Configuring Single Sign-On (SSO) for Oracle Database Security Central Console Users

You can configure SSO for Oracle Database Security Central console users.

About SSO for Oracle Database Security Central Console Users

The Audit Vault Server can integrate with an identity provider (IdP) through SAML 2.0 integration, and the IdP can provide single sign-on (SSO) and multifactor authentication (MFA) support. Audit Vault Server doesn’t store the SSO user credentials except for the SSO user name.

You can configure SSO for all types of Oracle Database Security Central console users, including normal administrators and auditors, readonly auditors, and super administrators and super auditors.

To manage SSO configurations, you need to log in to the Oracle Database Security Central console as a super administrator that is configured as a local DBSecCentral user. You can’t create or change SSO configurations in an SSO session.

As always, you cannot drop the last super administrator and super auditor configured as local DBSecCentral user.

Note: If you’ve deployed DBSecCentral using RAC, these settings are inaccessible though the UI. See Configure SSO for instructions on how to configure SSO using AVCLI commands. {. :infoboxnote}

Adding SSO Configurations

To configure single sign-on (SSO), add your identity provider (IdP) information to the Audit Vault Server.

Note: You can add multiple SSO configurations, but only one configuration can be enabled at any time.

1. Log in to the Oracle Database Security Central console as a super administrator that’s configured as a local user.

2. Select Settings.

3. Select Single Sign-On (SSO).

4. Enter the following information:

   Field	Description
   Identity Provider Name	A name to identify the IdP in the Audit Vault Server.
   Provider Type	Identity provider type, such as the following: Microsoft Active Directory Federation Service Microsoft Entra ID (MS-EI) Oracle Access Manager (OAM) Note: You can't change the provider type after you add an SSO configuration to the Audit Vault Server. To change the provider type, add a new SSO configuration with the new provider type.
   Identity Provider Domain	Domain name for the IdP. For example: login.example.com
   Protocol	The protocol is always SAML 2.0.
   SSO Sign-in URL	URL that you use to sign in to the IdP. For example: https://login.example.com/177306dd-a070-419a-b50f-6f71fc63b993/saml2
   SSO Sign-out URL	URL that you use to sign out of the IdP. For some providers, this might be the same as the sign-in URL. For example: https://login.example.com/177306dd-a070-419a-b50f-6f71fc63b993/saml2
   Identity Provider Issuer	URI for the IdP. For example: https://sts.example.net/177306dd-a070-419a-b50f-6f71fc63b993
   Identity Provider Signing Certificate	Certificate from the IdP in base-64 format. Either copy and paste the certificate or choose the file and upload it here.

5. Select Save.

6. If using Microsoft Azure Active Directory, you will need to include https://<AVDF_IP>/ords/apex_authentication.saml_callback in the Identifier (Entity ID), Reply URL (Assertion Consumer Service URL), and Logout URL fields when configuring Microsoft Azure Active Directory.

7. To begin using the SSO configuration, you need to enable it. See Enabling SSO Configurations.

Copying the Audit Vault Server SSO Certificate to the Identity Provider

Some identity providers require the Audit Vault Server single sign-on (SSO) certificate and you might need to copy the SSO certificate from the Audit Vault Server.

1. Log in to the Oracle Database Security Central console as a super administrator that’s configured as a local user.

2. Select Settings.

3. Select Single Sign-On (SSO).

4. Select Copy Certificate.

   The SSO certificate is copied to the clipboard.

Enabling SSO Configurations

To begin using a single sign-on (SSO) configuration, you need to enable it in the Audit Vault Server.

Note: You can add multiple SSO configurations, but only one configuration can be enabled at any time.

Prerequisites

• Add the SSO configuration if it’s not already defined in the Audit Vault Server. See Adding SSO Configurations.

• If another SSO configuration is already enabled, you need to disable it in the Audit Vault Server before enabling another SSO configuration. See Disabling an SSO Configuration.

Procedure

1. Log in to the Oracle Database Security Central console as a super administrator that’s configured as a local user.

2. Select Settings.

3. Select Single Sign-On (SSO).

4. Select the SSO configuration that you want to enable.

5. Select Enable.

Configuring ORDS After Enabling Oracle Access Manager as the SSO Identity Provider

After enabling Oracle Access Manager (OAM) as the SSO identity provider, you will need to configure Oracle Rest Data Services (ORDS).

Prerequisites

• Enable the SSO configuration. See Enabling SSO Configurations.

• Take note of:

  • The fully qualified host name (FQHN) of the Audit Vault Server

  • The FQHN of the OAM server

  • The FQHN of the LDAP server

Procedure

1. Log in to the Audit Vault Server through SSH and switch to the root user.

   See Logging In to Oracle DBSecCentral Appliances Through SSH.

2. Switch to the oracle user.

   su - oracle

3. Set the JAVA_PATH variable:

   export JAVA_PATH=/usr/java/jdk-11/bin

4. Set the PATH variable:

   export PATH=$JAVA_PATH:/var/lib/oracle/ords/bin:$PATH

5. Set the following configuration:

   ords --config /var/lib/oracle/ords_conf config set --global security.forceHTTPS true

6. Set the following configuration through either of the following:

   • Ensure that you input the appropriate FQHN’s where necessary.

     ords --config /var/lib/oracle/ords_conf config set --global security.externalSessionTrustedOrigins "https://<FQHN of AV server>:443, http://<FQHN of OAM server>:<port>, https://<FQHN LDAP server configured on OAM server>:<port>, null"

   • You can alternatively use the following since the parameters in the above are optional:

     ords --config /var/lib/oracle/ords_conf config set --global security.externalSessionTrustedOrigins "null"

7. Exit back to root.

8. Restart ORDS:

   systemctl restart ords

9. Test the connection by creating a new OAM user and logging into the Oracle Database Security Central console as that OAM user.

   See Creating New SSO Users and Logging In to the Oracle Database Security Central console as an SSO User for more information.

10. If configured in high availability, repeat the above steps on the standby Audit Vault Server.

Creating New SSO Users

To create new users for single sign-on (SSO) authentication, follow these steps.

Prerequisite

Ensure the SSO is enabled for users on the identity provider.

Procedure

1. Log in to the Oracle Database Security Central console as a super administrator.

2. Select Settings.

3. On the Manage Admins, select Add.

4. In the dialog box, select SAML SSO.

5. Enter the SSO user name.

   Allowed characters include uppercase and lowercase letters, numbers, and symbols (@.-_!^~+%). The total length of the SSO user name can’t exceed 127 characters.

   Note: Though Oracle Database Security Central accepts uppercase and lowercase letters, it will store the user name in only uppercase. The identity providers perform a case in-sensitive comparison of the user names.

6. Select the admin type, Admin or Super Admin.

7. Select Save.

Logging In to the Oracle Database Security Central Console as an SSO User

When you log in to the Oracle Database Security Central console as a single sign-on (SSO) user, you’re redirected to the enabled identity provider (IdP) SSO login page.

1. On the Oracle Database Security Central console login page, select Single Sign-On.

2. Select Login.

3. Enter your SSO user name and password on the SSO login page.

Note: Log out and close your browser at the end of the session. Otherwise, your browser will still be logged in as your SSO user and will allow access to the Audit Vault Server.

Modifying SSO Users

You can change the admin type for an existing single sign-on (SSO) user.

1. Log in to the Oracle Database Security Central console as a super administrator.

2. Select Settings.

3. On the Manage Admins, select user that you want to modify.

4. Select Change icon next to the Type field.

5. Select a new admin type.

6. Select Save.

Disabling an SSO Configuration

You might need to disable a single sign-on (SSO) configuration if you want to modify, delete, or switch to another SSO configuration.

1. Log in to the Oracle Database Security Central console as a super administrator that’s configured as a local user.

2. Select Settings.

3. Select Single Sign-On (SSO).

4. Select the SSO configuration that you want to disable.

5. Select Disable.

   You should see the following message:

   Do you want to continue to disable this identity provider?

6. Select OK to disable the configuration.

Configuring ORDS After Disabling Oracle Access Manager as the SSO Identity Provider

After disabling Oracle Access Manager (OAM) as the SSO identity provider, you will also need to configure Oracle Rest Data Services (ORDS).

Prerequisites

• Disable the SSO configuration. See Disabling an SSO Configuration.

Procedure

1. Log in to the Audit Vault Server through SSH and switch to the root user.

   See Logging In to Oracle DBSecCentral Appliances Through SSH.

2. Switch to the oracle user.

   su - oracle

3. Set the JAVA_PATH variable:

   export JAVA_PATH=/usr/java/jdk-11/bin

4. Set the PATH variable:

   export PATH=$JAVA_PATH:/var/lib/oracle/ords/bin:$PATH

5. Run the following command:

   ords --config /var/lib/oracle/ords_conf config delete --global security.forceHTTPS true

6. Run the following command:

   ords --config /var/lib/oracle/ords_conf config delete --global security.externalSessionTrustedOrigins true

7. Exit back to root.

8. Restart ORDS:

   systemctl restart ords

9. If configured in high availability, optionally repeat the above steps on the standby Audit Vault Server.

Modifying an SSO Configuration

You can modify a single sign-on (SSO) configuration if it’s disabled in the Audit Vault Server.

Note: You can’t change the provider type after you add an SSO configuration to the Audit Vault Server. To change the provider type, add a new SSO configuration with the new provider type.

Prerequisite

Disable the SSO configuration if it’s currently enabled in the Audit Vault Server. See Disabling an SSO Configuration.

Procedure

1. Log in to the Oracle Database Security Central console as a super administrator that’s configured as a local user.

2. Select Settings.

3. Select Single Sign-On (SSO).

4. Update any of the following information:

   Field	Description
   Identity Provider Name	A name to identify the IdP in the Audit Vault Server.
   Provider Type	Identity provider type, such as the following: Microsoft Active Directory Federation Service Microsoft Entra ID (MS-EI) Oracle Access Manager (OAM) Note: You can't change the provider type after you add an SSO configuration to the Audit Vault Server. To change the provider type, add a new SSO configuration with the new provider type.
   Identity Provider Domain	Domain name for the IdP. For example: login.example.com
   Protocol	The protocol is always SAML 2.0.
   SSO Sign-in URL	URL that you use to sign in to the IdP. For example: https://login.example.com/177306dd-a070-419a-b50f-6f71fc63b993/saml2
   SSO Sign-out URL	URL that you use to sign out of the IdP. For some providers, this might be the same as the sign-in URL. For example: https://login.example.com/177306dd-a070-419a-b50f-6f71fc63b993/saml2
   Identity Provider Issuer	URI for the IdP. For example: https://sts.example.net/177306dd-a070-419a-b50f-6f71fc63b993
   Identity Provider Signing Certificate	Certificate from the IdP in base-64 format. Either copy and paste the certificate or choose the file and upload it here.

5. Select Save.

Deleting an SSO Configuration

You can delete a single sign-on (SSO) configuration if it’s disabled in the Audit Vault Server.

Prerequisite

Disable the SSO configuration if it’s currently enabled in the Audit Vault Server. See Disabling an SSO Configuration.

Procedure

1. 1. Log in to the Oracle Database Security Central console as a super administrator that’s configured as a local user.

2. Select Settings.

3. Select Single Sign-On (SSO).

4. Select the SSO configuration that you want to delete.

5. Select Delete.

   After deleting the SSO configuration, existing sessions will receive the following message when logging out:

   Invalid value for parameter: SAML_SIGN_IN_URL