4
Configuring RADIUS Authentication

This chapter describes how to configure Oracle Advanced Security for Oracle8i, or for the Oracle8i server, for use with RADIUS (Remote Authentication Dial-In User Service).

This chapter contains the following sections:

RADIUS Overview

RADIUS is a client-server security protocol widely used to enable remote authentication and access. Oracle Advanced Security uses this industry standard in a client-server network environment.

You can enable the network to use any authentication method that supports the RADIUS standard, including token cards and smart cards, by installing and configuring the RADIUS protocol. Moreover, when you use RADIUS, you can change the authentication method without modifying either the Oracle client or the Oracle database server.

From the user's perspective, the entire authentication process is transparent. When the user seeks access to an Oracle database server, the Oracle database server, acting as the RADIUS client, notifies the RADIUS server. The RADIUS server:

Looks up the user's security information.
Passes authentication and authorization information between the appropriate authentication server or servers and the Oracle database server.
Grants the user access to the Oracle database server.
Logs session information, including when, how often, and for how long the user was connected to the Oracle database server.

The Oracle/RADIUS environment is displayed in Figure 4-1:

Figure 4-1 RADIUS in an Oracle Environment

The Oracle database server acts as the RADIUS client, passing information between the Oracle client and the RADIUS server. Similarly, the RADIUS server passes information between the Oracle database server and the appropriate authentication server or servers. To ensure transmission integrity of the authentication information, RADIUS converts it to a hash value. The authentication components are listed in Table 4-1:

Table 4-1 RADIUS Authentication Components

Component Stored Information

Oracle client

Configuration setting for communicating through RADIUS.

Oracle database server/
RADIUS client

Configuration settings for passing information between the Oracle client and the RADIUS server.
The secret key file.

RADIUS server

Authentication and authorization information for all users.
Each client's name or IP address.
Each client's shared secret.
Unlimited number of menu files enabling users already authenticated to select different login options without reconnecting.

Authentication
server or servers

User authentication information such as passcodes and PINs, depending on the authentication method in use.
Note: The RADIUS server can also be the authentication server.

Component	Stored Information
Oracle client	Configuration setting for communicating through RADIUS.
Oracle database server/ RADIUS client	Configuration settings for passing information between the Oracle client and the RADIUS server. The secret key file.
RADIUS server	Authentication and authorization information for all users. Each client's name or IP address. Each client's shared secret. Unlimited number of menu files enabling users already authenticated to select different login options without reconnecting.
Authentication server or servers	User authentication information such as passcodes and PINs, depending on the authentication method in use. Note: The RADIUS server can also be the authentication server.

A RADIUS server vendor is often the authentication server vendor as well, in which case authentication can be processed on the RADIUS server. For example, the Security Dynamics ACE/Server is both a RADIUS server and an authentication server. It thus authenticates the user's passcode.

See Also:
Net8 Administrator's Guide, for information about the sqlnet.ora file

RADIUS Authentication Modes

User authentication can take place in either of two ways:

Synchronous Authentication Mode

In the synchronous mode, RADIUS lets you use various authentication methods, including passwords and SecurID token cards. Figure 4-2 shows the sequence in which synchronous authentication occurs:

Figure 4-2 Synchronous Authentication Sequence

Example: Synchronous Authentication with SecurID Token Cards

With SecurID authentication, each user has a token card that displays a dynamic number that changes every sixty seconds. To gain access to the Oracle database server/RADIUS client, the user enters a valid passcode that includes both a personal identification number (PIN) and the dynamic number currently displayed on the user's SecurID card. The Oracle database server passes this authentication information from the Oracle client to the RADIUS server, which in this case is the authentication server for validation. Once the authentication server (Security Dynamics ACE/Server) validates the user, it sends an "accept" packet to the Oracle database server, which, in turn, passes it to the Oracle client. The user is now authenticated and able to access the appropriate tables and applications.

See Also:

Chapter 1, Introduction to Oracle Advanced Security, and Chapter 7, Configuring SecurID Authentication, for more information about SecurID token cards

Documentation provided by Security Dynamics

Challenge-Response (Asynchronous) Authentication Mode

When the system uses the asynchronous mode, the user does not need to enter a user name and password at the SQL*Plus CONNECT string. Instead, a graphical user interface asks the user for this information later in the process.

Figure 4-3 shows the sequence in which challenge-response (asynchronous) authentication occurs.

Note:
If the RADIUS server is the authentication server, Steps 3, 4, and 5, and Steps 9, 10, and 11 in Figure 4-3 are combined.

Figure 4-3 Asynchronous Authentication Sequence

Example: Asynchronous Authentication with Smart Cards

With smart card authentication, the user logs in by inserting the smart card--a plastic card (like a credit card) with an embedded integrated circuit for storing information--into a hardware device which reads the card. The Oracle client sends the login information contained in the smart card to the authentication server by way of the Oracle database server/RADIUS client and the RADIUS server. The authentication server sends back a challenge to the Oracle client, by way of the RADIUS server and the Oracle database server, prompting the user for authentication information. The information could be, for example, a PIN as well as additional authentication information contained on the smart card.

The Oracle client sends the user's response to the authentication server by way of the Oracle database server and the RADIUS server. If the user has entered a valid number, the authentication server sends an "accept" packet back to the Oracle client by way of the RADIUS server and the Oracle database server. The user is now authenticated and authorized to access the appropriate tables and applications. If the user has entered incorrect information, the authentication server sends back a message rejecting the user's access.

Example: Asynchronous Authentication with ActivCard Tokens

One particular ActivCard token is a hand-held device with a keypad and which displays a dynamic password. When the user seeks access to an Oracle database server by entering a password, the information is passed to the appropriate authentication server by way of the Oracle database server/RADIUS client and the RADIUS server. The authentication server sends back a challenge to the client--by way of the RADIUS server and the Oracle database server. The user types that challenge into the token, and the token displays a number for the user to send in response.

The Oracle client then sends the user's response to the authentication server by way of the Oracle database server and the RADIUS server. If the user has typed a valid number, the authentication server sends an "accept" packet back to the Oracle client by way of the RADIUS server and the Oracle database server. The user is now authenticated and authorized to access the appropriate tables and applications. If the user has entered an incorrect response, the authentication server sends back a message rejecting the user's access.

Enabling RADIUS Authentication and Accounting

To enable RADIUS authentication and accounting, perform the following tasks:

Task 1: Install RADIUS on the Oracle Database Server and on the Oracle Client

RADIUS is installed with Oracle Advanced Security during a typical installation of Oracle8i.

See:
platform-specific installation documentation for Oracle8i, for information about installing Oracle Advanced Security and the RADIUS adapter

Task 2: Configure RADIUS Authentication

This task includes the following steps:

Unless otherwise indicated, perform these configuration tasks by using the Net8 Assistant or by using any text editor to modify the sqlnet.ora file.

Step 1: Configure RADIUS on the Oracle Client

Start Net8 Assistant as follows:
- On UNIX, run netasst from $ORACLE_HOME/bin.
- On Windows NT, choose Start > Programs > Oracle - HOME_NAME > Network Administration > Net8 Assistant.
In the Navigator window, expand Local > Profile.
From the list in the right pane, select Oracle Advanced Security; the Oracle Advanced Security tabbed window appears:
Choose the Authentication tab.
From the Available Methods list, select RADIUS.
Choose the right-arrow [>] to move RADIUS to the Selected Methods list. Move any other methods you want to use in the same way.
Arrange the selected methods in order of required usage by selecting a method in the Selected Methods list, and clicking Promote or Demote to position it in the list. For example, put RADIUS at the top of the list for it to be the first service used.
Choose File > Save Network Configuration.

The sqlnet.ora file is updated with the following entry:

SQLNET.AUTHENTICATION_SERVICES=(RADIUS)

Step 2: Configure RADIUS on the Oracle Database Server

Create the RADIUS Secret Key File on the Oracle Database Server

Obtain the RADIUS secret key from the RADIUS server. For each RADIUS client, the administrator of the RADIUS server creates a shared secret key, which can be as simple as "test123".
On the Oracle database server, create a directory $ORACLE_HOME/network/security on UNIX or ORACLE_HOME\network\security on Windows NT.
Create the file radius.key to hold the shared secret from the RADIUS server. Place the file in the directory you just created, namely, $ORACLE_HOME/network/security on UNIX or ORACLE_HOME\network\security on Windows NT.
Copy the shared secret key and paste it (and nothing else) into the radius.key file created on the Oracle database server.

See Also:
The RADIUS server administration documentation, for information about obtaining the secret key

Note:
For security reasons, Oracle Corporation recommends that you change the radius.key file to root access only (on UNIX servers).

Configure RADIUS Parameters on the Server (sqlnet.ora file)

Start Net8 Assistant:
- On UNIX, run netasst from $ORACLE_HOME/bin.
- On Windows NT, choose Start > Programs > Oracle - HOME_NAME > Network Administration > Net8 Assistant.
In the Navigator window, expand Local > Profile.
From the list in the right pane, select Oracle Advanced Security.

The Oracle Advanced Security tabbed window appears:
Choose the Authentication tab.
From the Available Methods list, select RADIUS.
Move RADIUS to the Selected Methods list by choosing the right-arrow [>].
To arrange the selected methods in order of desired use, select a method in the Selected Methods list, and choose Promote or Demote to position it in the list. For example, if you want RADIUS to be the first service used, put it at the top of the list.
Choose the Other Params tab; the Other Params window appears:
From the Authentication Service list, select RADIUS.
In the Host Name field, accept the localhost as the default primary RADIUS server, or enter another host name.
Ensure that the default value of the Secret File field is valid.
Choose File > Save Network Configuration.

The sqlnet.ora file is updated with the following entries:

SQLNET.AUTHENTICATION_SERVICES=service

SQLNET.RADIUS_AUTHENTICATION=location

where service is RADIUS and location is the host name or IP address of the RADIUS server.

Set Oracle Database Server Initialization Parameters

Configure the initialization parameter file, located in $ORACLE_BASE\admin\db_name\pfile on UNIX and ORACLE_BASE/admin/db_name/pfile on Windows NT, with the following values:

REMOTE_OS_AUTHENT=FALSE

OS_AUTHENT_PREFIX=""

Caution:
Setting REMOTE_OS_AUTHENT to TRUE can allow a security breach because it allows someone using a non-secure protocol, such as TCP, to perform an operating system-authorized login (formerly referred to as an OPS$ login).

See Also:
Oracle8i Reference and the Oracle8i Administrator's Guide, for information about setting initialization parameters on the Oracle8i database server

Step 3: Configure Additional RADIUS Features

Change Default Settings

Start Net8 Assistant as follows:
- On UNIX, run netasst from $ORACLE_HOME/bin.
- On Windows NT, choose Start > Programs > Oracle - HOME_NAME > Network Administration > Net8 Assistant.
In the Navigator window, expand Local > Profile.
From the list in the right window pane, select Oracle Advanced Security; the Oracle Advanced Security tabbed window appears:
Choose the Other Params tab.
From the Authentication Service list, select RADIUS.

Change the default setting for any of the following fields:

Field Description

Port Number

Specifies the listening port of the primary RADIUS server. The default value is 1645.

Timeout (seconds)

Specifies the time the Oracle database server waits for a response from the primary RADIUS server. The default is 15 seconds.

Number of Retries

Specifies the number of times the Oracle database server resends messages to the primary RADIUS server. The default is three retries.
For instructions on configuring RADIUS accounting, see: Task 4: Configure RADIUS Accounting .

Secret File

Specifies the location of the secret key on the Oracle database server. The field specifies the location of the secret key file, not the secret key itself.
For information about specifying the secret key, see: Create the RADIUS Secret Key File on the Oracle Database Server .

Choose File > Save Network Configuration.

The sqlnet.ora file is updated with the following entries:

SQLNET.RADIUS_AUTHENTICATION_PORT=(PORT)

SQLNET.RADIUS_AUTHENTICATION_TIMEOUT= (NUMBER OF SECONDS TO WAIT FOR response)

SQLNET.RADIUS_AUTHENTICATION_RETRIES= (NUMBER OF TIMES TO RE-SEND TO RADIUS server)

SQLNET.RADIUS_SECRET=(path/radius.key)

Field	Description
Port Number	Specifies the listening port of the primary RADIUS server. The default value is 1645.
Timeout (seconds)	Specifies the time the Oracle database server waits for a response from the primary RADIUS server. The default is 15 seconds.
Number of Retries	Specifies the number of times the Oracle database server resends messages to the primary RADIUS server. The default is three retries. For instructions on configuring RADIUS accounting, see: Task 4: Configure RADIUS Accounting .
Secret File	Specifies the location of the secret key on the Oracle database server. The field specifies the location of the secret key file, not the secret key itself. For information about specifying the secret key, see: Create the RADIUS Secret Key File on the Oracle Database Server .

Configure Challenge-Response

The challenge-response (asynchronous) mode presents the user with a graphical interface requesting first a password, then additional information--for example, a dynamic password that the user obtains from a token card. With the RADIUS adapter, this interface is Java-based to provide optimal platform independence.

Note:
Third party vendors of authentication devices must customize this graphical user interface to fit their particular device. For example, a smart card vendor would customize the Java interface so that the Oracle client reads data, such as a dynamic password, from the smart card. When the smart card receives a challenge, it responds by prompting the user for more information, such as a PIN.

See Also:
Appendix C, Integrating Authentication Devices Using RADIUS, for information about how to customize the challenge-response user interface

To configure challenge-response:

If you are using JDK 1.1.7 or JRE 1.1.7, set the JAVA_HOME environment variable to the JRE or JDK location on the system where the Oracle client is run:
- On UNIX, enter this command at the prompt:
  
  % setenv JAVA_HOME /usr/local/packages/jre1.1.7B
- On Windows NT, choose Start> Settings > Control Panel > System > Environment, and set the JAVA_HOME variable as follows:
  
  c:\java\jre1.1.7B
  
  Note:
  This step is not required for any other JDK / JRE version.
If you are using a third-party graphic user interface, you must define its location by entering parameters in each of the following configuration files:
- In sqlnet.ora:
  
  Enter SQLNET.RADIUS_CLASSPATH=(location), where location is the complete pathname of the jar file. It defaults to $oracle_home/network/jlib/netradius.jar.
- In sqlnet.radius: Enter sqlnet.radius_authentication_interface.
Use a text editor to add the SQLNET.RADIUS_CLASSPATH parameter to the sqlnet.ora file (to set the path for the Java classes for the graphical interface), as follows:

SQLNET.RADIUS_CLASSPATH=(location), where location is the complete pathname of the netradius.jar file.
Start Net8 Assistant:
- On UNIX, run netasst from $ORACLE_HOME/bin.
- On Windows NT, choose Start > Programs > Oracle - HOME_NAME > Network Administration > Net8 Assistant.
In the Navigator window, expand Local > Profile.
From the list in the right pane, select Oracle Advanced Security; the Oracle Advanced Security tabbed window appears:
Choose the Other Params tab.
From the Authentication Service list, select RADIUS.
In the Challenge Response field, enter ON to enable challenge-response.

In the Default Keyword field, accept the default value of the challenge or enter a keyword for requesting a challenge from the RADIUS server.

Note:
The keyword feature is provided by Oracle and supported by some, but not all, RADIUS servers. You can use this feature only if your RADIUS server supports it.
By setting a keyword, you let the user avoid using a password to verify identity. If the user does not enter a password, the keyword you set here is passed to the RADIUS server which responds with a challenge requesting, for example, a driver's license number or birth date. If the user does enter a password, the RADIUS server may or may not respond with a challenge, depending upon the configuration of the RADIUS server.

In the Interface Class Name field, accept the default value of DefaultRadiusInterface or enter the name of the class you have created to handle the challenge-response conversation between the Oracle client and the RADIUS server.
Choose File > Save Network Configuration.

The sqlnet.ora file updates with these entries:

SQLNET.RADIUS_CHALLENGE_RESPONSE=([ON | OFF])

SQLNET.RADIUS_CHALLENGE_KEYWORD=(KEYWORD)

SQLNET.RADIUS_AUTHENTICATION_INTERFACE=(name of interface including the package name delimited by "/" for ".")

Set Parameters for an Alternate RADIUS Server

If you are using an alternate RADIUS server, set these parameters in the sqlnet.ora file using any text editor.

SQLNET.RADIUS_ALTERNATE=(hostname or ip address of alternate radius server)

SQLNET.RADIUS_ALTERNATE_PORT=(1645)

SQLNET.RADIUS_ALTERNATE_TIMEOUT=(number of seconds to wait for response)

SQLNET.RADIUS_ALTERNATE_RETRIES=(number of times to re-send to radius server)

Task 3: Create a User and Grant Access

To grant user access:

Launch SQL*Plus and execute these commands to create and grant access to a user identified externally on the Oracle database server.

SQL> CONNECT system/manager@database_name;

SQL> CREATE USER username IDENTIFIED EXTERNALLY;

SQL> GRANT CREATE SESSION TO USER username;

SQL> EXIT

If you are using Windows NT, you can use the Security Manager tool in the Oracle Enterprise Manager.

See Also:
Oracle8i Administrator's Guide and Oracle8i Distributed Database Systems
Enter the same user in the RADIUS server's users file.

See Also:
Administration documentation for the RADIUS server

Task 4: Configure RADIUS Accounting

RADIUS accounting logs information about access to the Oracle database server and stores it in a file on the RADIUS accounting server. Use this feature only if both the RADIUS server and authentication server support it.

Set RADIUS Accounting on the Oracle Database Server

To enable or disable RADIUS accounting:

Start Net8 Assistant:
- On UNIX, run netasst from $ORACLE_HOME/bin.
- On Windows NT, choose Start > Programs > Oracle - HOME_NAME > Network Administration > Net8 Assistant.
In the Navigator window, expand Local > Profile.
From the list in the right window pane, select Oracle Advanced Security; the Oracle Advanced Security tabbed window appears:
Choose the Other Params tab.
From the Authentication Service list, select RADIUS.
In the Send Accounting field, enter ON to enable accounting or OFF to disable accounting.
Choose File > Save Network Configuration.

The sqlnet.ora file is updated with the following entry:

SQLNET.RADIUS_SEND_ACCOUNTING= ON

Configure the RADIUS Accounting Server

RADIUS Accounting consists of an accounting server residing on either the same host as the RADIUS authentication server or on a separate host.

See Also:
Administration documentation for the RADIUS server, for information about configuring RADIUS accounting

Task 5: Add the RADIUS Client Name to the RADIUS Server Database

You can use virtually any RADIUS server that complies with the standards in the Internet Engineering Task Force (IETF) RFC #2138, Remote Authentication Dial In User Service (RADIUS) and RFC #2139 RADIUS Accounting. Because RADIUS servers vary, consult the documentation for your particular RADIUS server for any unique interoperability requirements.

Perform the following steps to add the RADIUS client name to a Livingston RADIUS server:

Open the clients file, which can be found at /etc/raddb/clients. The text and table that follows appear:

@ (#) clients 1.1 2/21/96 Copyright 1991 Livingston Enterprises Inc

This file contains a list of clients which are allowed to make authentication requests and their encryption key. The first field is a valid hostname. The second field (separated by blanks or tabs) is the encryption key.

Client Name Key
In the CLIENT NAME column, enter the host name or IP address of the host on which the Oracle database server is running. In the KEY column, type the shared secret.

The value you enter in the CLIENT NAME column, whether it is the client's name or IP address, depends on the RADIUS server.
Save and close the clients file.

See Also:
Administration documentation for the RADIUS server

Task 6: Configure the Authentication Server for Use with RADIUS

See the authentication server documentation for instructions about configuring the authentication servers. Related Documents contains a list of possible resources.

Task 7: Configure the RADIUS Server for Use with the Authentication Server

See the RADIUS server documentation.

Task 8: Configure Mapping Roles

If the RADIUS server supports vendor type attributes, you can manage roles by storing them in the RADIUS server. The Oracle database server downloads the roles when there is a CONNECT request using RADIUS.

To use this feature, configure roles on both the Oracle database server and the RADIUS server.

Perform these steps to configure roles on the Oracle database server:

Use a text editor to set the OS_ROLES parameter in the initialization parameters file on the Oracle database server.
Stop and restart the Oracle database server.
Create each role the RADIUS server is to manage on the Oracle database server with IDENTIFIED EXTERNALLY.

To configure roles on the RADIUS server, use the following syntax:

ORA_DatabaseName.DatabaseDomainName_RoleName

Parameter Description

DatabaseName

The name of the Oracle database server for which the role is being created. This is the same as the value of the DB_NAME initialization parameter.

DatabaseDomainName

The name of the domain to which the Oracle database server belongs. The value is the same as the value of the DB_DOMAIN initialization parameter.

RoleName

The name of the role created in the Oracle database server.

Parameter	Description
DatabaseName	The name of the Oracle database server for which the role is being created. This is the same as the value of the DB_NAME initialization parameter.
DatabaseDomainName	The name of the domain to which the Oracle database server belongs. The value is the same as the value of the DB_DOMAIN initialization parameter.
RoleName	The name of the role created in the Oracle database server.

Example:

ORA_USERDB.US.ORACLE.COM_MANAGER

See Also:
Oracle 8i Administrator's Guide

Logging in to the Database

If you are using the synchronous authentication mode, launch SQL*Plus and enter the following command at the prompt:

CONNECT username/password@database_alias

Note that you can log in with this command only when challenge-response is not turned to ON.

If you are using the challenge-response (asynchronous) mode, launch SQL*Plus and, at the prompt, enter the command that follows:

CONNECT /@database_alias

Note that you can log in with this command only when challenge-response is turned to ON.

4 Configuring RADIUS Authentication