2. Active Directory and Windows Security Integration with Oracle Database
Alex Keh
Principal Product Manager, Windows and .NET
Oracle

3. <Insert Picture Here>
Agenda
<Insert Picture Here>
Database Registration and Name Resolution
Single Sign-On
Windows Native Authentication
Kerberos
Security for Web Applications on Windows
Enterprise User Security and Virtual Directory

4. Database Registration and Name Resolution Overview
Store and resolve Net names through Active Directory
Eliminate tnsnames.ora on clients
Centralize configuration, reduce administration
Authenticated connection to Active Directory (11g)
Enhanced tools support for storing Net naming
AD Users and Computers
Oracle DB Configuration Assistant, Net Configuration Assistant and Net Manager

5. Database Registration and Name Resolution Active Directory support
Client OS
Server OS AD
OID
Comments
Windows
Yes
Any
Tools for registering Net Service in AD must be run on Windows
Linux/Unix No
AD Integration solutions can be used

6. Database Registration and Name Resolution Configuration/Administration
1 – Ensure Admin can modify Schema in AD
2 – Register Schema with NetCA
Windows
Admin
DB Names and Connect Descriptors
Repository
3 - Create Naming Context using NetCA
4 - Register DB in AD using DBCA or Net Manager
Active
Directory
Client
Systems
5 - Configure Directory Naming and AD Usage with NetCA

7. Database Registration and Name Resolution Run-time
DB Names and Connect Descriptors Repository
1 – User signs on to Desktop
2 – User issues
Connect Request
3 - Retrieves Connect Descriptor
AD/KDC
Oracle DB
4 - Connect to DB using Connect Descriptor
(Any Platform)

8. Database Registration and Name Resolution Demo Environment
Machine Name: xpclient.adnet.dev User: oracle Database Server: orcl
Machine Name: w2k3s.adnet.dev Domain: adnet.dev
Windows Server EE SP1
(Domain Controller)
Windows XP SP2
Tools installed on Windows XP
Support Tools (under Support directory on CD) -- ADSI  Edit is part of it
Admin Tools (under i386 directory on CD) -- AD users & computers, etc (These are available on Windows 2003 media,)

9. Database Registration and Name Resolution
D E M O N S T R A T I O N
Database Registration and Name Resolution

10. Database Registration and Name Resolution Summary
Ensure that Administrator can modify Schema in Active Directory
Register Schema using NetCA (one time for the entire AD forest)
Create Naming Context using NetCA (once per domain or the entire forest depending on where you create it)
Register Database in AD using DBCA or Net Manager
Configure Directory Naming and Directory Usage (AD) using NetCA (on systems that want to use AD) on clients
Set NAMES.LDAP_AUTHENTICATE_BIND=Yes in SQLNET.ORA on all 11g client systems
To support pre-11g clients
Enable anonymous bind in AD
Change ACLs for Oracle Naming Context and Database/Net Services objects to allow anonymous access
Please refer to the white paper Configuring Microsoft Active Directory for Net Naming for detailed information

11. <Insert Picture Here>
Agenda
<Insert Picture Here>
Database Registration and Name Resolution
Single Sign-On
Windows Native Authentication
Kerberos
Security for Web Applications on Windows
Enterprise User Security and Virtual Directory
Q&A

12. Single Sign-On Client OS Server OS Comments Authentication
Windows Native Authentication
Windows
Included and configured in all editions
MS KDC is used implicitly
Uses External Users mechanism
Direct support of Windows group membership for role authorization
Enterprise User Security not supported
Kerberos
Any
EE and ASO option needed
MS KDC is supported
Uses External Users mechanism (by default)
Enterprise User Security supported
EUS and AD integration solutions needed to support authorization through Windows group membership

13. Windows Native Authentication
Enabled by default and can work across systems
Very easy to configure and use
Windows user logon credentials used for database authentication
Authentication protocol (Kerberos or NTLM) negotiated based on OS and Domain Controller
Oracle Administration Assistant can be used to manage user authentication and role authorization
Independent of Database Registration and Name Resolution feature

14. Windows Native Authentication Use of Windows Groups
ORA_DBA: all members get SYSDBA privileges
ORA_OPER: all members get SYSOPER privileges
For any other Windows user, an external user needs to be created in Oracle DB
create user “Sales\frank” identified externally;
Windows groups can be used to assign roles (if os_roles is true)
create role sales identified externally;
Corresponding Windows group for a database with SID orcl: ORA_orcl_sales_d if this should be a default role
(If Oracle Administration Assistant is used, it makes appropriate changes in AD and Database)

15. Windows Native Authentication
1 - User signs on to desktop
AD/KDC
3 – Negotiate security protocol and exchange security tokens
5 – Find Windows Group memberships (if os_roles is true)
2 - User attempts
to sign on to Oracle
Oracle DB
6 – Assign roles based on DB roles or group memberships (based on os_roles)
4 - Identify as specific External User

16. Windows Native Authentication Configuration
Set os_authent_prefix to “” in init.ora
Ensure that sqlnet.authentication_services is set to NTS in sqlnet.ora (default set up)
Set os_roles to true in init.ora if you want to use Windows Group Membership for role authorization

17. Windows Native Authentication
D E M O N S T R A T I O N
Windows Native Authentication

18. Kerberos Authentication
Integrated with Microsoft Key Distribution Center (MSKDC)
Supports heterogeneous systems
A Windows client can connect to a non-Windows server and vice versa
Uses External User mechanisms in Database
Can also be supported with Enterprise User Security
EE and ASO (Advanced Security Option) feature

19. Kerberos Enhancements
Constrained Delegation support for better support of Windows middle tier applications
Connected User dblink support over Kerberos
IPv6 Support
Stronger encryption algorithms (AES)
Support default encryption type supported by MS KDC
Use DNS Domain Name as Kerberos REALM name by default
Kerberos authentication to Oracle database in a MS cross-domain setup
Removal of 30 character limit on the Kerberos user name
Constrained Delegation support
Support Windows Server constrained delegation feature
Middle tier applications can use Kerberos adapter and authenticate to Oracle DB on behalf of the Windows user (uses MS Credentials Cache)

20. Kerberos Authentication Windows Client Configuration
Create Kerberos and sqlnet configuration files using Oracle Net Manager
Set sqlnet.kerberos5_cc_name to “OSMSFT:” in sqlnet.ora so that the credential is retrieved from Microsoft Credential Cache

21. Kerberos Authentication Server configuration (non-Windows)
Create Kerberos and sqlnet configuration files on the server using Oracle Net Manager
Create user in Active Directory for Database Server
On the Domain Controller, use ktpass utility (available from Microsoft) to
Create Database Service Principal in AD
Map the Principal to AD user
Create keytab file
Copy keytab file to DB server node
Set os_authent_prefix to “” in init.ora

22. Kerberos Authentication
User signs on to desktop
AD/KDC
User attempts
to sign on to Oracle
Oracle DB
Identify as specific External User and assign DB roles accordingly
Example:
SQL> CREATE USER KRBUSER IDENTIFIED EXTERNALLY AS
SQL> Grant connect, resource to KRBUSER;

23. <Insert Picture Here>
Agenda
<Insert Picture Here>
Database Registration and Name Resolution
Single Sign-On
Windows Native Authentication
Kerberos
Security for Web Applications on Windows
Enterprise User Security and Virtual Directory

24. Web Applications on Windows
Service Test Monitoring
Web Applications on Windows
AD/KDC
User Communities
Web Apps On
Windows
(IIS)
Oracle DB
Web User Authentication
Web Application to DB Authentication

25. Web User Authentication Solutions
Oracle Identity Management solutions
Integrated with Active Directory
Supports heterogeneous environments
Check
ASP.NET Membership and Role Provider for Oracle
Validate and manage user and authorization information for your ASP.NET web applications in Oracle Database
Deployment time option
Oracle Database can be on any platform
These are Oracle provided solutions which can be used in addition to the solutions provided by Microsoft

26. Web Application to Database Authentication
Windows native authentication
Run Web Applications as specific Windows users or use IIS mechanisms for mapping Web users to Windows users
Use OS authenticated connection pool (ODP.NET supports it)
Database must be on Windows
Kerberos authentication can be used when Database is on a non-Windows platform
User ID/Password
If you must use it, use Secure External Password Store (in Oracle Wallet) to store the password securely
Database can be on any platform
Evaluate other security solutions: Oracle Advanced Security
Recommend the use of Application Context/Client ID for end-to-end auditing and security

27. <Insert Picture Here>
Agenda
<Insert Picture Here>
Database Registration and Name Resolution
Single Sign-On
Windows Native Authentication
Kerberos
Security Integration for Web Applications on Windows
Enterprise User Security and Virtual Directory

28. Identity Management Options
Enterprise User Security (EUS)
User Management 4 Databases (UM4DB)

29. Enterprise User Security
Centralize user accounts and roles into enterprise directory
Requires Oracle Virtual Directory or Oracle Internet Directory

30. What is Oracle Virtual Directory
Service that aggregates identity data without consolidation reducing the time it takes to deploy LDAP, Web Service and Database applications

31. EUS – OVD Architecture

32. User Management for Databases (UM4DB)
Provides centralized life-cycle management for databases
From hire to exit
Provides self-service
Audit/Compliance reports
Restricted License of OIM and OVD/OID

33. UM4DB UM4DB New or Existing User Approval Self Request Oracle
Policy Engine
Oracle
Databases
Administrator
Identity
Repository
Access
Policies
Workflow
Connector
Rules
Engine
SQL Server, Sybase
DB2 Databases
Approval
Role mining allows mapping of access privileges to roles based on business context, current policies practices and such analysis. So, when a new employee joins the company, based on her role and the organization context, she is assigned a role and accordingly access to various systems via the user provisioning system. The user provisioning tool’s user interface also allows an organization to ‘on board’ customers, vendors or other users via an intuitive self-services, non-HRMS based interface. In both cases, the role mgmt tool defines approvers per the user role or application that allows the integrated provisioning system to route approval requests accordingly. The provisioning workflow enforces provisioning policies & processes while maintaining an audit trail.
Helpdesk 33

34. Value: Automated Compliance Reporting
Main Point: OIM comes with a comprehensive set of OOB reports and additionally uses Oracle BI Publisher to allow you to generate custom reports
Oracle Identity Manager brings a comprehensive set of OOB reports both current and historic states including user resource access history, user account activity, who has or had access to what – assigned by whom, approved by whom, when, etc. 34

35. EUS and OVD Summary
EUS centralizes database account management into a directory
EUS works across heterogeneous operating systems
OVD enables EUS to work with 3rd party directories without synchronization

36. Session Summary
Most comprehensive solutions for integration with Active Directory and Windows Security
Support client/server and web applications
Support homogeneous and heterogeneous environments
Oracle solutions extend Microsoft offerings

37. For More Information Windows Server System Center
Oracle Net Services
Oracle Database Security
Oracle Virtual Directory (OVD)
Oracle Identity & Access Management
For questions,

38. The preceding is intended to outline our general product direction
The preceding is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle.

39. 39