17
Using Oracle Enterprise Login Assistant

Use Oracle Enterprise Login Assistant to open and close wallets, to update centrally managed wallets and passwords in an LDAP directory, and to enable or disable secure SSL connections.

This chapter describes Oracle Enterprise Login Assistant, and contains the following topics:

• About Oracle Enterprise Login Assistant

• Starting Oracle Enterprise Login Assistant

• Opening Existing Wallet on Local System

• Connecting to LDAP Directory and Downloading New Wallet

• Changing Wallet Passwords

• Uploading Wallet to LDAP Directory

• Logging Out and Disabling SSL Connection

See Also: Chapter 16, Using Oracle Wallet Manager, for information about managing wallets with Oracle Wallet Manager.

About Oracle Enterprise Login Assistant

Oracle Enterprise Login Assistant is a client-side tool used to authenticate users to the enterprise. It can authenticate users to an LDAP directory service, and download an Oracle wallet from the directory. It can also decrypt the wallet and let users establish a seamless SSL connection to all PKI-enabled applications and databases within the enterprise--without requiring additional passwords. Enterprise Login Assistant can update the directory password (OID only) and other related passwords stored in the directory, and it can also upload an Oracle Wallet to the directory.

Starting Oracle Enterprise Login Assistant

Refer to your platform-specific documentation for instructions about how to start Oracle Enterprise Login Assistant.

Opening Existing Wallet on Local System

Upon startup, Oracle Enterprise Login Assistant searches for an installed wallet in the default system location--defined in your platform-specific documentation. If it finds an installed wallet, the main login window appears; in this example, no local wallet was found (Figure 17-1):

Figure 17-1 Enterprise Login Assistant Login Window

Text description of the illustration ela_001.gif

To establish a secure SSL connection using the default wallet:

1. Choose the Local Copy button.

2. Enter the wallet password.

3. Choose the Login button.

   Enterprise Login Assistant creates an obfuscated copy of the wallet in the local file system, and you are returned to the logged-in state; the Logged-In Window appears (Figure 17-2). This confirms that the wallet was opened successfully, and that a successful connection has been established.

   Figure 17-2 Enterprise Login Assistant Logged-In Window

   
   
   Text description of the illustration ela_loggedin.gif

   Note: If Enterprise Login Assistant finds an obfuscated wallet upon startup, it assumes that you are already logged in--automatically changing to logged-in state.

Connecting to LDAP Directory and Downloading New Wallet

Enterprise Login Assistant can download a new wallet from an LDAP directory to your local system. This is necessary for your first connection to an Oracle enterprise.

To connect to an LDAP directory and download a new wallet:

1. Choose the Directory Service button (Figure 17-3).

   Figure 17-3 Enterprise Login Assistant Directory Login Window

   
   
   Text description of the illustration ela_003.gif
2. Enter your directory UserID and password.

3. Choose the Login button.

   Enterprise Login Assistant attempts to connect to the directory and download a wallet. If there is no default directory service configured, it prompts for the hostname and port of an alternative directory service (contact your System Administrator for further details).

4. Enterprise Login Assistant stores the wallet in the default location on the local system and attempts to decrypt it using the directory password. If the directory password is different from the wallet password, it prompts you for the wallet password.

5. Enterprise Login Assistant creates an obfuscated copy of the wallet in the local file system, and you are returned to the logged-in state; the Logged-In Window appears (Figure 17-2). This confirms that the wallet was successfully copied to the local system and opened.

Changing Wallet Passwords

You can use Enterprise Login Assistant to change any or all of the following passwords:

• The wallet password

• The directory password

• The database password

To change a password:

1. Choose the Change Password button from the Logged In Window (Figure 17-2); the Change Password Window appears (Figure 17-4):

   Figure 17-4 Enterprise Login Assistant Change Password Window

   
   
   Text description of the illustration ela_004.gif
2. Choose one of the following password change options:
   • All Passwords Below

   • Wallet Password Only

   • Directory Password Only

   • Oracle Database Password Only

3. Enter your directory UserID.

4. Enter your existing password in the Old password field.

5. Enter your new password, in accordance with your password policy, and confirm it by entering it again.

6. Enter an optional password hint in the Reminder field.

7. Choose the OK button.

   If the Old Password you entered matches the existing password(s), Enterprise Login Assistant updates the selected passwords with the new password and optional hint. Enterprise Login Assistant displays the following message to confirm successful update of the new password(s):

   Password changed successfully.

   Choose the OK button to exit the dialog box.

   Notes: If you choose Wallet Password Only, a UserID is not required, and you cannot enter a Reminder. Enterprise Login Assistant provides users with a broad range of control over their own passwords and credentials. However, your enterprise installation may have special security requirements that limit the applicability of this tool. Security Administrators can adjust the enterprise-wide security schema in the LDAP directory to inhibit users from updating certain passwords, or to force users to make all passwords identical--which would disable the individual password selection options in the Change Password Window (Figure 17-4).

Uploading Wallet to LDAP Directory

To upload a wallet to an LDAP directory:

1. Choose the Upload Wallet button in the Logged-In Window (Figure 17-2).

2. If you have already authenticated to the LDAP directory service in the current session, the local obfuscated wallet is in a closed state (encrypted); a copy of the wallet is uploaded to the directory, replacing the existing wallet.

3. If you have not yet authenticated to the LDAP directory service in the current session, Enterprise Login Assistant prompts you for your directory UserID and password to connect you to the directory before Step 2 is performed.

Logging Out and Disabling SSL Connection

Use Enterprise Login Assistant to disable single sign-on communications from server-side applications.

To log out and disable the SSL connection:

1. Choose the Logout button from the Logged-In Window (Figure 17-2).

   Enterprise Login Assistant displays the following warning:

   If you log out, your applications will no longer use the security credentials of your wallet.

2. Choose the Yes button to continue; you are returned to the Login Window (Figure 17-1).