4
Using Oracle9i Directory Server Features with Active Directory

This chapter describes the use of Oracle9i Directory Server Features with Active Directory.

This chapter contains these topics:

• LDAP and Active Directory Overview

• Oracle9i Directory Server Features

• Integration with Active Directory

• Requirements for Using Oracle9i with Active Directory

• Oracle9i Installation and Configuration with Active Directory

• Testing Connectivity

• Access Control List Management for Oracle Directory Objects

• Creating Enterprise Domains

LDAP and Active Directory Overview

This section provides an overview of the following topics:

• LDAP and a Directory Server

• Oracle Internet Directory

• Active Directory

LDAP and a Directory Server

The Lightweight Directory Access Protocol (LDAP) is a standard, extensible directory access protocol that enables directory clients and servers to interact using a common language. LDAP is a lightweight implementation of the X.500 Directory Access Protocol (DAP). LDAP runs directly over TCP/IP.

Oracle Internet Directory

Oracle Internet Directory provides data management tools, such as Oracle Directory Manager and command line tools, for manipulating large amounts of LDAP data. Oracle Internet Directory implements three levels of user authentication, namely, anonymous, password-based, and certificate-based using Secure Socket Layer (SSL) for authenticated access and data privacy.

Active Directory

Active Directory is the LDAP-compliant directory server included with Windows 2000. Active Directory stores all Windows 2000 information, including users, groups, and policies. Active Directory also stores information about network resources such as databases, and makes this information available to application users and network administrators. Active Directory enables users to access network resources with a single login. The scope of Active Directory can range from storing all the resources of a small computer network to storing all the resources of several wide areas networks (WANs). When using Oracle features that support Active Directory using LDAP, ensure that the Active Directory computer can be successfully reached using all of the TCP/IP hostname forms possible to reach the domain controller. For example, if the hostname of the domain controller is server1 in the domain acme.com, then you can ping that computer using:

server1.acme.com acme.com and server1

Active Directory often issues referrals back to itself in one or more of these forms, depending upon the operation being performed. If all of the forms cannot be used to reach the Active Directory computer, then some LDAP operations may fail.

Oracle9i Directory Server Features

Two features are provided which make use of a directory server. These features are briefly described in the following sections:

• Directory Naming

• Enterprise User Security

Both features have been enabled to work with Microsoft's Active Directory.

Directory Naming

This feature enables clients to connect to the database server making use of information stored centrally in an LDAP-compliant directory server such as Active Directory. For example, net service names previously stored in the tnsnames.ora file can now be stored in Active Directory.

Note: Database service and net service name entries stored in an Oracle Names Server can be migrated to a directory server using the Oracle Names Server Control utility. See Oracle9i Net Services Administrator's Guide for more information.

Enterprise User Security

This feature enables you to create and store Oracle9i database information as directory objects in an LDAP-compliant directory server. An administrator can create and store enterprise users and roles for the Oracle9i database in the directory, which helps centralize the administration of users and roles across multiple databases.

This chapter frequently references enterprise user security terms and concepts. Read the following documentation in Table 4-1 for descriptions of terms and concepts that an administrator and client user must understand before using an Oracle9i database with Active Directory. You must license Oracle Advanced Security to use Active Directory to manage enterprise roles.

Table 4-1 Descriptions of Terms and Concepts

See...	Which Describes...
"Managing Enterprise User Security" in Oracle Advanced Security Administrator's Guide	Enterprise user security and management Descriptions of enterprise users, roles, domains, and concepts Location for enterprise user security entries in a directory server Installing and configuring enterprise user security
"Using Oracle Enterprise Security Manager" in Oracle Advanced Security Administrator's Guide	Creating and managing enterprise users, roles, and domains

Note: Oracle Enterprise Security Manager cannot create or delete Windows 2000, Windows NT, Windows 95, or Windows 98 operating system usernames. Instead, Oracle Enterprise Security Manager creates a contact name in Active Directory. You cannot log in with a contact name; it is just defined for external purposes. You can then assign roles to this "user."

Note: Enterprise domains are directory constructs consisting of Oracle9i databases and enterprise users and roles. Enterprise domains are different from Windows 2000 domains, which are a collection of computers that share a common directory database.

Integration with Active Directory

In addition to Oracle Net directory naming and enterprise user security integration with a directory server, the following features have been specifically integrated into Active Directory:

• Automatic Discovery of Directory Servers

• Integration with Microsoft Tools

• User Interface Extensions for Oracle Net Directory Naming

• Enhancement of Directory Object Type Descriptions

• Integration with Windows Login Credentials

• Oracle Directory Objects in Active Directory

Automatic Discovery of Directory Servers

Oracle Net Configuration Assistant enables you to configure client computer and Oracle9i database server access to a directory server. When Oracle Net Configuration Assistant starts at the end of Oracle9i database installation or is manually started after installation, it prompts you to specify a directory server type to use. When you select Active Directory as the directory server type, Oracle Net Configuration Assistant automatically:

• Discovers the Active Directory server location

• Configures access to the Active Directory server

• Creates the Oracle context (also known as your domain)

If the Active Directory server through which client connections are accessing an Oracle9i database is shut down, another Active Directory server is automatically discovered and begins providing connection information; this prevents any downtime for client connections.

Note: You must be running the Oracle client and database software in a Windows 2000 domain to take advantage of the automatic directory server discovery features of Oracle Net Configuration Assistant. This is regardless of the Oracle client and database releases you are using.

If you are not running in a Windows 2000 domain, Oracle Net Configuration Assistant does not automatically discover your directory server, and instead prompts you for additional information, such as the Active Directory location.

When using the Oracle Net Configuration Assistant to complete directory usage configuration against Active Directory, Oracle schema creation can fail due to Active Directory display not being populated with all 24 default languages. Before running the Oracle Net Configuration Assistant to complete directory access configuration, verify that display specifiers for all 24 languages are populated by entering the following at the command prompt:

ldifde -p OneLevel -d cn=DisplaySpecifiers,cn=Configuration,domain
context -f temp file

where:

domain context is the domain context for this Active Directory server. For example dc=acme,dc=com

temp file is a file where you want to put the output.

If the command reports that less than 24 entries were found, you can still use the Oracle Net Configuration Assistant. However, it will report that Oracle schema creation failed when all that failed was that display specifiers for some languages were not created.

Integration with Microsoft Tools

Oracle9i database services, net service names, and enterprise role entries in Active Directory display in the Microsoft Windows 2000 tools in Table 4-2:

Table 4-2 Displaying Services in Active Directory

Tool	Description	This Enables You To...
Windows Explorer	A user tool that displays the hierarchical structure of files, directories, and local and network drives on your computer.	Display and test Oracle9i database service and net service name objects
Active Directory Users and Computers	An administrative tool installed on Windows servers configured as domain controllers. This tool enables you to add, modify, delete, and organize Windows 2000 accounts and groups, and publish resources in your organization's directory.	Display and test Oracle9i database service and net service name objects and manage access control

See Also: "Testing Connectivity from Microsoft Tools" "Access Control List Management for Oracle Directory Objects"

User Interface Extensions for Oracle Net Directory Naming

The property menus of Oracle9i database service and net service name objects in Windows Explorer and Active Directory Users and Computers have been enhanced. This enables you to test for object connectivity to the Oracle9i database and perform database administration. When you right-click these Oracle directory objects, a menu presents you with two options for testing connectivity shown in Table 4-3:

Table 4-3 Connectivity Testing Options

Menu Option	Description
Test	Starts an application that tests that the username, password, and net service name you initially entered can connect to the Oracle9i database.
Connect with SQL*Plus	Starts SQL*Plus, which enables you to perform database administration, run scripts, and so on.

See Also: "Testing Connectivity from Microsoft Tools" for more information

Enhancement of Directory Object Type Descriptions

Oracle directory object type descriptions in Active Directory have been enhanced to make them easier to understand. For example, in Figure 4-1 is the description for OracleDefaultDomain's type in the Type column of the right window pane.

Figure 4-1 Directory Object Type Descriptions in Active Directory

Text description of the illustration addescri.gif

Integration with Windows Login Credentials

This feature enables the Oracle client and database to use the credentials of the currently logged on Windows user for authentication and authorization.

The Oracle9i database and configuration tools can use the currently logged on Windows user's login credentials to automatically connect to Active Directory without having to re-enter their login credentials. This enables:

• Oracle9i clients and databases to securely connect to Active Directory and retrieve net service name, enterprise user, and enterprise role information

• Configuration tools such as Oracle Enterprise Security Manager, Oracle Net Configuration Assistant, and Oracle Database Configuration Assistant to connect automatically to Active Directory and configure the Oracle9i database and net service name objects

Oracle Directory Objects in Active Directory

Figure 4-2 shows when the Oracle9i database and Oracle Net Services are installed and configured to access Active Directory, Oracle directory objects appear in Active Directory Users and Computers:

Figure 4-2 Oracle Directory Objects in Active Directory Users and Computers

Text description of the illustration ch54.gif

Table 4-4 describes these Oracle directory objects:

Table 4-4 Oracle Directory Objects

Object	Description
domain	The domain (also known as the administrative context) in which you created your Oracle Context. The administrative context contains various Oracle entries to support directory naming and enterprise user security. Oracle Net Configuration Assistant automatically discovers this information during Oracle9i database integration with Active Directory.
Oracle Context	The top-level Oracle entry in the Active Directory tree that can contain Oracle9i database service and net service name object information. All Oracle software information is placed in this folder.
orcl	The Oracle9i database service name (for this example, orcl is the name).
Products	A folder for Oracle product information.
OracleDBSecurity	A folder for database security information.
OracleDefaultDomain	The default enterprise domain created. You can create additional enterprise domains with Oracle Enterprise Security Manager.
sales	The net service name object (for this example, sales is the name).
Users	The folder for the three Oracle security groups. See section "Access Control List Management for Oracle Directory Objects" for more information. Enterprise users and roles created with Oracle Enterprise Security Manager also appear in this folder.

Requirements for Using Oracle9i with Active Directory

Table 4-5 lists the requirements that you must complete depend upon the Oracle features you want to use:

Table 4-5 Requirements for Using Active Directory

	Required For...
Requirement	Net Directory Naming?	Enterprise User Security?
"Oracle Schema Creation Requirements"	Yes	Yes
"Oracle Context Creation Requirements"	Yes	Yes
"Directory Naming Requirements"	Yes	No
"Enterprise User Security Requirements"	No	Yes

Note: The Oracle schema and Oracle Context can both be created by running Oracle Net Configuration Assistant.

Note: You must be running your Oracle clients and database server in a Windows 2000 domain. This is regardless of the Oracle client and Oracle database server releases you are running.

If you are using Active Directory with Oracle on Windows 2000 or Windows NT, then ping the DNS domain name of your Windows 2000 domain. If this does not work, perform either of the following tasks:

• Set your Windows 2000 primary domain controller's IP address as your DNS.

  For example, if your Windows 2000 domain is sales, the DNS domain name for this domain is sales.acme.com. The IP address is of the form 001.002.003.0.

• Add the DNS domain name of your Windows 2000 domain and your domain controller's IP address to your hosts or lmhosts file.

  On the Windows 2000 computer, either 001.002.003.0 can be set as the DNS, or 001.002.003.0 sales.acme.com can be added to the hosts or lmhosts file.

If this step is not performed, then errors such as the following are returned when using Active Directory:

Cannot Chase Referrals

On Windows NT and Windows 2000, the Oracle database service runs in the security context of the LocalSystem or a specific local or domain user. When using Oracle8i release 8.1.7 with Active Directory, if the database service runs in the security context of LocalSystem, manually add the computer name in which the database service is running. This enables you to access control entries on the OracleDBSecurity container object in the Active Directory with read permissions on the OracleDBSecurity container object. For example, if the database service OracleServiceORCL is running in the security context of LocalSystem in the computer mypc1, then add mypc1 with READ permissions ON OracleDBSecurity object to the access control entries on the OracleDBSecurity container object.

Oracle Schema Creation Requirements

Complete the following Oracle schema creation requirements to use the net directory naming and enterprise user security features with Active Directory. A schema is a set of rules for Oracle Net Services and Oracle9i database entries and their attributes stored in Active Directory.

• You can create only one Oracle schema for each forest.

• Perform schema creation on a Windows 2000 domain controller.

• The Windows 2000 domain controller must be the operations master that allows schema updates. See your Microsoft Windows operating system documentation for instructions.

• Log in as a member of the Schema Administrator group to create the schema. Domain administrators by default are in the Schema Administrator group.

• Use Oracle Net Configuration Assistant to create the Oracle schema. You can create your schema during or after installation. The schema can be created by running Oracle Net Configuration Assistant on the Oracle9i database.

  See Also: Oracle9i Net Services Administrator's Guide for configuration procedures and Oracle9i Database installation guide for Windows for a configuration overview

Oracle Context Creation Requirements

You must complete the following Oracle Context creation requirements to use the net directory naming and enterprise user security features with Active Directory. The Oracle Context is the top-level Oracle entry in the Active Directory tree that contains Oracle9i database service and Oracle Net service name object information.

• You can create only one Oracle Context for each Windows 2000 domain (administrative context).

• You must have the right to create domain objects in order to create the Oracle Context in Active Directory with Oracle Net Configuration Assistant. If you are a domain administrator, you automatically have these rights.

• Use Oracle Net Configuration Assistant to create your Oracle Context. You can create the Oracle Context during Oracle9i Database Custom install or after installation.

  See Also: See Oracle9i Database installation guide for Windows for installation procedures and Oracle9i Net Services Administrator's Guide for configuration procedures

Directory Naming Requirements

Ensure that you first satisfy the requirements described in:

• "Oracle Schema Creation Requirements"

• "Oracle Context Creation Requirements"

Table 4-6 describes the minimum Microsoft and Oracle software releases that must be installed to use directory naming with Active Directory:

Table 4-6 Minimal Directory Naming Requirements

For...	Required Microsoft Software	Required Oracle Software
Client Computers from which to manage the Oracle9i enterprise users, roles and domains	Windows 2000 Windows NT 4.0 with Active Directory Service Interfaces (ADSI) Windows 95 or 98 with the Distributed Systems Client upgrade Must be in the Windows 2000 domain	Oracle8i Client release 8.1.6 or later
Database Server	Windows NT 4.0 with ADSI The computer running the database server should be in the Windows 2000 domain	Oracle8i database release 8.1.6 or later is required for registering the database service as an object in Active Directory.
	Windows 2000

Enterprise User Security Requirements

Ensure that you first satisfy the requirements described in:

• "Oracle Schema Creation Requirements"

• "Oracle Context Creation Requirements"

Table 4-7 describes the Microsoft and Oracle software releases required to use enterprise user security with Active Directory:

Table 4-7 Enterprise User Security Software Requirements

For...	Microsoft Software
Database Server	Windows NT 4.0 with ADSI The computer running the database server should be in the Windows 2000 domain	Oracle8i database release 8.1.6 or later is required for registering the database service as an object in Active Directory.
	Windows 2000
Remote computer	The host computer has to be in the Windows 2000 domain Windows NT 4.0 with ADSI or Windows 2000	Oracle Enterprise Manager Console release 2.1, which includes: Oracle Enterprise Security Manager Oracle Net Services Note: Oracle Enterprise Security Manager is required if you want to create and manage enterprise users, roles, and domains. If Oracle Enterprise Security Manager uses Native Authentication to connect to Active Directory, the host computer should be in a Windows 2000 domain and the user should be logged into the host computer as a Windows 2000 domain user.

Oracle9i Installation and Configuration with Active Directory

This section provides an overview of installation and configuration information. This section contains these topics:

• Installation Tasks

• Post-Installation Configuration Tasks

Installation Tasks

See the Oracle9i Database installation guide for Windows for Oracle9i installation instructions.

Post-Installation Configuration Tasks

You must set the OSAUTH_X509_NAME registry parameter to true to use enterprise user security in the Oracle Windows Native Authentication Adapter. See "Task 2: Set the OSAUTH_X509_NAME Registry Parameter".

Testing Connectivity

This section describes how to connect to an Oracle9i database through Active Directory. This section contains these topics:

• Testing Connectivity from Client Computers

• Testing Connectivity from Microsoft Tools

Testing Connectivity from Client Computers

When using Oracle Net directory naming client computers connect to a database by specifying the database or net service name entry that appears in the Oracle Context. For example, if the database entry under the Oracle Context in Active Directory was orcl, a user connects through SQL*Plus to the Oracle9i database as shown in Table 4-8:

Table 4-8 Connectivity from Client Computers

If the Client and Oracle9i database are in...	The Client Specifies The Following...
The same domain	SQL> CONNECT scott/tiger@orcl
Different domains	SQL> CONNECT scott/[e-mail] where domain is the domain in which the Oracle9i database is located.

The connect strings in this table follow DNS-style conventions. While Active Directory also supports connections using X.500 naming conventions, DNS-style conventions are the recommended method because of ease of use. DNS-style conventions enable client users to access an Oracle9i database through a directory server by entering minimal connection information; this is the case even when the client computer and Oracle9i database are in separate domains. X.500 names are longer; this is especially the case when the client and Oracle9i database are located in different domains (also known as administrative contexts).

To learn more about X.500 naming conventions, see "Configuration Management Concepts", of Oracle9i Net Services Administrator's Guide for information.

Testing Connectivity from Microsoft Tools

Oracle directory objects in Active Directory are integrated with Microsoft tools such as:

• Windows Explorer

• Active Directory Users and Computers

You can perform the following tasks from within these Microsoft tools:

• Connect with SQL*Plus to an Oracle9i database

• Test Oracle9i database connectivity

  Note: All clients accessing an Oracle9i database through Active Directory require read access on all net service name objects in the Oracle Context and must be able to authenticate anonymously with Active Directory. Oracle Net Configuration Assistant automatically sets this up.

Accessing Connectivity Tools

To access connectivity tools:

1. Start the Microsoft tool with which you want to connect:

   With...	Choose...
   Windows Explorer	Start > Programs > Accessories > Windows Explorer Expand My Network Places. Expand Entire Network. Expand Directory.
   Active Directory Users and Computers	Start > Programs > Administrative Tools > Active Directory Users and Computers.

2. Expand the domain in which your Oracle Context is located.

3. Go to your Oracle Context.

4. Right-click a database service or Oracle Net Service name object.

   A menu appears with several options:

   
   
   Text description of the illustration adtest.gif
5. Make an appropriate selection:

   If You Want To...	Then...
   Test connectivity	Choose Test. Go to section "Testing Connectivity"
   Connect with SQL*Plus	Choose Connect with SQL*Plus. Go to section "Connecting With SQL*Plus"

Testing Connectivity

A status message appears describing the status of your connection attempt:

Text description of the illustration adtestco.gif

Connecting With SQL*Plus

The Oracle SQL*Plus Login dialog box appears:

Text description of the illustration adsqlplu.gif

Enter your username and password. A status message appears describing the status of your connection attempt.

Access Control List Management for Oracle Directory Objects

Access Control Lists provide Active Directory security by specifying:

• The user that can access the object attributes in the object

• Authentication method to access the entry

• Access rights, or what the user can do with the object (read/write) attributes in the object

Three security groups shown in Table 4-9 are automatically created when the Oracle Context is created in Active Directory. The user configuring access (and thus creating the Oracle Context) is automatically added to each:

Table 4-9 Oracle Context Security Groups

Group	Description
OracleDBSecurityAdmin	Group for the creator of the Oracle Context. Users in this group can also: Manage the group membership for all three security groups Manage any object in the Oracle Context Use Oracle Enterprise Security Manager to create enterprise domains
OracleDBCreator	Group for the creator of the Oracle9i database. Users in this group can: This group creates new Oracle9i database objects in the Oracle Context Modify the Oracle9i database objects that they create Read, but not modify, the membership for this group The domain administrator is automatically a member of this group.
OracleNetAdmins	Users in this group can: Create, modify, and read Oracle Net Services objects and attributes Read the group membership of this group

Accessing the Security Groups

Active Directory Users and Computers enables you to add or remove users or change permission settings in the three security groups. See Table 4-10.

Table 4-10 Tools Available for Adding or Removing Users

If You Want to...	Use...
Add or remove users in OracleNetAdmins	Active Directory Users and Computers
Add or remove users in OracleDBSecurityAdmin or OracleDBCreator	Oracle Enterprise Security Manager or Active Directory Users and Computers

This section describes how to use Active Directory Users and Computers. See Oracle Advanced Security Administrator's Guide for instructions on using Oracle Enterprise Security Manager.

Note: Use Active Directory Users and Computers to perform the procedures described in this section. Windows Explorer does not provide the functionality.

To add or remove users or change permission settings:

1. Choose Start > Programs > Administrative Tools > Active Directory Users and Computers.

2. Choose Advanced Features from the View main menu.

   This enables you to view and edit information that is normally hidden.

3. Expand the domain (administrative context) in which your Oracle Context is located.

4. Expand Users.

   The three security groups appear in the right window pane:

   
   
   Text description of the illustration adsecgro.gif
5. Right-click the Oracle security group that you want to view or modify.

   A menu appears with several options.

6. Choose Properties.

7. Make an appropriate selection:

   If You Want To...	Then...
   Add or remove users	Choose the Members tab. Go to section "Adding or Removing Users".
   Change permissions	Choose the Security tab. Go to section "Changing User Permissions".

Adding or Removing Users

To add or remove users:

1. Complete the access procedures in "Accessing the Security Groups".

   The Properties dialog box for the group you selected appears (in this example, OracleDBSecurityAdmins):

   
   
   Text description of the illustration admember.gif
2. Make an appropriate selection:

   To...	Then...
   Add Users	Choose Add. The Select Users, Contacts, Computers, or Groups dialog box appears. Select appropriate users or groups, and choose Add. Your selections appear in the Select Users, Contacts, Computers, or Groups dialog box. Choose OK.
   Remove Users	Select a user to remove. Choose Remove. The user is removed. Choose OK.

Changing User Permissions

To change user permissions:

1. Complete the access procedures in "Accessing the Security Groups".

   The Properties dialog box for the group you selected appears.

2. Choose Advanced.

3. Choose View/Edit.

   The Permission Entry dialog box for the security group you selected appears:

   
   
   Text description of the illustration ch56.gif
4. View or make appropriate changes to group permissions.

5. Choose OK.

Creating Enterprise Domains

A default enterprise domain, OracleDefaultDomain, is created in your Oracle Context. If you do not want to use this domain or want to create another domain, use Oracle Enterprise Security Manager to create additional enterprise domains. These domains are added under the OracleDBSecurity folder.