|Oracle® Database Security Guide
12c Release 1 (12.1)
|PDF · Mobi · ePub|
This chapter contains:
You use authentication to prove the identities of users who are attempting to log into the database. Authenticating user identity is imperative in distributed environments, without which there can be little confidence in network security. Passwords are the most common means of authentication. Oracle Database enables strong authentication with Oracle authentication adapters that support various third-party authentication services, including SSL with digital certificates.
Figure 15-1 shows user authentication with an Oracle database instance configured to use a third-party authentication server. Having a central facility to authenticate all members of the network (clients to servers, servers to servers, users to both clients and servers) is one effective way to address the threat of network nodes falsifying their identities.
Centralized authentication also provides the benefit of single sign-on (SSO) for users. Single sign-on enables users to access multiple accounts and applications with a single password. A user only needs to login once and can then automatically connect to any other service without having to giving user name and password again. Single sign-on eliminates the need for the user to remember and administer multiple passwords, reducing the time spent logging into multiple services.
Figure 15-2 shows how a centralized network authentication service typically operates.
The following steps describe how centralized Network Authentication Process works.
A user (client) requests authentication services and provides identifying information, such as a token or password.
The authentication server validates the user's identity and passes a ticket or credentials back to the client, which may include an expiration time.
The client passes these credentials to the Oracle server concurrent with a service request, such as connection to a database.
The server sends the credentials back to the authentication server for authentication.
The authentication server checks the credentials and notifies the Oracle server.
If the credentials were accepted by the authentication server, then the Oracle server authenticates the user. If the authentication server rejected the credentials, then authentication fails, and the service request is denied.
Oracle Database support for Kerberos provides the benefits of single sign-on and centralized authentication of Oracle users. Kerberos is a trusted third-party authentication system that relies on shared secrets. It presumes that the third party is secure, and provides single sign-on capabilities, centralized password storage, database link authentication, and enhanced PC security. It does this through a Kerberos authentication server. Refer to Chapter 17, "Configuring Kerberos Authentication" for information about configuring and using this adapter.
Note:Oracle authentication for Kerberos provides database link authentication (also called proxy authentication). Kerberos is also an authentication method that is supported with Enterprise User Security.
RADIUS is a client/server security protocol that is most widely known for enabling remote authentication and access. Oracle Database uses this standard in a client/server network environment to enable use of any authentication method that supports the RADIUS protocol. RADIUS can be used with a variety of authentication mechanisms, including token cards and smart cards.
See Also:Chapter 19, "Configuring RADIUS Authentication" for information about configuring and using RADIUS
Token Cards. Token cards (Secure ID or RADIUS-compliant) can improve ease of use through several different mechanisms. Some token cards dynamically display one-time passwords that are synchronized with an authentication service. The server can verify the password provided by the token card at any given time by contacting the authentication service. Other token cards have a keypad and operate on a challenge-response basis. In this case, the server offers a challenge (a number) that the user enters into a token card. The token card provides a response (another number cryptographically derived from the challenge) that the user enters and sends to the server.
You can use SecurID tokens through the RADIUS adapter.
You can use the Oracle Database SSL can be used to secure communications between any client and any server. You can configure SSL to provide authentication for the server only, the client only, or both client and server. You can also configure SSL features in combination with other authentication methods supported by Oracle Database (database user names and passwords, RADIUS, and Kerberos).
To support your PKI implementation, Oracle Database includes the following features in addition to SSL:
Oracle wallets, where you can store PKI credentials
Oracle Wallet Manager, which you can use to manage your Oracle wallets
Certificate validation with certificate revocation lists (CRLs)
Hardware security module support
Chapter 18, "Configuring Secure Sockets Layer Authentication"for conceptual, configuration, and usage information about SSL, certificate validation, and hardware security modules
Oracle Database Enterprise User Security Administrator's Guide for information about using Oracle Wallet Manager to manage Oracle wallets
Chapter 20, "Customizing the Use of Strong Authentication" for information about configuring SSL in combination with other authentication methods
The Oracle Database network encryption and strong authentication architecture complements an Oracle database server or client installations. Figure 15-3 shows the this architecture within an Oracle networking environment.
Oracle Database supports authentication through adapters that are similar to the existing Oracle protocol adapters. As shown in Figure 15-4, authentication adapters integrate the Oracle Net interface, and allow existing applications to take advantage of new authentication systems transparently, without any changes to the application.
See Also:Oracle Database Net Services Administrator's Guide for more information about stack communications in an Oracle networking environment
Table 15-1 lists system requirements for strong authentication.
|Authentication Method||System Requirements|
Oracle applications support Oracle network encryption and strong authentication. However, because Oracle network encryption and strong authentication requires Oracle Net Services to transmit data securely, these external authentication features are not supported by some parts of Oracle Financial, Human Resource, and Manufacturing Applications when they are running on Microsoft Windows. The portions of these products that use Oracle Display Manager (ODM) do not take advantage of Oracle network encryption and strong authentication, because ODM does not use Oracle Net Services.