On the Directory Usage Configuration page, select an option appropriate for your environment. Then follow the prompts in the wizard and refer to the online Help to create an ldap.ora file for your Oracle home.
|
Note:
|
Task 6: Register the database in the directory
After you have configured your Oracle home for directory usage, use Database Configuration Assistant to register the database in the directory. Registration creates an entry in the directory so the database can bind (log in) to it.
|
Note: To perform this task, you must be the directory superuser or a member of either the OracleDBCreators group or the OracleContextAdmins group. |
When registering a database in the directory, Database Configuration Assistant performs the following configuration tasks:
Creates a new database service entry and subtree, and assigns a DN to it in the Oracle Context for the identity management realm you are using.
Adds the database to the default enterprise domain.
Establishes the authentication type of the database to the directory by setting the LDAP_DIRECTORY_ACCESS parameter to one of the three allowable settings: NONE, PASSWORD, or SSL. Database Configuration Assistant reads the default database to directory authentication attribute setting for the identity management realm to determine the authentication type setting for the database.
The LDAP_DIRECTORY_ACCESS parameter, residing in the database initialization parameter file, determines whether and how the database attempts authentication to the directory. An administrator can change this authentication type setting by using the ALTER SYSTEM command.
Creates a database wallet, containing the database DN in the following form:
cn=<short_database_name>,cn=OracleContext,<realm_DN>
where short_database_name is the first part of the fully qualified domain name for a database.
For example, if you have a database named db1.us.oracle.com, then the short database name is db1.
Randomly generates a database password for directory access, storing it in the database wallet and in the directory.
After creating the wallet, Database Configuration Assistant stores it at ORACLE_BASE/admin/Oracle_SID/wallet (in UNIX environments), if the ORACLE_BASE environment variable is present. If the ORACLE_BASE environment variable is not present, then the ORACLE_HOME/admin/Oracle_SID/wallet directory is used.
In Windows environments, replace the slashes with backslashes.
If a database wallet already exists, then Database Configuration Assistant uses it and updates the password in the wallet.
Enables autologin for the database wallet.
|
Note:
|
To register a database in (or unregister a database from) the directory:
See "Starting Database Configuration Assistant" to start this tool.
After starting Database Configuration Assistant, select Configure Database Options in a Database and click Next.
Select a database and click Next.
To register the database, click Yes, Register the Database.
Enter the directory credentials for a user in the OracleDBCreators group.
Enter a password for the database wallet.
|
Note: Remember the database wallet password you entered in Step 5. It cannot be retrieved after you finish database registration. If you do not know the password, a multistep process is required to generate a new wallet and reregister the database. See "About the Database Wallet and Password" for further information. |
Click Finish if you are only registering the database. Click Next if you want to configure additional database features.
To change the database's directory password:
After starting Database Configuration Assistant, select Configure Database Options in a Database, and click Next.
Select a database and click Next.
Select Regenerate database password.
Enter the directory credentials for a user in the OracleDBCreators group and a password for the database wallet. Click OK.
Click Finish if you are only regenerating the password. Click Next if you want to configure additional database features.
To unregister a database from the directory:
See "Starting Database Configuration Assistant" to start this tool.
After starting Database Configuration Assistant, select Configure Database Options in a Database and click Next.
Select a database and click Next.
To unregister the database, select the Unregister option.
Enter the directory credentials for a user with the appropriate permissions.
Enter a password for the database wallet.
When you unregister a database from the directory, Database Configuration Assistant performs the following configuration tasks:
Removes the database entry and subtree from the directory.
Sets the LDAP_DIRECTORY_ACCESS parameter to NONE.
Removes the database from its enterprise domain (if the user has sufficient permissions).
|
Note: Depending on user permissions, Database Configuration Assistant may be unable to remove a database from its domain in the directory. If it cannot, then use Enterprise Security Manager to remove it from the enterprise domain. |
Does not remove the database wallet.
|
See Also: To delete the wallet, see the discussions on Oracle Wallet Manager in Oracle Database Advanced Security Administrator's Guide. The particular sections of note are named "Navigating the Oracle Wallet Manager User Interface" in Chapter 2 and "Managing Wallets" in Chapter 9 |
|
Note: To succeed at unregistering an Oracle Database 10g Release 2 (10.2) from Oracle Internet Directory by using Database Configuration Assistant, you must be one of the following:
|
The database requires the wallet even if no SSL (Secure Sockets Layer) is used to secure the connection between the database and the directory. If SSL is used, then this wallet should be used to store the database's digital PKI certificate.
The wallet password you enter when using Database Configuration Assistant to register a database in the directory is the password to the wallet itself. This password is not the database's directory login credentials.
You can change this wallet password later, using Oracle Wallet Manager. However, if you forget this wallet password, then you must generate an entirely new wallet and password. To do so, you must first delete the existing database wallet, create a new wallet (which can be empty) and put it at the default wallet location, ORACLE_HOME/admin/Oracle_SID/wallet (in UNIX environment). Next, unregister the database from the directory, and reregister the database in the directory. During that registration, another database wallet and password can be generated.
|
See Also: Oracle Database Advanced Security Administrator's Guide for information about using Oracle Wallet Manager to change wallet passwords and, in general, to manage public key infrastructure (PKI) credentials |
After you have prepared the directory for Enterprise User Security, then you can create the Enterprise User Security database and directory objects as described in "Configuring Enterprise User Security Objects in the Database and the Directory (Phase Two)".
|
See Also:
|
Multiple databases (that are not replicas) cannot share wallets, because wallets contain a database's identity. Therefore, if a sqlnet.ora file contains a wallet location, then multiple databases cannot share that sqlnet.ora file.
In order to share a single sqlnet.ora file amongst multiple databases, the following preconditions are required:
User authentication should use passwords or Kerberos.
The wallet containing the password should reside at the default wallet location, which is where Database Configuration Assistant creates it.
If the preceding conditions are met, then multiple databases can share the sqlnet.ora file because no wallet location information is stored in that file.
However, when SSL authentication is used between the user (client) and the database, the wallet location must be specified in the database server's sqlnet.ora file. Such a sqlnet.ora file cannot be shared by multiple databases for SSL-authenticated enterprise users.
This is the second phase of configuration steps required to implement Enterprise User Security. The configuration steps in this section assume the following recommended setup:
You have prepared your database and your directory by completing the tasks described in "Preparing the Directory for Enterprise User Security (Phase One)".
Your users are stored in an identity management realm Users subtree.
You use the OracleDefaultDomain, which is the default enterprise domain that Database Configuration Assistant uses when you register databases in the directory.
Note that databases must be in an enterprise domain that is in an identity management realm in order for enterprise user logins to work.
|
See Also: If you do not use the OracleDefaultDomain or store your users in an identity management realm Users subtree, then see the following documentation:
|
To configure Enterprise User Security objects in the database and directory perform the following tasks:
Task 1: Create Global Schemas and Global Roles in the Database
Task 2: Configure User-Schema Mappings for the Enterprise Domain
Task 5: Grant Enterprise Roles to Enterprise Users for Database Access
Task 1: Create Global Schemas and Global Roles in the Database
Although this step can also be completed by using Oracle Enterprise Manager, the following examples use SQL*Plus directly:
Create a shared schema for enterprise users. The following syntax example creates a shared schema named guest:
SQL> CREATE USER guest IDENTIFIED GLOBALLY AS '';
If you do not want to use a shared schema, then specify a user DN between the single quotation marks to create an exclusive schema.
Grant the CREATE SESSION privilege to the shared schema created in Step 1 so users can connect to it. The following syntax example grants the CREATE SESSION privilege to the guest shared schema:
SQL> GRANT CREATE SESSION TO guest;
Alternatively, you can grant the CREATE SESSION privilege to a global role, which you grant to specific users through an enterprise role. See Step 3.
Create global roles for the database to hold relevant privileges. The following syntax examples create the emprole and custrole global roles:
SQL> CREATE ROLE emprole IDENTIFIED GLOBALLY; SQL> CREATE ROLE custrole IDENTIFIED GLOBALLY;
Global roles are associated with enterprise roles, which are created later, and then are allocated to enterprise users.
Grant privileges to the new global roles that were created in Step 3. The following syntax example grants the SELECT privilege to emprole and custrole global roles on the products table:
SQL> GRANT select ON products TO custrole, emprole;
Task 2: Configure User-Schema Mappings for the Enterprise Domain
Use Enterprise Security Manager (see "Starting Enterprise Security Manager") to configure user-schema mappings for the OracleDefaultDomain by using the following steps:
Select the OracleDefaultDomain in the navigator pane.
Select the Database Schema Mapping tabbed window and click Add.
In the Add Database Schema Mappings dialog box enter the appropriate DN and the shared schema name that you created in Task 1. Refer to the Enterprise Security Manager online Help for information about how to enter these values.
Click OK. The new user-schema mappings apply to all databases in the enterprise domain.
For more information about this task, see "Managing Enterprise Domain Database Schema Mappings".
|
Note: You also can create user-schema mappings under a database in an enterprise domain which apply only to that database. |
Task 3: Create Enterprise Roles in the Enterprise Domain
Use Enterprise Security Manager to create enterprise roles in the OracleDefaultDomain by using the following steps:
Right-click OracleDefaultDomain in the navigator pane and choose Create Enterprise Role.
The Create Enterprise Role dialog box appears with the appropriate realm Oracle Context and enterprise domain displayed.
Enter the enterprise role name in the Role Name field.
Click OK. The new enterprise role is added under the domain in the navigator pane.
For more information about this task, see "Creating a New Enterprise Role".
Task 4: Add Global Database Roles to Enterprise Roles
Use Enterprise Security Manager to add the global database roles that you created in Task 1 to the enterprise roles that you created in Task 3 by using the following steps:
Select the enterprise role name in the navigator pane.
Choose the Database Global Roles tabbed window and click Add.
In the Add Global Database Roles dialog box, select the database from which to obtain global roles. A database logon window appears, prompting you for a user name and password to authenticate to the database so global roles can be fetched. Typically, this is a DBA logon to the database.
|
Note: You can use the database name that appears by default in the Service field to connect to the database if your Oracle home has LDAP as one of its selected Oracle Net naming methods, or if this name appears as a TNS alias in your local Oracle Net configuration. Otherwise, you can overwrite the Service field with any other TNS alias (from the databasetnsnames.ora file), or by using a connect string in the following format:
For example: |
Click OK. Enterprise Security Manager connects to the selected database, fetches the global roles supported on that database, and displays them in the Add Global Database Roles dialog box.
Select one or more global roles and click OK. The selected global roles appear in the Database Global Roles window.
Click Apply. The new global roles are added to the enterprise role.
For more information about this task, see "Assigning Database Global Role Membership to an Enterprise Role".
Task 5: Grant Enterprise Roles to Enterprise Users for Database Access
Use Enterprise Security Manager to grant enterprise roles that you created in Task 3 to the enterprise users by using the following steps:
In the navigator pane, select an enterprise role in the appropriate identity management realm.
Select the Users tab adjacent to the main application window and click Add.
In the Add Enterprise Users dialog box top panel, select a directory entry as a user search base, or edit the Selection field to manually define the user search base.
In the middle Search Criteria panel, check Include Subtrees to enable searching for all users within the search, including subtrees.
Enter any known user name in the Show Names Containing field. This limits the search to users in the directory who have a common name value that contains or starts with the specified text.
Click Search Now. If there are any users in the directory who match your search criteria, then they are listed in the bottom panel.
Choose a desired user by selecting the user in the bottom panel and clicking OK, or by double-clicking the user. Multiple users can be granted the enterprise role by selecting a range of users and clicking OK.
The Add Enterprise Users dialog box automatically closes, and you are returned to the main application window.
The user names you added appear in the Users tab. Click Apply to grant the enterprise role to the users.
For more information about this task, see "Granting Enterprise Roles to Users".
In the third phase, you complete the Enterprise User Security configuration based on the authentication method you have chosen. Go to one of the following sections:
"Configuring Enterprise User Security for Password Authentication"
"Configuring Enterprise User Security for Kerberos Authentication"
"Configuring Enterprise User Security for SSL Authentication"
|
See Also: Table 1-1, "Enterprise User Security Authentication: Selection Criteria" for a comparison of the benefits provided by password, Kerberos, and SSL authentication for Enterprise User Security |
By default, new enterprise domains are configured to accept all supported user authentication types (password, Kerberos, and SSL). If you want enterprise users to be authenticated by passwords, then you must configure that as described in the following tasks.
The configuration steps in this section assume the following:
You have prepared your directory by completing the tasks described in "Preparing the Directory for Enterprise User Security (Phase One)".
You have configured your Enterprise User Security objects in the database and the directory by completing the tasks described in "Configuring Enterprise User Security Objects in the Database and the Directory (Phase Two)".
You have configured an SSL instance with no authentication for Oracle Internet Directory as described in Oracle Internet Directory Administrator's Guide. If you are using an ldap.ora file, then also ensure that the port number for this SSL with no authentication instance is listed there as your directory SSL port.
To configure Enterprise User Security for password authentication, perform the following tasks:
Task 1: (Optional) Enable the Enterprise Domain to Accept Password Authentication
Task 2: Add the Enterprise Domain to the Password-Accessible Domains List
Task 1: (Optional) Enable the Enterprise Domain to Accept Password Authentication
By default, OracleDefaultDomain is configured to accept password authentication. If this has been changed, then use Enterprise Security Manager to enable password authentication for OracleDefaultDomain and add it to Password-Accessible Domains List by using the following steps:
Select OracleDefaultDomain in the navigator pane.
Choose the Databases tabbed window and select Password or All Types from the User Authentication methods listed.
Click Apply.
Select the identity management realm in the navigator pane.
Choose the Accessible Domains tabbed window and click Add.
In the Add Accessible Enterprise Domains dialog box, select OracleDefaultDomain from the list of enterprise domains, and click OK. OracleDefaultDomain is added to the password-accessible domains list.
For more information about this task, see Table 4-4, "Enterprise Security Manager Database Security Options".
Task 2: Add the Enterprise Domain to the Password-Accessible Domains List
Use Enterprise Security Manager to add OracleDefaultDomain to Password-Accessible Domains List by performing the following steps:
Select the identity management realm in the navigator pane.
Choose the Accessible Domains tabbed window and click Add.
In the Add Accessible Enterprise Domains dialog box, select OracleDefaultDomain from the list of enterprise domains, and click OK. OracleDefaultDomain is added to the Password-Accessible Domains List.
For more information about this task, see "Managing Password-Accessible Domains".
Task 3: Connect as a Password-Authenticated Enterprise User
For an enterprise user whose directory login name is hscortea and whose password is welcome, enter the following to connect to the database by using SQL*Plus:
SQL> connect hscortea/welcome@<Oracle Net Service Name>
The database authenticates the enterprise user (hscortea) by verifying the username-password combination against the directory entry associated with this user. Then, it identifies the proper schema and retrieves the user's global roles. If successful, then the connection to the database is established.
If your connection succeeds, then the system responds Connected to:.... This is the confirmation message of a successful connect and setup. If an error message is displayed, then see "ORA-# Errors for Password-Authenticated Enterprise Users".
If you do connect successfully, then check that the appropriate global roles were retrieved from the directory, by entering the following at the SQL*Plus prompt:
select * from session_roles
If the global roles were not retrieved from the directory, then see "NO-GLOBAL-ROLES Checklist".
You have completed password-authenticated Enterprise User Security configuration.
|
See Also:
|
The configuration steps in this section assume the following:
You have registered your databases with the Kerberos authentication server and configured your Oracle Net Services as described in the Kerberos chapter of the Oracle Database Advanced Security Administrator's Guide.
You have prepared your directory by completing the tasks described in "Preparing the Directory for Enterprise User Security (Phase One)".
You have configured your Enterprise User Security objects in the database and the directory by completing the tasks described in "Configuring Enterprise User Security Objects in the Database and the Directory (Phase Two)".
You have configured an SSL instance with no authentication for Oracle Internet Directory as described in Oracle Internet Directory Administrator's Guide. If you are using an ldap.ora, then also ensure that the port number for this SSL with no authentication instance is listed there as your directory SSL port.
To configure Enterprise User Security for Kerberos authentication, perform the following tasks:
Task 3: Specify the Enterprise User's Kerberos Principal Name in the krbPrincipalName Attribute
Task 4: (Optional) Enable the Enterprise Domain to Accept Kerberos Authentication
Task 1: Configure Enterprise Security Manager Console to display the Kerberos principal name attribute
Use Oracle Internet Directory Self-Service Console to configure the Enterprise Security Manager Console to display the Kerberos principal name attribute. For more information about this task, see "Configuring Enterprise Security Manager Console for Kerberos-Authenticated Enterprise Users".
Task 2: (Optional) Configure the Kerberos Principal Name Directory Attribute for the Identity Management Realm
Use Enterprise Security Manager Console to enter the directory attribute used to store the Kerberos principal name for the identity management realm you are using in the directory. By default, Kerberos principal names are stored in the krbPrincipalName attribute but can be changed to correspond to your directory configuration by changing orclCommonKrbPrincipalAttribute in the identity management realm. For more information about this task, see "Setting Login Name, Kerberos Principal Name, User Search Base, and Group Search Base Identity Management Realm Attributes".
|
Note: By default, the Enterprise Security Manager Console user interface does not display the field where you can configure Kerberos principal names. The first time you create Kerberos-authenticated users in the directory, you must configure the console to display thekrbPrincipalName attribute in its Create User window. See "Configuring Enterprise Security Manager Console for Kerberos-Authenticated Enterprise Users" for details. |
Task 3: Specify the Enterprise User's Kerberos Principal Name in the krbPrincipalName Attribute
Use Enterprise Security Manager Console to specify the enterprise user's Kerberos principal name (Kerberos_username@Kerberos_realm) in the krbPrincipalName attribute of the enterprise user's directory entry. For more information about this task, see "Creating New Enterprise Users".
Task 4: (Optional) Enable the Enterprise Domain to Accept Kerberos Authentication
By default, OracleDefaultDomain is configured to accept all types of authentication. If this has been changed or if you are using another domain, then use Enterprise Security Manager to enable Kerberos authentication for your enterprise domain by performing the following steps:
Select the enterprise domain in the navigator pane.
Choose the Databases tabbed window and select Kerberos or All Types from the User Authentication methods listed.
Click Apply.
For more information about this task, see "Managing Database Security Options for an Enterprise Domain".
Task 5: Connect as a Kerberos-Authenticated Enterprise User
If the KDC is not part of the operating system, such as Kerberos V5 from MIT, then the user must get an initial ticket with the FORWARDABLE flag set by using the okinit utility. See "Obtaining the Initial Ticket with the okinit Utility" in the Oracle Database Advanced Security Administrator's Guide.
If the KDC is part of the operating system, such as Windows 2000 or some versions of Linux or UNIX, then the operating system automatically picks up the user's ticket (with the FORWARDABLE flag set) from the cache when the user logs in.
The user connects to the database by launching SQL*Plus and entering the following at the command line:
SQL> connect /@<net_service_name>
The database uses Kerberos to authenticate the user. The database authenticates itself to the directory by password.
If your connection succeeds, then the system responds with Connected to:.... This is the confirmation message of a successful connect and setup. If an error message is displayed, then see "ORA-# Errors for Kerberos-Authenticated Enterprise Users".
If you do connect successfully, then check that the appropriate global roles were retrieved from the directory, by entering the following at the SQL*Plus prompt:
select * from session_roles
If the global roles were not retrieved from the directory, then see "NO-GLOBAL-ROLES Checklist".
You have completed Kerberos-authenticated Enterprise User Security configuration.
|
See Also:
|
The configuration steps in this section assume the following:
You have obtained the appropriate PKI credentials and used Oracle Wallet Manager to create wallets for the directories, databases, and clients that you want to include in your Enterprise User Security implementation.
You have confirmed that each enterprise user entry in Oracle Internet Directory is provisioned with a unique PKI credential. However, in this release an enterprise user can have different DNs in his or her PKI certificate and Oracle Internet Directory entry. Also in this release, the database entry can have different DNs in its PKI certificate and Oracle Internet Directory entry.
You must provision user certificates in their respective Oracle Internet Directory user entries in order to support using different DNs in the certificate and the directory. A user certificate is provisioned in to the usercertificate attribute of the user entry. If you prefer not to provision the certificates, then you must make sure that the subject DNs in the certificates match the user DNs in the directory.
Oracle Internet Directory 10g Release2 (10.1.2) includes certificate matching rules to support the new functionality of being able to use different DNs in the certificate and the directory. The orclpkimatchingrule attribute in Oracle Internet Directory determines the type of match that is used.
The default value of orclpkimatchingrule is 2. This enables you to support both provisioned and non-provisioned user entries. The database finds out a user's Oracle Internet Directory DN based on a search for the user's certificate provisioned in the directory. If the certificate search fails, then the database reverts to using an exact match between the user's certificate DN and his or her Oracle Internet Directory DN.
If all users have certificates provisioned in Oracle Internet Directory, then you can set the orclpkimatchingrule to 1. This instructs Oracle Internet Directory to always conduct a certificate search. For instance, if your certificate authority does not support two common names in certificate DNs but the directory DNs are using two common names, then you would need to provision all user certificates into the directory. You can then set the orclpkimatchingrule to 1.
If you do not want to support the functionality of using different DNs in the PKI certificate and Oracle Internet Directory, then you can set the orclpkimatchingrule value to 0. You use this setting if all certificate DNs match directory DNs and you do not wish to provision the certificates.
You can also create your own mapping rules to map certificate DNs to directory DNs in Oracle Internet Directory 10g Release 2 (10.1.2.0.2). To use mapping rules, orclpkimatchingrule is set to 3 or 4.
When you want to use the mapping rule for all users, set orclpkimatchingrule to 3. If you also need to support certificate-based search and exact match, then set orclpkimatchingrule to 4.
Table 3-2 describes the values of the orclpkimatchingrule attribute.
Table 3-2 Oracle Internet Directory Matching Rules
| Value | Rule |
|---|---|
orclpkimatchingrule=0 |
Exact match. The bind is based on the subject DN of the client certificate. This DN is compared with the DN of the user in the directory. |
orclpkimatchingrule=1 |
Certificate hash. The bind is based on the hashed value of the certificate. |
orclpkimatchingrule=2
(default) |
Certificate hash/exact match. The bind is based on the hashed value of the certificate. If this operation fails, then a bind based on the subject DN of the client certificate is performed. |
orclpkimatchingrule=3 |
Mapping rule only. |
orclpkimatchingrule=4 |
Mapping rule/certificate hash/exact match. The bind is based on the mapping rule. If this operation fails, a bind based on the hashed value of the certificate is performed. If this operation fails, then a bind based on an exact match of the certificate is performed. |
|
See Also: Oracle Internet Directory Administrator's Guide and Oracle Identity Management User Reference Guide for information on how to modify theorclpkimatchingrule attribute |
|
Note: A certificate search will fail if there is no user entry under the realm's user search base with that certificate, or if you are using an older version of Oracle Internet Directory that does not support the certificate search functionality. If the certificate search fails, then the database will revert to the old behavior of matching the user DN with the certificate DN for a successful connection. |
You have enabled SSL for your client-database Oracle Net connections as described in "Enabling SSL" in the Oracle Database Advanced Security Administrator's Guide. Ensure that you included the following steps when you enabled SSL:
Enabled SSL for your database listener on TCPS and provided a corresponding TNS name
Stored your database PKI credentials in the database wallet that Database Configuration Assistant automatically created during database registration
You have configured an SSL instance with two-way authentication for Oracle Internet Directory as described in Oracle Internet Directory Administrator's Guide.
You have prepared your directory by completing the tasks described in "Preparing the Directory for Enterprise User Security (Phase One)".
You have configured your Enterprise User Security objects in the database and the directory by completing the tasks described in "Configuring Enterprise User Security Objects in the Database and the Directory (Phase Two)".
To configure Enterprise User Security for SSL authentication, perform the following tasks:
Task 1: Enable the Enterprise Domain to Accept SSL Authentication
Task 2: Set the LDAP_DIRECTORY_ACCESS Initialization Parameter to SSL
Task 1: Enable the Enterprise Domain to Accept SSL Authentication
Use Enterprise Security Manager to enable SSL authentication for the enterprise domain (OracleDefaultDomain) by using the following steps:
Select the enterprise domain in the navigator pane.
Choose the Databases tabbed window and select Oracle Wallet (SSL) or All Types from the User Authentication methods listed.
Click Apply.
For more information about this task, see "Managing Database Security Options for an Enterprise Domain".
Task 2: Set the LDAP_DIRECTORY_ACCESS Initialization Parameter to SSL
You can change this initialization parameter either by editing your database initialization parameter file or by issuing an ALTER SYSTEM SQL command with the SET clause.
For example, the following ALTER SYSTEM command changes the LDAP_DIRECTORY_ACCESS parameter value to SSL in the server parameter file:
ALTER SYSTEM SET LDAP_DIRECTORY_ACCESS=SSL SCOPE=SPFILE
|
See Also:
|
Task 3: Connect as an SSL-Authenticated Enterprise User
Connecting as an SSL-authenticated enterprise user involves ensuring that you have the appropriate Oracle wallet features configured and that you do not have a wallet location specified in the client sqlnet.ora file. If the client sqlnet.ora file contains a wallet location, then multiple users and databases cannot share that file. Only the server sqlnet.ora file must have a value for the wallet location parameter.
|
See Also: Oracle Database Advanced Security Administrator's Guide for the default location of a user's wallet when the authentication used between the user and the database is SSL |
To connect as an SSL-authentication enterprise user, perform the following steps:
Use Oracle Wallet Manager to download a user wallet from the directory. See "Downloading a Wallet from an LDAP Directory" in the Oracle Wallet Manager chapter of Oracle Database Advanced Security Administrator's Guide.
Use Oracle Wallet Manager to enable autologin for the user wallet. Enabling autologin generates a single sign-on (.sso) file and enables authentication to the SSL adapter. See Oracle Database Advanced Security Administrator's Guide for information about using the autologin feature of Oracle Wallet Manager.
Set the TNS_ADMIN environment variable (to point to the client's sqlnet.ora file) for the client if the client Oracle home points to a server Oracle home. (Because a server must have a wallet location set in its sqlnet.ora file and a client cannot have a wallet location specified there, the server and client cannot share sqlnet.ora files.)
If you have a separate client Oracle home, then you do not need to set the TNS_ADMIN environment variable.
Launch SQL*Plus and enter the following at the command line:
SQL> /@connect_identifier
where connect_identifer is the Oracle Net service name you set up when you configured SSL for the database client.
If your connection succeeds, then the system responds with Connected to:.... This is the confirmation message of a successful connect and setup. If an error message is displayed, then see "ORA-# Errors for SSL-Authenticated Enterprise Users".
If you do connect successfully, then check that the appropriate global roles were retrieved from the directory, by entering the following at the SQL*Plus prompt:
select * from session_roles
If the global roles were not retrieved from the directory, then see "NO-GLOBAL-ROLES Checklist".
You have completed SSL-authenticated Enterprise User Security configuration.
|
Note: For security purposes, ensure that you disable auto login for the user wallet after logging out from the enterprise user session with the database. This is especially important if the client computer is shared by more than one user. See Oracle Database Advanced Security Administrator's Guide for information about using Oracle Wallet Manager to disable auto login for an Oracle wallet. |
When you use Database Configuration Assistant to register your database in the directory, this tool automatically creates identical DNs for the database wallet and the database directory entry. To view the database DN, use one of the following options:
Use Oracle Directory Manager to look in the directory under the realm Oracle Context for
cn=<short_database_name>,cn=OracleContext,<realm_DN>
where short_database_name is the first part of the fully qualified domain name for a database. For example, if you have a database named db1.us.oracle.com, then the short database name is db1.
Use the following mkstore utility syntax on the command line:
mkstore -wrl <wallet_location> -viewEntry ORACLE.SECURITY.DN
where wallet_location is the path to the database wallet.
|
See Also:
|
Current user database links require SSL-enabled network connections between the databases. Before you can enable current user database links, you must enable SSL, create Oracle wallets, and obtain PKI credentials for all databases involved.
Then, use Enterprise Security Manager to enable current user database links between databases within the enterprise domain in the directory by using the following steps:
Select the enterprise domain in the navigator pane.
Choose the Databases tabbed window and check Enable Current User Database Links.
Click Apply.
For more information about this task, see "Managing Database Security Options for an Enterprise Domain".
This section describes potential problems and associated corrective actions in the following topics:
If you receive an ORA-# error while using password-authenticated Enterprise User Security, then locate the error in the following section and take the recommended action.
Check that the correct wallet_location value is specified in the database's sqlnet.ora file in case you are not using the default wallet location. You can use Oracle Net Manager to enter the wallet location. You do not need to specify a wallet location in the sqlnet.ora file if the default wallet location is being used. If a wallet location is specified in the sqlnet.ora file, then you must ensure that it is correct.
If Domain Name System (DNS) server discovery of Oracle Internet Directory is not used, check that there is a correct ldap.ora file in $LDAP_ADMIN, $ORACLE_HOME/ldap/admin, $TNS_ADMIN, or $ORACLE_HOME/network/admin. (See Oracle Internet Directory Administrator's Guide for information about DNS server discovery.)
Check that the SSL port used (by way of either DNS discovery or an ldap.ora file) supports SSL with no authentication.
Check that the LDAP_DIRECTORY_ACCESS parameter is set to PASSWORD in the database initialization parameters file.
Use Database Configuration Assistant to reset the database password used to authenticate the database to Oracle Internet Directory. This resets it both locally in the database wallet, and remotely in the database entry in Oracle Internet Directory.
Check that the database wallet has autologin enabled. Either use Oracle Wallet Manager or check that there is a cwallet.sso file in $ORACLE_HOME/admin/<ORACLE_SID>/wallet/.
Use the password stored in the database wallet to check that the database can bind to Oracle Internet Directory:
Use the mkstore command-line utility to retrieve the database password from the wallet by using the following syntax:
mkstore -wrl <database wallet location> -viewEntry ORACLE.SECURITY.PASSWORD
Use the password returned from mkstore in the following ldapbind:
ldapbind -h <directory host> -p <non-SSL directory port> -D "<database DN>" -w <password returned by mkstore>
Check to ensure that the database belongs to only one enterprise domain.
|
Note: Themkstore utility is for troubleshooting purposes only. The name and functionality of this tool may change in the future. In 10g Release 2 (10.2), Oracle Database supports only the viewEntry mode. |
Use Enterprise Security Manager to check that a user search base containing this user is listed in the user search base attribute of the realm that you are using.
Check the ACL on the User Search Base in Oracle Internet Directory to ensure that the verifierServices group has read permission on the user entry, and that this permission is not prevented by an ACL between the User Search Base entry and the user entry in the directory tree.
Check that the enterprise domain is in the password-accessible domains group for that realm Oracle Context.
Check that a user entry exists in Oracle Internet Directory for your user.
Use Enterprise Security Manager to check that a user search base containing this user is listed in the identity management realm that you are using.
Check that the user entry contains the correct login name:
Use Enterprise Security Manager Console to find the login name attribute that is configured for the directory in your realm, and
Check that the name provided during the attempted user database login is the value for that attribute in the user directory entry.
If you have an exclusive schema for the global user in the database, then check that the DN in the database matches the DN of the user entry in Oracle Internet Directory.
Check that the user entry in the directory has the orcluser object class. If it does not, then perform the following steps:
Use Oracle Internet Directory Self-Service Console to check that the default object classes for new user creation include orcluser, and then
Use Enterprise Security Manager Console or Oracle Internet Directory Self-Service Console to re-create the user, or
Add the orcluser and the orcluserV2 object classes.
Check that there is a value for the attribute orclpassword in the user entry. If there is no value, then reset the user's directory password (userpassword attribute). This should prompt Oracle Internet Directory to regenerate the database password verifier for the user.
Use Enterprise Security Manager to check that the user search base containing this user is listed in the user search base attribute of the realm that you are using.
Use Enterprise Security Manager to check that the enterprise domain is in the password-accessible domains group.
Check that the ACL on the user search base attribute allows read and search access to the orclpassword attributes by the verifierServices group. This is set properly by default, but may have been altered.
If you receive an ORA-# error while using Kerberos-authenticated Enterprise User Security, then locate the error in the following section and take the recommended action.
Use Enterprise Security Manager to set the user authentication policy for this enterprise domain to KERBEROS or ALL.
Check that the user entry in the directory has the krbprincipalname attribute.
If it does not have the krbprincipalname attribute, then check the following:
Check that the default attributes for new user creation by using Oracle Internet Directory Self-Service Console include krbprincipalname, and then
Use Enterprise Security Manager Console or Oracle Internet Directory Self-Service Console to create the user again, or
Add the orclcommonattributes object class.
Check that there is a value for the attribute krbprincipalname in the user entry. If there is no value, then use Oracle Internet Directory Self-Service Console to enter one.
Use Enterprise Security Manager to check that the user search base containing this user is listed in the realm Oracle Context that you are using.
Check that the ACL on the user search base attribute allows read and search access to the krbprincipalname attributes by the verifierServices group. This is set properly by default, but may have been altered.
Check that a user entry exists in Oracle Internet Directory for your user.
Use Enterprise Security Manager or ldapsearch to check that a user search base containing this user is listed in the identity management realm that you are using.
Check that the user entry in the directory contains the correct Kerberos principal name, by using the following steps:
Use Enterprise Security Manager Console to find the Kerberos principal name attribute that is configured for the directory in your realm, and
Check that the correct Kerberos principal name appears in that attribute in the user's directory entry.
If you have an exclusive schema for the global user in the database, check that the DN in the database matches the DN of the user entry in Oracle Internet Directory.
Use the mkstore command-line utility to retrieve the database password for the wallet by using the following syntax:
mkstore -wrl <database wallet location> -viewEntry ORACLE.SECURITY.PASSWORD -viewEntry ORACLE.SECURITY.DN
If these values are incorrect, reset the database wallet by using Database Configuration Assistant.
Use the DN and the password returned by mkstore in the following ldapbind:
ldapbind -h <directory host> -p <non-SSL directory port> -D "<database DN>" -w <password>
|
Note: Themkstore utility is for troubleshooting purposes only. The name and functionality of this tool may change in the future. In 10g Release 2 (10.2), Oracle Database supports only the viewEntry mode. |
If you receive an ORA-# error while using SSL-authenticated Enterprise User Security, then locate the error in the following section and perform the recommended action.
Check that there is a correct wallet_location value in the database's sqlnet.ora file. If not, then use Oracle Net Manager to enter one.
If Domain Name System (DNS) server discovery of Oracle Internet Directory is not used, then check that there is a correct ldap.ora file in $LDAP_ADMIN, $ORACLE_HOME/ldap/admin, $TNS_ADMIN or $ORACLE_HOME/network/admin. (See Oracle Internet Directory Administrator's Guide for information about DNS server discovery.)
Check that the Oracle Internet Directory SSL port used (by way of DNS discovery or an ldap.ora file) supports SSL with two-way authentication.
Check that the LDAP_DIRECTORY_ACCESS parameter is set to SSL in the database initialization parameters file.
Check that the database wallet has autologin enabled. Either use Oracle Wallet Manager or check that there is a cwallet.sso file in $ORACLE_HOME/admin/<ORACLE_SID>/wallet/.
Use the mkstore command-line utility to check that the database wallet has the database DN in it by using the following syntax:
mkstore -wrl <database_wallet_location> -viewEntry ORACLE.SECURITY.DN
If the wallet does not contain the database DN, then use Database Configuration Assistant to reregister the database with Oracle Internet Directory.
Check that the database can bind to Oracle Internet Directory, by using its wallet with the following ldapbind:
ldapbind -h <directory_host> -p <directory_SSLport> -U 3 -W "file:<database wallet_location>" -P <wallet_password>
Check to ensure that the database belongs to only one enterprise domain.
|
Note: Themkstore utility is for troubleshooting purposes only. The name and functionality of this tool may change in the future. In 10g Release 2 (10.2), Oracle supports only the viewEntry mode. |
If the enterprise user can connect to the database but a select * from session_roles returns no global roles, then check the following:
Check that the global role has been created in the database. To create global roles, use the following syntax:
CREATE ROLE <role_name> IDENTIFIED GLOBALLY;
Use Enterprise Security Manager to check that the global role is included in an enterprise role in the directory.
Use Enterprise Security Manager to check that the enterprise role is assigned to the user in the directory.
If these checks are fine, then see the "DOMAIN-READ-ERROR Checklist".
If your database cannot read the user schema, then check the following:
If this is an SSL-authenticated enterprise user, then ensure that the correct user wallet is being used by checking the following:
There is no WALLET_LOCATION parameter value in the client sqlnet.ora file, and
The TNS_ADMIN parameter is set properly so that the correct sqlnet.ora file is being used.
Check that the schema was created in the database as a global user, by using the following syntax:
CREATE USER username IDENTIFIED GLOBALLY AS ' ';
or by using the following syntax:
CREATE USER username IDENTIFIED GLOBALLY AS '<DN>';
Suppose the following is true:
The user schema is an exclusive schema (created with the CREATE USER username IDENTIFIED GLOBALLY AS '<user_DN>'; syntax), and
This is an SSL-authenticated user.
Then, ensure that the DN in the user wallet matches the DN that was used in the CREATE USER statement.
Use Oracle Wallet Manager to view the DN in the user wallet.
Use the following syntax to view the DN that was used with the CREATE USER statement:
SELECT EXTERNAL_NAME FROM DBA_USERS WHERE USERNAME='<schema>';
If you are using a shared schema, then check the following:
Use Enterprise Security Manager to ensure that you have created a user-schema mapping either for the entire enterprise domain or for the database.
If the user-schema mapping is intended to apply to this database (not to the entire enterprise domain), then check that the database can read its own entry and subtree in the directory.
To check this, enter the following ldapsearch command for your database-to-directory connection type:
If the database connects to the directory over SSL, then use
ldapsearch -h <directory_host> -p <directory_SSLport> -U 3 -W "file:<database_wallet_path>" -P <wallet_password> -b "<database_DN>" "objectclass=*"
where <wallet_password> is the password to the wallet, which enables you to open or change the wallet.
If the database connects to the directory by using password authentication, then use
ldapsearch -h <directory_host> -p <directory_port> -D <database_DN> -w <database_directory_password> -b "<database_DN>" "objectclass=*"
where <database_directory_password> is the password in the database wallet, which is the database's password to Oracle Internet Directory.
You should see the database entry and the relevant mapping.
If the user-schema mapping applies to the entire enterprise domain rather than to only this individual database, then see "DOMAIN-READ-ERROR Checklist".
If your database cannot read its enterprise domain information in Oracle Internet Directory, then check the following:
Use Enterprise Security Manager to check that the database is a member of exactly one enterprise domain, and add it to one if it is not.
Check that the database can see its domain, by entering one of the following at the command line:
If the database connects to the directory over SSL, then use
ldapsearch -h <directory_host> -p <directory_SSLport> -U 3 -W "file:<database_wallet_path>" -P <wallet_password> -b "cn=OracleContext, <realm_DN>" "objectclass=orclDBEnterpriseDomain"
where <wallet_password> is the password to the wallet, which enables you to open or change the wallet.
If the database connects to the directory by using password authentication, then use
ldapsearch -h <directory_host> -p <directory_port> -D <database_DN> -w <database_directory_password> -b "cn=OracleContext, <realm_DN>" "objectclass=orclDBEnterpriseDomain"
where <database_directory_password> is the password in the database wallet, which is the database's password to Oracle Internet Directory.
This ldapsearch should return exactly one enterprise domain.
If no domain is returned and Enterprise Security Manager shows the database as a member of a domain, then restart the database. Restarting the database updates the cached value for the enterprise domain.
If more than one domain is returned, then use Enterprise Security Manager to remove the database from the additional domain.
Check that the database can read the enterprise domain subtree and thus can read its enterprise roles and mappings, by entering one of the following at the command line:
If the database connects to the directory over SSL, then use
ldapsearch -h <directory_host> -p <directory_SSLport> -U 3 -W "file:<database_wallet_path>" -P <wallet_password> -b "cn=OracleContext, <realm_DN>" "objectclass=orclDBEnterpriseRole"
where <wallet_password> is the password to the wallet, which enables you to open or change the wallet.
If the database connects to the directory by using password authentication, then use
ldapsearch -h <directory_host> -p <directory_port> -D <database_DN> -w <database_directory_password> -b "cn=OracleContext, <realm_DN>" "objectclass=orclDBEnterpriseRole"
where <database_directory_password> is the password in the database wallet, which is the database password to Oracle Internet Directory.
This ldapsearch should return all of the enterprise roles that you have created for this domain. If it does not, then use Enterprise Security Manager to create enterprise roles and mappings.
Use Enterprise Security Manager to set or reset the user authentication policy for the relevant enterprise domain. See "Managing Database Security Options for an Enterprise Domain" for information about setting the user authentication policy for an enterprise domain.
