Strong authentication supports tools such as Secure Sockets Layer (SSL) to verify the identities of users who log in to the database.
15.1 What Is Strong Authentication?
You use authentication to prove the identities of users who are attempting to log into the database.
Authenticating user identity is imperative in distributed environments, without which there can be little confidence in network security. Passwords are the most common means of authentication. Oracle Database enables strong authentication with Oracle authentication adapters that support various third-party authentication services, including SSL with digital certificates.
Figure 15-1 shows user authentication with an Oracle database instance configured to use a third-party authentication server. Having a central facility to authenticate all members of the network (clients to servers, servers to servers, users to both clients and servers) is one effective way to address the threat of network nodes falsifying their identities.
Figure 15-1 Strong Authentication with Oracle Authentication Adapters
Description of "Figure 15-1 Strong Authentication with Oracle Authentication Adapters"
15.2 Centralized Authentication and Single Sign-On
Single sign-on enables users to access multiple accounts and applications with a single password.
Centralized authentication also provides the benefit of single sign-on (SSO) for users.
In single sign-on, a user only needs to login once and can then automatically connect to any other service without having to give the user name and password again. Single sign-on eliminates the need for the user to remember and administer multiple passwords, reducing the time spent logging into multiple services.
15.3 How Centralized Network Authentication Works
A centralized network authentication system works with an Oracle server, an authentication server, and users who connect to the Oracle server.
Figure 15-2 shows how a centralized network authentication service typically operates.
Figure 15-2 How a Network Authentication Service Authenticates a User
Description of "Figure 15-2 How a Network Authentication Service Authenticates a User"
The following steps describe how centralized Network Authentication Process works.
A user (client) requests authentication services and provides identifying information, such as a token or password.
The authentication server validates the user's identity and passes a ticket or credentials back to the client, which may include an expiration time.
The client passes these credentials to the Oracle server concurrent with a service request, such as connection to a database.
The server sends the credentials back to the authentication server for authentication.
The authentication server checks the credentials and notifies the Oracle server.
If the credentials were accepted by the authentication server, then the Oracle server authenticates the user. If the authentication server rejected the credentials, then authentication fails, and the service request is denied.
15.4 Supported Strong Authentication Methods
Oracle Database supports industry-standard authentication methods.
15.4.1 About Kerberos
Oracle Database support for Kerberos provides the benefits of single sign-on and centralized authentication of Oracle users.
Kerberos is a trusted third-party authentication system that relies on shared secrets. It presumes that the third party is secure, and provides single sign-on capabilities, centralized password storage, database link authentication, and enhanced PC security. It does this through a Kerberos authentication server. Refer to Configuring Kerberos Authentication for information about configuring and using this adapter.
Oracle authentication for Kerberos provides database link authentication (also called proxy authentication). Kerberos is also an authentication method that is supported with Enterprise User Security.
15.4.2 About Remote Authentication Dial-In User Service (RADIUS)
RADIUS is a client/server security protocol that is most widely known for enabling remote authentication and access.
Oracle Database uses this standard in a client/server network environment to enable use of any authentication method that supports the RADIUS protocol. RADIUS can be used with a variety of authentication mechanisms, including token cards and smart cards.
Smart Cards. A RADIUS-compliant smart card is a credit card-like hardware device which has memory and a processor. It is read by a smart card reader located at the client workstation.
Token Cards. Token cards (Secure ID or RADIUS-compliant) can improve ease of use through several different mechanisms. Some token cards dynamically display one-time passwords that are synchronized with an authentication service. The server can verify the password provided by the token card at any given time by contacting the authentication service. Other token cards have a keypad and operate on a challenge-response basis. In this case, the server offers a challenge (a number) that the user enters into a token card. The token card provides a response (another number cryptographically derived from the challenge) that the user enters and sends to the server.
You can use SecurID tokens through the RADIUS adapter.
15.4.3 About Secure Sockets Layer
Secure Sockets Layer (SSL) is an industry standard protocol for securing network connections.
Oracle Database SSL can be used to secure communications between any client and any server. You can configure SSL to provide authentication for the server only, the client only, or both client and server. You can also configure SSL features in combination with other authentication methods supported by Oracle Database (database user names and passwords, RADIUS, and Kerberos).
To support your PKI implementation, Oracle Database includes the following features in addition to SSL:
Oracle wallets, where you can store PKI credentials
Oracle Wallet Manager, which you can use to manage your Oracle wallets
Certificate validation with certificate revocation lists (CRLs)
Hardware security module support
15.5 Oracle Database Native Network Encryption/Strong Authentication Architecture
The Oracle Database native network encryption and strong authentication architecture complements an Oracle database server or client installations.
Figure 15-3 shows the this architecture within an Oracle networking environment.
Figure 15-3 Oracle Native Network Encryption and Strong Authentication Architecture
Description of "Figure 15-3 Oracle Native Network Encryption and Strong Authentication Architecture"
Oracle Database supports authentication through adapters that are similar to the existing Oracle protocol adapters. As shown in Figure 15-4, authentication adapters integrate the Oracle Net interface, and allow existing applications to take advantage of new authentication systems transparently, without any changes to the application.
Figure 15-4 Oracle Net Services with Authentication Adapters
Description of "Figure 15-4 Oracle Net Services with Authentication Adapters"
See Also:Oracle Database Net Services Administrator's Guide for more information about stack communications in an Oracle networking environment
15.6 System Requirements for Strong Authentication
Kerberos, RADIUS, and Secure Sockets Layer (SSL) have a set of system requirements for strong authentication.
Table 15-1 lists the SSL system requirements for strong authentication.
Table 15-1 Authentication Methods and System Requirements
15.7 Oracle Database Native Network Encryption and Strong Authentication Restrictions
Oracle applications support Oracle Database native network encryption and strong authentication.
However, because Oracle Database native network encryption and strong authentication requires Oracle Net Services to transmit data securely, these external authentication features are not supported by some parts of Oracle Financial, Human Resource, and Manufacturing Applications when they are running on Microsoft Windows.
The portions of these products that use Oracle Display Manager (ODM) do not take advantage of Oracle Database native network encryption and strong authentication, because ODM does not use Oracle Net Services.