Contents

Title and Copyright Information

List of Figures

List of Tables

Send Us Your Comments

Preface

Audience

Organization

Related Documentation

Conventions

Documentation Accessibility

Part I Introduction

1 Introduction to Oracle Advanced Security

About Oracle Advanced Security

Security in an Intranet or Internet Environment

Security Threats

Oracle Advanced Security Features

Data Privacy

Data Integrity

Authentication

Single Sign-On

Authorization

Oracle Advanced Security Architecture

Secure Data Transfer Across Network Protocol Boundaries

System Requirements

Oracle Advanced Security Restrictions

Part II Encryption, Integrity, and JDBC

2 Configuring Data Encryption and Integrity

Oracle Advanced Security Encryption

Overview

DES Algorithm for Standards-Based Encryption

Triple-DES Support

RSA RC4 Algorithm for High Speed Encryption

Oracle Advanced Security Data Integrity

Data Integrity Algorithms Supported

Diffie-Hellman Based Key Management

Authentication Key Fold-in

Configuring Data Encryption and Integrity

Activating Encryption and Integrity

Negotiating Encryption and Integrity

Setting the Encryption Seed

Configuring Encryption and Integrity Parameters Using Oracle Net Manager

3 Thin JDBC Support

About the Java Implementation

Java Database Connectivity Support

Securing Thin JDBC

Implementation Overview

Obfuscation

Configuration Parameters

Client Encryption Level

Client Encryption Selected List

Client Integrity Level

Client Integrity Selected List

Part III Configuring Authentication Methods

4 Configuring RADIUS Authentication

RADIUS Overview

RADIUS Authentication Modes

Synchronous Authentication Mode

Challenge-Response (Asynchronous) Authentication Mode

Enabling RADIUS Authentication and Accounting

Task 1: Install RADIUS on the Oracle Database Server and on the Oracle Client

Task 2: Configure RADIUS Authentication

Task 3: Create a User and Grant Access

Task 4: Configure RADIUS Accounting

Task 5: Add the RADIUS Client Name to the RADIUS Server Database

Task 6: Configure the Authentication Server for Use with RADIUS

Task 7: Configure the RADIUS Server for Use with the Authentication Server

Task 8: Configure Mapping Roles

Using RADIUS to Log In to a Database

5 Configuring CyberSafe Authentication

Configuring CyberSafe Authentication

Task 1: Install the CyberSafe Server

Task 2: Install the CyberSafe TrustBroker Client

Task 3: Install the CyberSafe Application Security Toolkit

Task 4: Configure a Service Principal for an Oracle Database Server

Task 5: Extract the Service Table from CyberSafe

Task 6: Install an Oracle Database Server

Task 7: Install Oracle Advanced Security With CyberSafe

Task 8: Configure Oracle Net and Oracle9i

Task 9: Configure CyberSafe Authentication

Task 10: Create a CyberSafe User on the Authentication Server

Task 11: Create an Externally Authenticated Oracle User on the Oracle Database Server

Task 12: Get the Initial Ticket for the CyberSafe/Oracle User

Task 13: Connect to an Oracle Database Server Authenticated by CyberSafe

Troubleshooting

If you cannot get your ticket-granting ticket using kinit:

If you have an initial ticket, but still cannot connect:

If you have a service ticket, and you still cannot connect:

If everything seems to work fine, but then you issue another query and it fails:

6 Configuring Kerberos Authentication

Enabling Kerberos Authentication

Task 1: Install Kerberos

Task 2: Configure a Service Principal for an Oracle Database Server

Task 3: Extract a Service Table from Kerberos

Task 4: Install an Oracle Database Server and an Oracle Client

Task 5: Install Oracle Net and Oracle Advanced Security

Task 6: Configure Oracle Net and Oracle9i

Task 7: Configure Kerberos Authentication

Task 8: Create a Kerberos User

Task 9: Create an Externally-authenticated Oracle User

Task 10: Get an Initial Ticket for the Kerberos/Oracle User

Utilities for the Kerberos Authentication Adapter

Use okinit to Obtain the Initial Ticket

Use OKLIST to Display Credentials

Use OKDSTRY to Remove Credentials from the Cache File

Connecting to an Oracle Database Server Authenticated by Kerberos

Troubleshooting

If you cannot get your ticket-granting ticket using OKINIT:

If you have an initial ticket, but still cannot connect:

If you have a service ticket and you still cannot connect:

If everything seems to work fine, but then you issue another query and it fails:

7 Configuring Secure Sockets Layer Authentication

SSL in an Oracle Environment

What You Can Do with SSL

Architecture of SSL in an Oracle Environment

Components of SSL in an Oracle Environment

How SSL Works in an Oracle Environment: The SSL Handshake

SSL Beyond an Oracle Environment

SSL Combined with Other Authentication Methods

Architecture: Oracle Advanced Security and SSL

Using SSL with Other Authentication Methods

SSL and Firewalls

SSL Usage Issues

Enabling SSL

Task 1: Install Oracle Advanced Security and Related Products

Task 2: Configure SSL on the Client

Task 3: Configure SSL on the Server

Task 4: Log on to the Database

8 Configuring Entrust-Enabled SSL Authentication

Overview

Oracle Advanced Security

Entrust/PKI

Entrust-Enabled Oracle Advanced Security

System Components

Entrust/PKI 5.0.2 for Oracle

Entrust/Toolkit Server Login 5.0.2

Entrust IPSEC Negotiator Toolkit 5.0.2

Entrust Authentication Process

Enabling Entrust Authentication

Creating Entrust Profiles

Installing Oracle Advanced Security and Related Products

Configuring SSL on the Client and Server

Configuring Entrust on the Client

Configuring Entrust on the Server

Creating Database Users

Logging Into the Database

Issues and Restrictions

Troubleshooting Entrust In Oracle Advanced Security

ORA-28890 Entrust Login Failed

General Problems and Guidelines

9 Configuring Multiple Authentication Methods

Connecting with User Name and Password

Disabling Oracle Advanced Security Authentication

Configuring Multiple Authentication Methods

Configuring Oracle9i for External Authentication

Setting the SQLNET.AUTHENTICATION_SERVICES Parameter in sqlnet.ora

Verifying that REMOTE_OS_AUTHENT Is Not Set to TRUE

Setting OS_AUTHENT_PREFIX to a Null Value

Part IV Oracle DCE Integration

10 Overview of Oracle DCE Integration

Oracle DCE Integration Requirements

System Requirements

Backward Compatibility

The Distributed Computing Environment

Components of Oracle DCE Integration

DCE Communication/Security

DCE Cell Directory Services Native Naming

Flexible DCE Deployment

Release Limitations

11 Configuring DCE for Oracle DCE Integration

To Configure DCE for Oracle DCE Integration:

Task 1: Create New Principals and Accounts

Task 2: Install the Key of the Server into a Keytab File

Task 3: Configure DCE CDS for Use by Oracle DCE Integration

12 Configuring Oracle9i for Oracle DCE Integration

DCE Address Parameters

Configuring Oracle9i and Oracle Net

Task 1: Configure the Server

Task 2: Create and Name Externally-Authenticated Accounts

Task 3: Set up DCE Integration External Roles

Task 4: Configure DCE for SYSDBA and SYSOPER Connections to Oracle Databases

Task 5: Configure the Client

Task 6: Configure Clients to Use DCE CDS Naming

13 Connecting to an Oracle Database in DCE

Starting the Listener

Connecting to an Oracle Database Server in the DCE Environment

Method 1

Method 2

14 DCE and Non-DCE Interoperability

Connecting Clients Outside DCE to Oracle Servers in DCE

Sample Parameter Files

The listener.ora File

The tnsnames.ora File

Using tnsnames.ora for Name Lookup When CDS Is Inaccessible

SQL*Net Release 2.2 and Earlier

SQL*Net Release 2.3 and Oracle Net

Part V Oracle9i Enterprise User Security

15 Managing Enterprise User Security

Part I: Overview / Concepts

Overview of Enterprise User Security

Introduction to Enterprise User Security

Enterprise Users and Authentication Methods

Enterprise Users and Password Authentication

Elements of Enterprise User Security

The Enterprise User Security Process with SSL

The Enterprise User Security Process with Passwords

Shared Schemas

Overview

Configuring Shared Schemas

Shared Schema Functionality and SSL

Creating a Shared Schema

Creating an Enterprise User in the Directory

Mapping an Enterprise User to a Shared Schema

Current User Database Links

Enterprise User Security Components

Oracle Enterprise Security Manager

Oracle Enterprise Login Assistant

Oracle Wallet Manager

Deployment Considerations

Security Aspects of Centralizing Security Credentials

Database Membership in Enterprise Domains

Part II: Initial Configuration for SSL and Password Authentication

Task 1: Install or Identify a Certificate Service

Task 2: Install and Configure a Directory Service

Task 3: Install and Configure the Database

Task 4: Configure the Database for SSL

Task 5: Create the Wallet and Start the Listener

Task 6: Verify Database Installation

Task 7: Create Global Schemas and Roles

Part III: Final Configuration for SSL Authentication

Task 8: Configure Database Clients

Task 9: Configure an Enterprise Domain

Task 10: Configure Enterprise Users

Task 11: Log In as an Enterprise User

Part IV: Final Configuration for Password Authentication

Task 12: Complete Initial Setup Steps

Task 13: Configure the Enterprise Domain

Task 14: Configure Oracle Context

Task 15: Configure Enterprise Users

Task 16: Connect as Password Authenticated Enterprise User

Part V: TroubleShooting Enterprise User Login

No Global Roles

TNS Lost Connection

ORA-1004: Default username feature not supported

ORA-1017: Invalid username/password

ORA-12560: Protocol adapter error

Decryption of Encrypted Private Key Fails

ORA-28030

Tracing

16 Using Oracle Wallet Manager

Overview

PKCS #12 Support

Importing Third-Party Wallets

Exporting Oracle Wallets

Multiple Certificate Support

LDAP Directory Support

Managing Wallets

Starting Oracle Wallet Manager

Creating a New Wallet

Opening an Existing Wallet

Closing a Wallet

Uploading a Wallet to an LDAP Directory

Downloading a Wallet from an LDAP Directory

Saving Changes

Saving the Open Wallet to a New Location

Saving in System Default

Deleting the Wallet

Changing the Password

Using Auto Login

Managing Certificates

Managing User Certificates

Managing Trusted Certificates

17 Using Oracle Enterprise Login Assistant

About Oracle Enterprise Login Assistant

Starting Oracle Enterprise Login Assistant

Opening Existing Wallet on Local System

Connecting to LDAP Directory and Downloading New Wallet

Changing Wallet Passwords

Uploading Wallet to LDAP Directory

Logging Out and Disabling SSL Connection

18 Using Oracle Enterprise Security Manager

Introduction

Installing and Configuring Oracle Enterprise Security Manager

Task 1: Configure an Oracle Internet Directory

Task 2: Install Oracle Enterprise Manager

Task 3: Configure Oracle Enterprise Manager for Enterprise User Security

Task 4: Start Oracle Enterprise Security Manager

Task 5: Log On to the Directory

Administering a Directory for Enterprise User Security

Administering Enterprise Users

Creating New Enterprise Users

Defining a Directory Base

Defining a New Enterprise User Password

Defining an Initial Enterprise Role Assignment

Viewing an Oracle Wallet

Browsing Users in the Directory

Enabling Database Access

Administering Oracle Contexts

Oracle Context Versions

Defining Properties of an Oracle Context

Defining User Search Bases

Defining Oracle Context Administrators

Managing Password Accessible Domains

Managing Database Security

Administering Databases

Managing Database Administrators

Managing Database Schema Mappings

Administering Enterprise Domains

Defining Database Membership of an Enterprise Domain

Managing Database Security Options for an Enterprise Domain

Managing Enterprise Domain Administrators

Managing Enterprise Domain Database Schema Mappings

Administering Enterprise Roles

Assigning Database Global Role Membership to an Enterprise Role

Managing Enterprise Role Grantees

Part VI Appendixes

A Data Encryption and Integrity Parameters

Sample sqlnet.ora File

Data Encryption and Integrity Parameters

Encryption and Integrity Level Settings

Encryption and Integrity Selected Lists

Seeding the Random Key Generator

B Authentication Parameters

Parameters for Clients and Servers using CyberSafe Authentication

Parameters for Clients and Servers using Kerberos Authentication

Parameters for Clients and Servers using RADIUS Authentication

sqlnet.ora File Parameters

Minimum RADIUS Parameters

Initialization File (init.ora) Parameters

Parameters for Clients and Servers using SSL

Authentication Parameters

Cipher Suites

SSL Version

SSL Client Authentication

Wallet Location

C Integrating Authentication Devices Using RADIUS

About the RADIUS Challenge-Response User Interface

Customizing the RADIUS Challenge-Response User Interface

D Oracle Advanced Security FIPS 140-1 Settings

Configuration Parameters

Server Encryption Level Setting

Client Encryption Level Setting

Server Encryption Selection List

Client Encryption Selection List

Cryptographic Seed Value

FIPS Parameter

Post Installation Checks

Status Information

Physical Security

E Oracle Implementation of Java SSL

Prerequisites

Oracle Java SSL Features

SSL Cipher Suites Supported by Oracle Java SSL

Certificate and Key Management with Oracle Wallet Manager

Security-Aware Applications Support

Oracle Java SSL Examples

SSLServerExample Program

SSLClientExample Program

SSLProxyClientExample Program

Typical Errors

SSLException X509CertExpiredErr

SSLException X509CertChainInvalidErr

Client Connection with No Credentials

Oracle Java SSL API

Public Class: OracleSSLCredential

Public Interface: OracleSSLProtocolVersion

Public Class: OracleSSLServerSocketFactoryImpl

Public Class: OracleSSLSession

Public Class: OracleSSLSocketFactoryImpl

F Abbreviations and Acronyms

Glossary

Index