25
Managing Security in the Oracle Directory Integration Platform

This chapter discusses the most important aspects of security in the Oracle Directory Integration platform. It contains these sections:

• Authentication

• Access Control and Authorization

• Data Integrity

• Data Privacy

Authentication

Authentication is the process by which the Oracle directory server establishes the true identity of the user connecting to the directory. It occurs when an LDAP session is established by means of the ldapbind operation.

It is important that each component in the Oracle Directory Integration platform be properly authenticated before it is allowed access to the directory.

Secure Sockets Layer (SSL) and the Oracle Directory Integration Platform

You can deploy the Oracle Directory Integration platform either with or without Secure Socket Layer (SSL). SSL implementation supports these modes:

• No authentication--Provides SSL encryption of data, but does not use SSL for authentication

• SSL server authentication--Includes both SSL encryption of data and SSL authentication of the server to the client. In the Oracle Directory Integration platform, the server is the directory server, the client is the directory integration server.

  The server verifies its identity to the client by sending a certificate issued by a trusted certificate authority (CA). This mode requires a public key infrastructure (PKI) and SSL wallets to hold the certificates.

To use SSL with the Oracle Directory Integration platform, you must start both the Oracle directory server and the Oracle directory integration server in the SSL mode.

See Also: "Using the Oracle Directory Integration Server in SSL Mode" for instructions on starting the directory integration server in SSL mode Chapter 4, "Preliminary Tasks" for instructions on starting the Oracle directory server in SSL mode

Oracle Directory Integration Server Authentication

You can install and run multiple instances of the directory integration server on various hosts. When you do this, beware of a malicious user either posing as the directory integration server or using an unauthorized copy of it.

To avoid such security issues:

• Ensure that each directory integration server is identified properly

• Ensure that, when you start a directory integration server, it is properly authenticated before it obtains access to Oracle Internet Directory

Non-SSL Authentication

To use non-SSL authentication, register each directory integration server by using the registration tool called odisrvreg.

The registration tool creates:

• An identity entry in the directory. The directory integration server uses this entry when it binds to the directory

• An encrypted password. It stores this password in the directory integration server entry.

• A private wallet on the local host. This wallet contains the security credentials, including an encrypted password. The name of the wallet is odisrvwallet, and it is stored in the $ORACLE_HOME/ldap/odi/conf directory.

When it binds to the directory, the directory integration server uses the encrypted password in the private wallet.

Note: Ensure that the wallet is protected against unauthorized access.

See Also: "Registering the Oracle Directory Integration Server" for instructions about registering the directory integration server

Authentication in SSL Mode

The identity of the directory server can be established by starting both Oracle Internet Directory and the directory integration server in the SSL server authentication mode. The directory server provides its certificate to the directory integration server, which acts the client of Oracle Internet Directory.

The directory integration server is authenticated by using the same mechanism used in the non-SSL mode.

Agent Authentication

Within Oracle Internet Directory, an agent is a user with its own DN and password. This information is stored in the integration profile of the agent. To protect the profile from unauthorized access, establish appropriate access control policies for it in the directory. Only the Oracle Directory Integration platform administrator or a user designated by the Oracle Internet Directory administrator can create the integration profiles.

When the directory integration server performs a task on behalf of an agent, it binds to the directory as that agent and uses the agent name and password stored in the agent profile. The Oracle Directory Integration platform uses this mechanism to authenticate agents in both the SSL and non-SSL mode.

Access Control and Authorization

Authorization is the process of ensuring that a user reads or updates only the information for which that user has privileges. When directory operations are attempted within a directory session, the directory server ensures that the user-- identified by the authorization identifier associated with the session--has the requisite permissions to perform those operations. Otherwise, the operation is disallowed. Through this mechanism, the directory server protects directory data from unauthorized operations by directory users. This mechanism is called access control. Access control information is the directory metadata that captures the administrative policies relating to access control.

Access to data in Oracle Internet Directory is restricted for both the directory integration server as well as the agents only to the desired subset of data by placing appropriate access policies in the directory. The following section discusses these policies in detail.

Access Controls for the Oracle Directory Integration Server

The directory integration server binds to the directory both as itself and on behalf of the agent.

• When it binds as itself, it can cache the information in various integration profiles. This enables the directory integration server to schedule agents.

• When the directory integration server operates on behalf of an agent, it uses the agent credentials to bind to the directory and perform various operations. The directory integration server can perform only those operations in the directory that are permitted to the agent.

To establish and manage access rights granted to directory integration servers, the Oracle Directory Integration platform creates a group entry, called odisgroup, during installation. When a directory integration server is registered, it becomes a member of this group.

You control the access rights granted to directory integration servers by placing access control policies in the odisgroup entry. The default policy grants various rights to directory integration servers for accessing the profiles. For example, the default policy enables the directory integration server to compare user passwords for authenticating agents when it binds on their behalf. It also enables directory integration servers to modify status information in the profile--such as the next synchronization time and the synchronization status.

Access Controls for Agents

To control access to Oracle Internet Directory data by agents, place appropriate access control policies in Oracle Internet Directory. This enables you to protect data of one agent from interference by other agents. It also enables you to allow only the agent that owns an attribute to modify that attribute.

To control access, a group entry called odipgroup is created in the directory during installation. The access rights granted to various agents in the Oracle Internet Directory Platform are controlled by placing appropriate access policies in the odipgroup entry. Each agent is a member of this group. The membership is established when the agent is registered in the system. The default access policy, which is installed automatically with the product, grants various access rights to the agents for the integration profiles they own. For example, the agent can modify the status information such as orclodipConDirLastAppliedChgTime in the integration profile. The default access policy also permits agents to access Oracle Internet Directory change logs. The access to the Oracle Internet Directory change log is otherwise restricted.

The odipgroup and the odisgroup group entries and their default policies are created only during the server installation of the Oracle Internet Directory release 3.0.1 patch. Client-only installations do not create these groups and policies. For this reason, Oracle Corporation recommends that you install the 2.1.1.1 patch on the Oracle Internet Directory release 2.1.1 server. Do this even if you do not intend to use the Oracle Directory Integration platform on the Oracle Internet Directory server installation.

Data Integrity

The Oracle Directory Integration platform ensures that data has not been modified, deleted, or replayed during transmission by using SSL. This SSL feature generates a cryptographically secure message digest--through cryptographic checksums using either the MD5 algorithm or the Secure Hash Algorithm (SHA) --and includes it with each packet sent across the network.

Data Privacy

The Oracle Directory Integration platform ensures that data is not disclosed during transmission by using public-key encryption available with SSL. In public-key encryption, the sender of a message encrypts the message with the public key of the recipient. Upon delivery, the recipient decrypts the message using the recipient's private key.

To exchange data securely between the directory integration server and Oracle Internet Directory, you run both components in the SSL mode.

Tools Security

You can run all the commonly used tools in the SSL mode to transmit data to Oracle Internet Directory securely. These tools include:

• Oracle Directory Manager --Use it to administer data in the directory

• The Oracle directory integration server registration tool (odisrvreg)--Use it to register the directory integration server in the directory

• Ldapadd and ldapmodify tools--Use these to add or modify entries from the command line