Integrating Oracle Database Security Central with Microsoft Active Directory or OpenLDAP

You can use Microsoft Active Directory or OpenLDAP to control access to Oracle Database Security Central.

About Microsoft Active Directory or OpenLDAP Integration

You can integrate a Microsoft Active Directory or OpenLDAP server to authenticate users who connect to the Oracle Database Security Central console.

When users log in to the Oracle DBSecCentral console, they’re prompted to select a group from a list of groups. Users are authorized from the group to which they belong and select. After a user is authenticated, access is granted based on the Microsoft Active Directory or OpenLDAP groups to which the user belongs and selects.

A super user can assign the roles to the groups on Oracle Database Security Central. For example, super administrator, super auditor, administrator, or auditor. Oracle Database Security Central supports Microsoft Active Directory and OpenLDAP.

Note:

• While other LDAP servers may work, they are not tested or certified with Oracle Database Security Central.

• Oracle DBSecCentral does not support the default local accounts of Microsoft Active Directory (for example administrator). Refer to Microsoft documentation for complete information on default local accounts in Active Directory.

• Microsoft Active Directory and OpenLDAP users and groups must belong to the domain specified in the topic Configuring an LDAP Server.

Configuring an LDAP Server

You can configure an LDAP server to authenticate users by using Microsoft Active Directory or OpenLDAP.

Note: If you’ve deployed DBSecCentral using RAC, these settings are inaccessible though the UI. See Configure LDAP for instructions on how to configure LDAP using AVCLI commands. {. :infoboxnote}

Prerequisite: The LDAP user must have access to the Microsoft Active Directory or OpenLDAP groups that are being provisioned for access to Oracle DBSecCentral.

1. Get the SSL/TLS certificate to connect to Microsoft Active Directory or OpenLDAP. This can be sourced from Microsoft Active Directory or OpenLDAP administrator. Using the command certutil -ca.cert client.crt is a common way to generate Active Directory client SSL/TLS certificate.

2. Copy the SSL/TLS certificate in Base64 encoding format.

3. Launch the Oracle DBSecCentral console.

4. Log in to the console as a super administrator.

5. Select Settings.

6. Select Active Directory/LDAP Configuration in the main page.

7. Select Add .

8. Enter the Microsoft Active Directory or OpenLDAP server details. In the Active Directory/LDAP Configuration dialog, select either Active Directory (AD) or LDAP radio .

9. Provide a new Name for the LDAP server.

10. Enter the AD/LDAP Host Name / IP Address.

11. Enter the Port number for the SSL/TLS connection.

12. Enter the Active Directory/LDAP Username and Password.

    The user must be able to retrieve all groups from the AD/LDAP server.

13. Enter the Domain Name. For example, subdomain.example.com.

14. Provide the AD/LDAP Server Certificate (SSL/TLS) in Base64 encoding format that was sourced earlier in the initial step.

15. Enter a new password as the Wallet Password for Storing Certificate. This wallet stores the SSL/TLS certificate you provided for LDAP SSL/TLS connection earlier.

16. Enter the password again in Re-enter Wallet Password field.

17. Select Test Connection to verify the details. Fix any errors encountered and proceed to the next step.

18. Select Save.

Note: Select Delete to delete the Microsoft Active Directory or OpenLDAP configuration. A dialog appears and prompts for your confirmation.

Creating New Users

Create new users for Microsoft Active Directory or OpenLDAP authentication.

1. Log in to the Oracle DBSecCentral console as a super administrator or super auditor.

2. Select Settings.

   The Manage Admins or Manage Auditors on the main page is selected by default.

3. Select Add in the top, right corner.

4. In the Add Admin (or Add Auditor) dialog box, select Active Directory/LDAP Group.

5. For Active Directory/LDAP Group, select the Import Mode.

   OpenLDAP or Active Directory users and groups have to exist in the LDAP server before you can create the admin or auditor on the Audit Vault Server for the same.

6. If you have selected import mode as Fetch, then provide an LDAP User Name and Password. Alternatively, you can register an Microsoft Active Directory or OpenLDAP group in Oracle Database Security Central that corresponds to an existing group by providing the distinguished name. The LDAP user needs the correct access privileges to view all the groups that exist on the LDAP server.

   Note: The user credentials are not stored. Therefore, each time that you choose the Fetch option, you must enter the credentials.

7. In the Group Name Like field, enter a keyword to search in order to fetch details from a group that has a similar name. Select Fetch at the bottom of the dialog. For example, enter admin keyword to fetch AD or OpenLDAP groups containing admin string in the group name.

   Note: A user can be added to a group. A group can have administrator or auditor privileges, but not both. For example, a group with the name AdminAndAuditor can have administrator privileges assigned. However, the same group cannot have auditor privileges. In case there is an attempt to add both the privileges, then it fails. The user SpecialUser can be part of both, the Admin group and the Auditor group. This user SpecialUser may choose to connect with Admin group as administrator, or with Auditor group as auditor.

8. Select the Domain.

9. Select Fetch at the bottom of the dialog. The values in the Group and User Type fields are populated.

10. Select the right Group from the drop down menu.

11. Select the User Type from the drop-down menu, such as, Admin, Super Admin, Auditor, or Super Auditor.

12. If you have selected the import mode as Manual, then enter the Group Name as distinguished name.

13. Select Save.

Logging In as an OpenLDAP or Microsoft Active Directory User

After OpenLDAP or Microsoft Active Directory is configured, users can log in to the Oracle Database Security Central console.

1. Open the Oracle Database Security Central console.

2. Select Active Directory/LDAP Group.

3. For database users, enter the user name and password. For Microsoft Active Directory users, enter the user name (sAMAccountName) and password. Select the domain name from the drop-down list.

   Note:

   • The domain name is appended to the user name. This may cause issues if a user has been created with a domain in the user name. For example, if you attempt to login as user [e-mail] and select the domain company.example.com, then the Audit Vault Server will attempt to look for the user [e-mail]@company.example.com.

   • You must add the user to the Microsoft Active Directory or OpenLDAP group and register the group with the Audit Vault Server. See Creating New Users.

4. On the following page, select a Group from the drop-down list.

5. Select Save to log in and complete the authorization.

Note: Microsoft Active Directory and OpenLDAP users can connect to the Audit Vault Server only through the Oracle Database Security Central console. They cannot connect to the Audit Vault Server through AVCLI or SQL*Plus.