13
Administering Enterpri se User Security

You can set and maintain enterprise user passwords in the Basic Info rmation region of the Enterprise Security Manager Console Edit User window (Figure 13-2).

Figure 13-2 Enterprise Security Manager Consol e Edit User Window: Basic Information

Text description of the illustration edituser.gif

The enterprise user password is used for:

• Directory logon
• Database logon, to databases that support p assword authentication for global users

T o set the password for an enterprise user:

1. Navigate to the Enterprise Security Manager Console home page. (Choose Launch Enterprise Security Manager C onsole from the Operations menu and log in using your OracleAS Single Sign-On username and password.)
2. Choose the Users and Groups tab.
3. In the Users and Groups tabbed window, choose the User subtab, if it is not already displayed.
4. In the User subtab window, enter part of the enterprise user's username (login name) or e-mail address, and click Go.

   A list of all users that match your search cri teria displays.

5. Select the user for whom you wish to create a new p assword, and click Edit.
6. In the Edit User window, enter the new password, and click Submit.

Defining an Initial Enterprise Role Assignment

When you create a new enterprise user, you can grant any previously configur ed enterprise roles to the new user.

See Also: "Administering Enterprise Roles"< a href="asoadmeu.htm#1008211">

To assign existing enterprise roles to a new enterprise user:

1. In the left navigator pane, choose the Users icon under the Users, By Search Base folder, which d isplay under the identity management realm you are using. The list of users displays in the right main window.
2. Select a user in the main window, and click Edit.... An Edit Us er window displays.
3. Choose the Enterprise Roles tab of the Edit User wi ndow, and click Add....

   The Add Enterprise Roles window a ppears (Figure 13-3):

Figure 13-3 Enterprise Security Manager: Add Enterprise Roles Window

Text description of the illustration esm0009.gif

4. Select the correct identity management realm, then select any enterprise roles in your realm to assign to the new user, and ch oose OK.

Browsing Users in the Directory

Enterprise Security Manager lets you browse the directory for all users currently stored there in two ways--by using Enterprise Secur ity Manager Console, or by using the All Users tab in the main application window.

To browse enterprise users in the directory by using Enterprise Security Manager Console:< /h5>

1. Navigate to the Enterprise Security Manager C onsole home page. (Choose Launch Enterprise Security Manager Console from the Operations menu and log i n by using your OracleAS Single Sign-On username and password.)
2. Choose the Users and Groups tab.
3. In the Users and Groups tabbed window, choose the User subtab, if it is not already displayed.
4. In the User subtab wi ndow, enter part of the enterprise user's username (login name) or e-mail address, and click Go. To dis play all users, do not enter search criteria.

   A list of all users that match your searc h criteria displays. You can browse through the displayed users and select one to Edit, Delete, or Assign Privileges. If you need to create a new user, click Create.

To browse enterpr ise users in the directory by using the All Users tab in the main application window:

1. Select the directory in the left navigator pane.
2. Choose the All Users tab in the right main window (Figure 13-4):

Figure 13-4 Enterprise Security Manager: Main Window (All Users Tab)

Text description of the illustration esm0011.gif

3. Define the search criteria and click Search Now. The window d isplays the results of the search. Table 13-3 summarizes the search criteria and their respec tive effects on the search results.

   Table 13-3 Directory Search Criteria

   < td class="Formal">

   This determines whether to show all users found in th e entire subtree under the selected base, or to only show only those users that exist directly under that base location (one level on ly).

   Search Criteria	Effect on the Search
   Base	This is th e base entry point in the directory where the search is performed. Only users under this base are returned by the search.
   Include Subtrees
   Show names containing	This limits the search to those users whose directory entries have a common name that starts with the characters you specify. This is useful if you do not know the e xact name or base of the target users.

Note that you ca n also browse enterprise users in the directory by selecting realm_name > User, by Search Base > Users in the left navigation pane of the main application window.

Administering Enterprise Domains

An identity management realm contains an enterprise domain called OracleDef aultDomain. The OracleDefaultDomain is part of the realm when it is first created in the directory. When a new da tabase is registered into a realm, it automatically becomes a member of the OracleDefaultDomain in that realm. You can c reate and remove your own enterprise domains but you must not remove the OracleDefaultDomain from a realm.

This section describes how to use Enterprise Security Manager to administer enterprise domains in the di rectory. It contains the following topics:

• Creating a New Enterprise Domain
• Defining Database Membership of an Enterprise Domain
• Managing Database Security Options for an Enterprise Domain
• Managing Enterprise Domain Administrators
• Managing Enterprise Domain Database Schema Mappings
• Managing Password Accessible Domains
• Managing Database Administrators

Creating a New Enterprise Domain

If you do not want to use the OracleDefaultDomain, then you can create a new enterprise do main in your identity management realm.

To crea te a new enterprise domain in an identity management realm:

1. Start by using one of the following methods:
   • Select Create Enterprise Domain from the Operations menu.
   • Select a realm from the main application tree with a right mouse-click.

   The Create Enterprise Domain window appears (Figure 13-5):

Text description of the illustration esm0023.gif

2. In the Create Enterprise Domain window, select the appropriate R ealm from the list (Figure 13-5).

   Note: If you invoked the Create Ent erprise Domain window by right-clicking the realm in the main application tree, the name of that realm is already selected. < /td>

3. Enter the name of the new enterprise domain, in the Domain Name field.
4. Choose OK. The new enterprise domain is created in the realm, and appears on the main application tree.

To remove an enterprise domain:

1. Select t he target enterprise domain from the main application tree.
2. Use either of the following methods:
   • Select Remove Ente rprise Domain from the Operations menu.
   • Select an enterprise domain f rom the main application tree with a right mouse-click.
3. Enter prise Security Manager asks you to confirm removal of the enterprise domain from the realm. Choose OK t o remove it.

   Note: You cannot remove an enterprise domain from an identity management realm if that enterprise domain contains any enterprise roles.

Defining Database Membership of an Enterprise Domain

Use the navigation tree of the main Enterprise Security Manager window to select a spec ific enterprise domain. You can then use the Databases tab to manage database membership of an enterprise domain in a realm (Figure 13-6):

Figure 13-6 Enterprise Security Manager: Databases Tab (Database Membership)

Text description of the illustration esm00 25.gif

To remove a d atabase from an enterprise domain:

1. Sel ect a specific database for removal, and choose Remove.... The database is removed from the list.
2. Choose Apply. The database is removed from the enterprise domain.

To add a database to an enterprise domain:

1. Choose Add.... The Add Databases window appears. T his window lists all the databases associated with the realm (Figure 13-7):

Figure 13-7 Enterprise Security Manager: Add Databases Window

Text description of the illustration esm0026.gif

2. Select a new database to be added to the enterprise domain.
3. Choose OK. The selected database is added to the list of databas es in the Databases tabbed window (Figure 13-6).
4. Choose Apply (Figure 13-6). The new database is added to the enterprise domain.

Managing Database Security Options for an Enterprise Domain

Use the Databases tabbed window (Figure 13-6) to manage database secu rity options applicable to all databases that are members of the enterprise domain.

Databas e security options are summarized by Table 13-4:

< a name="1008893"> Table 13-4 Enterprise Security Mana ger Database Security Options

Managing Enterprise Domain Administrators

An Enterprise Domain Administrator is a directory user with privileges to modify the content of that domain. You can use the Administrators tabbed window to manage Ente rprise Domain Administrators when an enterprise domain is selected under an realm in the main application tree.

To add a new user to the list of Enterprise Domain Administrators:

1. In the left navigator pane, select the enterprise domain to which you wish to add administrators.
2. In the right pane, select the Administrators tab.
3. Cho ose Add.... The Add Users window appears. Use this window to locate and select users for designation as Enterprise Domain Administrators. The new users appear in the Administrators tabbed window.
4. Choose Apply. The new Administrators are added to the enterprise domain.

To remove a user from the list of Enterprise Doma in Administrators:

1. In the left navigat or pane, select the enterprise domain from which you wish to remove administrators.
2. In the right pane, select the Administrators tab.
3. Select a user from the list of Administrators.
4. Ch oose Remove. The selected user is removed from the list.
5. Choose Apply. The user is removed as an Enterprise Domain Administrator for that domain in the realm.

Managing Enterprise Domain Database Schema Mappings

Data base schema mappings, also referred to as user schema mappings) let databases that are registered in the directory accept connections from users without requiring any dedicat ed database schemas for them. For example , when local user Scott connects to a database, a database schema called Scott must exist--for that logon to be successful. This can be difficult to maintain if there are thousands of users and perhaps hundreds of databases in a very large enterprise.

Users that are defined in an LDAP-compliant directory do not require dedicated schemas on every Oracle9i or later database to which they might connect.

A database can use a schema mapping to share one database schema between multiple directory users. The schema mapping is a pair of values: the base in th e directory at which users exist, and the name of the database schema they will use.

You ca n use the Database Schema Mappings tabbed window to manage database schema mappings--when a database is selected under a realm in the main application tree or when a domain is selected. If a domain is selected, these mappings apply to all databases that are members of the enterprise domain. Therefore, each database in the enterprise domain must have a schema of the same name used in the mapping f or that mapping to be effective on that database. This window contains a list of database schema names, directory DNs, and mapping ty pes (Figure 13-8):

Figure 13-8 Enterprise Security Manager: Database Schema Mappings Tab

Text description of the illustration esm0020.gif

To add a new mapping to the list of database schema mappings in the enterprise domain:

1. In the Database Schema Mapping tabbed window, choose Add....

   The Add Database Schema Mappings window appears (Figure& nbsp;13-9). Use this window to locate and select a base in the directory and pair it with a database schema name, to make a datab ase schema mapping. There are three components to the window: there is a directory search tree from which to select the user's DN or the base of users, the option to choose either subtree-level or entry-level mapping, and a field in which to enter a schema name.

Figure 13-9 Enterprise Security Manag er: Add Database Schema Mappings Window

Text description of the illustration esm0021.gif

2. Navigate the directory to select a desired entry a s a base for the database schema mapping. This can be any directory entry but should be either the actual user (entry-level) or locat ed above the subtree of users to be mapped (subtree-level). You can also edit the contents of the Directory Entry field in this windo w to manually define the base.
3. Choose the mapping type: Subtree Level or Entry Level. Note that subtree-level mapping is usually the most useful .
4. Enter the name of the database schema for which this Mapping will be made into the Schema field, and choose OK. This must be a valid name, for a schema that already exists on that database.The new database schema mapping appears in the database schema mappings window (Figur e 13-8).
5. Choose Apply. The new d atabase schema mapping is added to the selected database or domain in the realm.

To remove a mapping from the list of database schema mappings in an enterprise domain:

1. Select a mapping by selecting from the Datab ase Schema Mapping tabbed window.
2. Choose Remove. The selected Mapping is removed from the list.
3. Choose Apply. The mapping is removed from the enterprise domain.

There are three requirements for a database to accept a connection from a password-authe nticated user:

• The database must be a member of a domain confi gured to accept Password authentication (See: Table 13-4).
• The domain must be a member of a password-accessible domains group, called th e Password-Accessible Domains List, added by a member of either the Ora cleContextAdmins or the OracleDBSecurityAdmins directory administrator groups. Domain members (databases) of this list can read the u ser's password verifier in the directory, while those excluded from this list cannot.
• The user entry must be in a directory subtree of users that has been enabled for Oracle database access.

To configure password accessibility:

1. Select the enterprise domain in the left navigator pane.
2. Choose the Databases tabbed window and select Password< /strong> or All Types from the User Authentication methods listed. (See < a href="asoadmeu.htm#1008779">Figure 13-6)
3. Click Apply.

To add a domain to the Password-Accessible Domains List:

1. Select the identity management realm in the left navigator pane.
2. Choose the Accessible Domains tabbed window and click Add. The Add Acces sible Enterprise Domains dialog box appears. See Figure 13-10< /a>.

Figure 13-10 Enterprise Security Manager: Add Accessible Enterprise Domains Dialog Box

Text description of the illustration esmpwacc.gif

3. Select the OracleDefaultDomain from the list of enterprise domains, and click OK. The OracleDefaultDomain is added to the password-accessible domains list.

   Note: By default , the cn=Users subtree in an identity management realm has ACLs (access control lists) to enable appropriate database ac cess to user password attributes. If you do not use this subtree to store users, then see Oracle Internet Directory Administrator's Guide for information about setting up pro per ACLs for another user search base. The OracleDefaultDomain is a member of t he password-accessible domains list by default, but it can be removed.

To remove an enterprise domain from the password-accessible doma ins list:

1. Select the identity manageme nt realm in the left navigator pane.
2. Choose the Accessible Domains tabb ed window and select the enterprise domain that you want to remove from the list.
3. Click Remove.

   See Also: "Defining Database Membership of an Enterprise Domain" "Managing Database Security Options for an Enterpris e Domain"

Managing Database Administrators

A Database Administrator i s a directory user that has privileges to modify the database and its subtree in the realm. Database Administrators may be managed by using the Administrators tabbed window when a database is selected under a realm in the main application tree.

To remove a user from the list of Database Administrators:

1. In the Administrators tabbed window, select a u ser from the list of administrators.
2. Choose Remove ; the selected user is removed from the list.
3. Choose Apply; the user is removed as a Database Administrator for that database.

To add a new user to the list of Database Administrators:

1. In the Administrators tabbed window, choose Add; the Add Users window appears. Use this window to locate and select users in the directory.
2. Select a user or users from the directory to be added as a Database Administrator; the new us er(s) is displayed in the Administrators tabbed window.
3. Choose Apply; the new Administrator(s) is added to the database in the realm.

   < font face="Arial, Helvetica, sans-serif">See Also: "Creating New Enterprise Users" "Browsing Users in the Directory"

Administering Enterprise Roles

An enterprise domain within an identity m anagement realm can contain multiple enterprise roles. An enterprise role is a set of Oracle role-based authorizations across one or more databases in an enterprise domain.

This section describes how to use Enterprise Security Manager to administer enterprise roles in the directory. It contains the follow ing topics:

• Creating a New Ente rprise Role
• Assigning Database Global Role Membership to an Enterprise Role
• Granting E nterprise Roles to Users

Creating a New Enterprise Role

You can cre ate an enterprise role in an enterprise domain either from the Operations menu on the Enterprise Security Manager main window (Figure 13-8), or by right-clicking an enterprise domain in the main application tree. In either cas e, the Create Enterprise Role window appears (Figure 13-11):

Figure 13-11 Enterprise Security Manager: Create Enterprise Role Window

Text description of the illustration esm0030.gif

To create a new enterprise role:

1. Choose the target identity management realm from the list. This is the realm containing the target en terprise domain to hold the new enterprise role.

   Note: If you invoked the Create Enterprise Role window by right-click ing an enterprise domain, the name of the identity management realm is already selected.

< a name="1012145">

2. Select the appropriate ente rprise domain for the new enterprise role, from the Enterprise Domain list.

   ---

   Note:

   If you invoked the Create Enterprise Role window by right-clicking an enterprise domain, the name of the enterprise domain is already selected.

   ---

3. Enter th e name of the new enterprise role in the Role Name field.
4. Choose OK. The new enterprise role is created in the enterprise domain, and appears on the main application tree.

To remove an enterprise role:

1. Select the target ent erprise role from the main application tree (Figure 13-8).
2. Choose Remove Enterprise Role, either from the Operations menu or by right- clicking the enterprise domain in the main application tree.
3. Enterprise Security Manager asks you to confirm the removal of the enterprise role. Choose Yes.

Assigning Database G lobal Role Membership to an Enterprise Role

Use the Database Global Roles tabbed window (Figure 13-12) of the Enterprise Security Manager main window to manage d atabase global role membership in an enterprise role. This window lists the names of each global role that belongs to the enterprise role, along with the name of the database on which that global role exi sts.

Figure 13-12 Enterprise Security Manage r: Database Global Roles Tab

Text description of the illustration esm0031.gif

When populating an enterprise role with different database roles it is only possible to reference roles on databases that are configured to be global roles on those databases. A global role on a database is identical to a normal role, except that the Database Administrator has defined i t to be authorized only through the directory. (Global roles are created with the syntax, CREATE ROLE <role_name> IDENTIF IED GLOBALLY ' ';) A Database Administrator cannot locally grant and revoke global roles to users of the database.

To add a global role to an enterprise role:

Choose Add... (Figure 13-12). The Add Global Database Roles window appears. This window lists all of the databases in the enterprise domain--from which global roles can be selected to add to an enterprise role.

Select a database from which to obtain global roles. A window appears and prompts you for logon details to a uthenticate to the database (and fetch global roles). Typically, this is a DBA logon to that database.

Note that the name of the database appears in the Service field by default. You can use this name to connect to the d atabase if your Oracle home has LDAP enabled as its Oracle Net naming method, or if this name appears as a TNS alias in your local Or acle Net configuration. Otherwise, you can overwrite the content of the Service field with any other TNS alias configured for that da tabase, or by a connect string in the format <host>:<port>:<oracle sid>. For example, cartman:15 21:broncos.

Figure 13-13 En terprise Security Manager: Database Authentication Required Window

Text description of the illustration esm0034.gif

3. Choose OK. Enterprise Security Manager connects you to the given database and fetches the list of global roles supported on th at database. The list of values, if any, is displayed in the Add Global Database Roles window.
4. Select one or more global roles from the list of returned values and choose OK. These global roles appear in the Database Global Roles tabbed window (Figure 13-12).
5. Choose Apply. The new global roles are a dded to the enterprise role in the enterprise domain.

To remove a database global role from an enterprise role:

1. Select a global role from the list in the main application tree, and choose Rem ove.... The global role is removed from the list.
2. Choose Apply. The global role is removed from the enterprise role in the enterprise domain.

Granting Enterprise Roles to Users

You can grant an enterprise role to users in two ways: you can select a user and add a role (see "Defining an Initial Enterprise Role Assignment"), or you can select a role and add a user. When you grant an enterprise role to a user, it includes all datab ase global roles contained within that enterprise role. Use the Users tabbed window.