| Oracle® Identity Management Integration Guide 10g (10.1.4.0.1) Part Number B15995-01 |
|
|
View PDF |
| Oracle® Identity Management Integration Guide 10g (10.1.4.0.1) Part Number B15995-01 |
|
|
View PDF |
This chapter discusses the most important aspects of security in Oracle Directory Integration Platform. It contains these topics:
Authentication is the process by which the Oracle directory server establishes the true identity of the user connecting to the directory. It occurs when an LDAP session is established by means of the ldapbind operation.
It is important that each component in Oracle Directory Integration Platform be properly authenticated before it is allowed access to the directory.
This section contains these topics:
You can deploy Oracle Directory Integration Platform with or without Secure Socket Layer (SSL). SSL implementation supports these modes:
No authentication—Provides SSL data encryption, but does not use SSL for authentication.
SSL server authentication—Includes both SSL data encryption and SSL authentication of the server to the client. In Oracle Directory Integration Platform, the server is the directory server, and the client is the Oracle directory integration platform.
The server verifies its identity to the client by sending a certificate issued by a trusted certificate authority (CA). This mode requires a public key infrastructure (PKI) and SSL wallets to hold the certificates.
To use SSL with Oracle Directory Integration Platform, you must start both the Oracle directory server and Oracle directory integration platform in SSL mode.
|
See Also: The chapter on preliminary tasks and information in Oracle Internet Directory Administrator's Guide for instructions about starting the Oracle directory server in SSL mode |
You can install and run multiple instances of the directory integration server on various hosts. However, when you do this, beware of a malicious user either posing as the directory integration server or using an unauthorized copy of it.
To avoid such security issues:
Ensure that each directory integration server is identified properly.
Ensure that, when you start a directory integration server, it is properly authenticated before it obtains access to Oracle Internet Directory.
To use non-SSL authentication, register each directory integration server by using the registration tool called odisrvreg.
The registration tool creates:
An identity entry in the directory. The directory integration server uses this entry when it binds to the directory.
An encrypted password. It stores this password in the directory integration server entry.
A private wallet on the local host. This wallet contains the security credentials, including an encrypted password. The name of the wallet is specified in the odi.properties file, and it is stored in the $ORACLE_HOME/ldap/odi/conf directory.
When it binds to the directory, the directory integration server uses the encrypted password in the private wallet.
|
Note: Ensure that the wallet is protected against unauthorized access. |
The identity of the directory server can be established by starting both Oracle Internet Directory and the directory integration server in SSL server authentication mode. In this case, the directory server provides its certificate to the directory integration server, which acts as the client of Oracle Internet Directory.
The directory integration server is authenticated by using the same mechanism used in the non-SSL mode.
You can also configure the Oracle directory integration platform to use SSL when connecting to a third-party directory. In this case, you store the connected directory certificates in the wallet as described in "Managing the SSL Certificates of Oracle Internet Directory and Connected Directories".
Within Oracle Internet Directory, an integration profile represents a user with its own distinguished name (DN) and password. The users who can access the profiles are:
The administrator of Oracle Directory Integration Platform (DIPAdmin), represented by the DN Cn=dipadmin,cn=dipadmins,cn=directory integration platform,cn=products,cn=oraclecontext
Members of the Oracle Directory Integration Platform administrator group (DIPAdminGroup), represented by the DN cn=dipadmingrp,cn=dipadmin,cn=directory integration platform,cn=products,cn=oraclecontext
When the directory integration server imports data to Oracle Internet Directory based on an integration profile, it proxy-binds to the directory as that integration profile.The Oracle directory integration platform can bind in either SSL or non-SSL mode.
Authorization is the process of ensuring that a user reads or updates only the information for which he or she has privileges. When directory operations are attempted within a directory session, the directory server ensures that the user— identified by the authorization identifier associated with the session—has the requisite permissions to perform those operations. If the user does not have the necessary permissions, then the directory server disallows the operation. Through this mechanism, called access control, the directory server protects directory data from unauthorized operations by directory users.
To restrict access to only the desired subset of Oracle Internet Directory data, for both the directory integration server and a connector, place appropriate access policies in the directory.
This section discusses these policies in detail. It contains these topics:
The Oracle directory integration server binds to the directory both as itself and on behalf of the profile, as follows:
When it binds as itself, it can cache the information in various integration profiles. This enables the directory integration server to schedule synchronization actions to be carried out by various connectors.
When the directory integration server operates on behalf of a profile, it acts as proxy for the profile—that is, it uses the profile credentials to bind to the directory and perform various operations. The directory integration server can perform only those operations in the directory that are permitted in the profile.
To establish and manage access rights granted to directory integration servers, Oracle Directory Integration Platform creates a group entry, called odisgroup, during installation. The DN of odisgroup is cn=odisgroup,cn=odi,cn=oracle internet directory. When a directory integration server is registered, it becomes a member of this group.
You control the access rights granted to directory integration servers by placing access control policies in the odisgroup entry. The default policy grants various rights to directory integration servers for accessing the profiles. For example, the default policy enables the directory integration server to compare user passwords between Oracle Internet Directory and a connected directory it binds as a proxy on behalf of a profile. It also enables directory integration servers to modify status information in the profile—such as the last successful execution time and the synchronization status.
To control access to Oracle Internet Directory data by using integration profiles, place appropriate access control policies in Oracle Internet Directory. This enables you to protect data synchronized or processed by one profile from interference by another profile. It also enables you to allow only the integration profile that owns synchronization of an attribute to modify that attribute.
|
See Also: The chapter on access control, specifically, the section about security groups, in Oracle Internet Directory Administrator's Guide for instructions about setting access control policies for group entries |
For example, creating a group entry called odipgroup when installing the Oracle Internet Directory enables you to control the access rights granted to various profiles. Rights are controlled by placing appropriate access policies in the odipgroup entry. Each profile is a member of this group. The membership is established when the profile is registered in the system. The default access policy, automatically installed with the product, grants to profiles certain standard access rights for the integration profiles they own. One such right is the ability to modify status information in the integration profile, such as the parameter named orclodipConDirLastAppliedChgTime. The default access policy also permits profiles to access Oracle Internet Directory change logs, to which access is otherwise restricted.
The odisgroup group entries and their default policies are created during the server installation of Oracle Internet Directory. Oracle Directory Integration Platform-only installations do not create these groups and policies.
Oracle Directory Integration Platform ensures that data is not modified, deleted, or replayed during transmission by using SSL. This SSL feature generates a cryptographically secure message digest—through cryptographic checksums using either the Message-Digest algorithm 5 (MD5) or the Secure Hash Algorithm (SHA) —and includes the message digest with each packet sent across the network.
Oracle Directory Integration Platform ensures that data is not disclosed during transmission by using public-key encryption available with SSL. In public-key encryption, the sender of a message encrypts the message with the public key of the recipient. Upon delivery, the recipient decrypts the message using the recipient's private key.
To exchange data securely between the directory integration server and Oracle Internet Directory, you run both components in SSL mode.
You can run all the commonly used tools in SSL mode to transmit data to Oracle Internet Directory securely. These tools include:
Oracle Directory Manager
The Oracle directory integration server registration tool
The Oracle Directory Integration Server Administration tool
The Directory Integration Assistant (dipassistant)
The Provisioning Subscription Tool
