This chapter discusses the most important aspects of security in Oracle Directory Integration Platform. It contains these topics:
Authentication is the process by which the Oracle directory server establishes the true identity of the user connecting to the directory. It occurs when an LDAP session is established by means of the ldapbind operation.
It is important that each component in Oracle Directory Integration Platform be properly authenticated before it is allowed access to the directory.
This section contains these topics:
Secure Sockets Layer and Oracle Directory Integration Platform
Oracle Directory Integration Platform Authentication in SSL Mode
The Oracle back-end directory should be configured to use Secure Socket Layer (SSL).
If Oracle Unified Directory or Oracle Directory Server Enterprise Edition is your Oracle back-end directory, Oracle Directory Integration Platform will work in non-SSL mode when it is first installed. If Oracle Internet Directory is your Oracle back-end directory, however, an SSL connection is required.
Oracle Directory Integration Platform supports these SSL implementation modes:
No Authentication (SSL Mode 1)—Provides SSL data encryption, but does not use SSL for authentication.
Note:
Oracle Directory Integration Platform only supports the No Authentication SSL mode (SSL mode 1) if your Oracle back-end directory is Oracle Internet Directory. If Oracle Unified Directory or Oracle Directory Server Enterprise Edition is your Oracle back-end directory, SSL Server Authentication (SSL mode 2) is your only SSL option.SSL Server Authentication (SSL Mode 2)—Includes both SSL data encryption and SSL authentication of the server to the client. In Oracle Directory Integration Platform, the server is the directory server, and the client is the Oracle Directory Integration Platform.
The server verifies its identity to the client by sending a certificate issued by a trusted certificate authority (CA). This mode requires a public key infrastructure (PKI) and certificates to be stored in the Java Keystore (JKS).
To use SSL with Oracle Directory Integration Platform, you must start both the Oracle back-end directory and Oracle Directory Integration Platform in the same SSL mode. For example, if the Oracle back-end directory is running in SSL mode 1, then Directory Integration Platform must be configured to connect to the Oracle back-end directory using the same SSL mode 1.
See Also:
If using Oracle Internet Directory as the Oracle back-end directory, refer to the Oracle Fusion Middleware Administrator's Guide for Oracle Internet Directory for instructions about starting the Oracle directory server in SSL mode.The identity of the directory server can be established by starting both the Oracle back-end directory and the directory integration server in SSL server authentication mode. In this case, the directory server provides its certificate to the directory integration server, which acts as the client of the Oracle back-end directory.
You can also configure the Oracle Directory Integration Platform to use SSL when connecting to a third-party directory. In this case, you store the connected directory certificates in the Java Keystore (JKS) as described in "Managing the SSL Certificates of Back-End Directories and Connected Directories".
Within the Oracle back-end directory, an integration profile represents a user with its own distinguished name (DN) and password.
The users who can access the profiles are:
The administrator of Oracle Directory Integration Platform.
In back-end directory the administrator is represented by the DN cn=dipadmin,cn=dipadmins,cn=directory integration platform,cn=products,cn=oraclecontext.
Members of the Oracle Directory Integration Platform administrator group.
In back-end directory the administrator group is represented by the DN cn=odisgroup,cn=dipadmins,cn=directory integration platform,cn=products,cn=oraclecontext.
When the Oracle Directory Integration Platform imports data to the Oracle back-end directory based on an integration profile, it proxy-binds to the directory as that integration profile. The Oracle Directory Integration Platform can bind in either SSL or non-SSL mode.
Authorization is the process of ensuring that a user reads or updates only the information for which he or she has privileges. When directory operations are attempted within a directory session, the directory server ensures that the user— identified by the authorization identifier associated with the session—has the requisite permissions to perform those operations. If the user does not have the necessary permissions, then the directory server disallows the operation. Through this mechanism, called access control, the directory server protects directory data from unauthorized operations by directory users.
If the Oracle Unified Directory is used as the back-end directory, then some privileges are assigned to the Oracle Directory Integration Platform user. For more information, see "Understanding Root Users and the Privilege Subsystem" in the Oracle Fusion Middleware Administrator's Guide for Oracle Unified Directory.
If the Oracle Internet Directory is used as the back-end directory, then to restrict access to only the desired subset of Oracle Internet Directory data, for both the directory integration server and a connector, place appropriate access policies in the directory.
The following section discusses these policies:
The Oracle Directory Integration Platform binds to the directory both as itself and on behalf of the profile, as follows:
When it binds as itself, it can cache the information in various integration profiles. This enables the directory integration server to schedule synchronization actions to be carried out by various connectors.
When contacting Oracle Unified Directory, the directory integration server operates on behalf of a profile, it acts as proxy for the profile—that is, it uses the profile credentials to bind to the directory and perform various operations. The directory integration server can perform only those operations in the directory that are permitted in the profile.
When contacting Oracle Unified Directory or Oracle Directory Server Enterprise Edition, the directory integration server binds using the Oracle Directory Integration Platform user and then uses the proxy authorization v2 control (RFC 4370) to perform the actions against the directory server acting as the profile.
To establish and manage access rights granted to directory integration servers, Oracle Directory Integration Platform creates a group entry, called odisgroup, during installation. When a directory integration server is registered, it becomes a member of this group.
In back-end directory the DN of odisgroup is:
cn=odisgroup,cn=directory admins,cn=directory integration platform,cn=products,cn=oraclecontext
You control the access rights granted to directory integration servers by placing access control policies for the odisgroup entry. The default policy grants various rights to directory integration servers for accessing the profiles. For example, the default policy enables the directory integration server to compare user passwords between the Oracle back-end directory and the connected directory it binds as a proxy on behalf of a profile. It also enables directory integration servers to modify status information in the profile—such as the last successful execution time and the synchronization status.
During installation, Oracle Directory Integration Platform creates a group entry called odipgroup that enables you to control the access rights granted to various profiles. For additional security, the odipigroup and odipegroup groups are also created during installation. All import profiles are assigned to the odipigroup group and all export profiles are assigned to the odipegroup group. Rights are controlled by placing appropriate access policies for the odipgroup entry. The default access policy, automatically installed with the product, grants to profiles certain standard access rights for the integration profiles they own. One such right is the ability to modify status information in the integration profile, such as the parameter named orclodipConDirLastAppliedChgTime. The default access policy also permits profiles to access back-end directory change logs, to which access is otherwise restricted.
See Also:
The chapter "Controlling Access To Data" in the Oracle Fusion Middleware Administrator's Guide for Oracle Unified Directory.
The chapter "Managing Directory Access Control" in the Oracle Fusion Middleware Administrator's Guide for Oracle Internet Directory.
The chapter "Directory Server Access Control" in the Oracle Fusion Middleware Administrator's Guide for Oracle Directory Server Enterprise Edition.
Oracle Directory Integration Platform ensures that data is not modified, deleted, or replayed during transmission by using SSL. This SSL feature generates a cryptographically secure message digest—through cryptographic checksums using either the Message-Digest algorithm 5 (MD5) or the Secure Hash Algorithm (SHA) —and includes the message digest with each packet sent across the network.
Oracle Directory Integration Platform ensures that data is not disclosed during transmission by using public-key encryption available with SSL. In public-key encryption, the sender of a message encrypts the message with the public key of the recipient. Upon delivery, the recipient decrypts the message using the recipient's private key.
To exchange data securely between the directory integration server and Oracle Internet Directory, you must run both components in the same SSL mode.
You can run all the commonly used tools in SSL mode to transmit data to the back-end directory securely, including Oracle Enterprise Manager Fusion Middleware Control.
Oracle Directory Integration Platform uses the Credential Store Framework of the Oracle Fusion Middleware 11g infrastructure. The following is a list and description of the credentials Oracle Directory Integration Platform stores in this Credential Store Framework:
The Oracle Directory Integration Platform user name:
cn=odisrv,cn=Registered Instances,cn=Directory Integration Platform,cn=products,cn=oraclecontext
The Oracle Directory Integration Platform user password. The password is created during installation, stored as read-only, and read by run-time operations.
The JKS password. The JKS password is used if the Server Only (mode 2) SSL setting is configured for connecting to the Oracle back-end directory or a third-party directory. You can use the WebLogic Scripting Tool (WLST) createCred() command to write the keystore password to the Credential Store Framework. For example: after invoking the WLST shell and connecting to the Oracle WebLogic Admin Server using the connect() command, enter:
createCred(map="dip", key="jksKey", user="jksUser", password="welcome1", desc="DIP SSL JKS")
| Argument | Description |
|---|---|
|
|
Specifies the map name (folder) of the credential. The map option is fixed and the only supported value is |
|
|
Specifies the key name of the credential. The key option is fixed and the only supported values is |
|
|
Specifies the credential user name. The |
|
|
Specifies the credential password. The |
|
|
Specifies a string describing the credential. |
You can change the keystore password to a new value, by running the updateCred() command:
updateCred(map="dip", key="jksKey", user="jksUser", password="welcome2"
See Also:
The Oracle Fusion Middleware Security Guide for complete information about the Credential Store Framework of the Oracle Application Server 11g infrastructure.
The Oracle Fusion Middleware WebLogic Scripting Tool Command Reference for more information about the WLST commands.