To enable the Oracle database server to validate the identity of clients that authenticate themselves using K erberos, you must create a service principal for Oracle Database.
< a name="1006174">The name of the principal should have the following format:
kservice/kinstance@REALM
Each of the fields in the service p rincipal specify the following values:
| Service Principal Field | Description |
|---|---|
|
kservice |
A case- sensitive string that represents the Oracle service; this can be the same as the database service name. |
|
kinstance |
This is typically the fully qualified name of the system on which Oracle Database is running. |
|
REALM |
The domain name of the database server. REALM must always be uppercase and is typically the DNS domain name. |
|
Note: The utility names in this section are executable
programs. However, the Kerberos user name |
For example, if kservice is oracle, the fully qualified name
of the system on which Oracle Database is running is dbserver.someco.com and the realm is SOMECO.COM. The
principal name is:
oracle/dbserver.someco.com@SOMECO.COM
It is a convention to use the DNS domain name as the name of the realm. To create the service principal, run kadmin.local. On UNIX, run this command as the root user, by using the following syntax:
# cd /kerberos-install-directory/sbin # ./kadmin.local
To add a principal named oracle/dbserver.someco.com@SOMECO.COM to the list of server principals known by Kerb
eros, enter the following:
kadmin.local:addprinc -randkey oracle/dbserver.someco.com@SOMEC O.COM
Extract the service table from Kerberos and copy it to the Oracle database server/Kerberos cli ent system.
For example, use the following steps to extract a service table for dbserv
er.someco.com:
kadmin.local: ktadd -k /tmp/keytab oracle/dbserver.someco.com Entry for principal oracle/dbserver.someco.com with kvno 2, encryption DES-CBC-CRC added to the keytab WRFILE: 'WRFILE:/tmp/keytab kadmin.local: exit oklist -k -t /tmp/keytab
kadmin.local to append to them.
If you do n ot enter a realm when using ktadd, it uses the realm of the current host and displays it in the command output, as shown in Step 1.
The following exampl e shows how to move the service table on a UNIX platform:
# mv /tmp/keytab /etc/v5srvtab
The default name of the service file is /etc/v5srvtab.
Install the Oracle database server and client software.
Install Oracle Net Services and Oracle Advanced Security on the Oracle database server and Oracle client systems.
Configure Oracle Net Services on the Oracle database server and client.
See Also:
|
Perform these tasks to set required parameters in the
Oracle database server and client sqlnet.ora files:
Use Oracle Net Manager to perfo rm the following steps to configure Kerberos authentication service parameters on the client and on the database server (See "Starting Oracle Net Manager"):
Text description of the illustrati on kerb0001.gif
KERBEROS5 to be the first service used, move
it to the top of the list.
Text description of the illustration kerb0002.gif
| See Also:
Oracle Net Manager online help, and "Step 3: Set sqlnet.ora Parameters (optional)", for more information about the fields and t he parameters they configure |
The sqlnet.ora file is updated with the following entries:
SQLNET.AUTHENTICATION_SERVICES=(KERBEROS5) SQLNET.AUTHENTICATION_KERBEROS5_SERVICE=kservice
To set parameters in the initializati on parameter file:
REMOTE_OS_AUTHENT=FALSE
|
< /a>Caution: Setting
|
|
Parameter: |
<
code>SQLNET.KERBEROS5_CC_NAME= |
|
Description: |
<
td class="Simple">
|
|
Example: |
|
|
Parameter: |
|
|
Description: |
This paramet er specifies how many seconds can pass before a Kerberos credential is considered out-of-date. It is used when a credential is actual ly received by either a client or a database server. An Oracle database server also uses it to decide if a credential needs to be sto red to protect against a replay attack. The default is 300 seconds. |
|
Example: |
|
|
|
|
|
Description: |
This parameter specifies the complete pat
h name to the Kerberos configuration file. The configuration file contains the realm for the default KDC (key distribution center) an
d maps realms to KDC hosts. The default is operating system-dependent. For UNIX, it is |
Example: |
|
|
|
|
|
Description: |
This parameter sp
ecifies whether the new MIT Kerberos configuration format is used. If the value is set to |
|
Example: |
|
|
Parameter: |
|
|
Description:< /p> |
This parameter specifies the complete path name to the Kerberos pri ncipal/secret key mapping file. It is used by the Oracle database server to extract its key and decrypt the incoming authentication i nformation from the client. The default is operating system-dependent. For UNIX, it is /etc/v5srvtab. |
|
Example: |
|
|
Parameter: |
|
|
Description: |
This parameter specifies the complete path name to the Kerberos realm translation file. The translation file provides a mapping f rom a host name or domain name to a realm. The default is operating system-dependent. For UNIX, it is /etc/krb.realms. |
|
Example: |
|
To create Oracle users that K erberos can authenticate, perform this task on the Kerberos authentication server where the administration tools are installed. The r ealm must already exist.
|
Note: The utility names in this section are executable programs. However, the Kerberos user name <
code>krbuser and realm |
Run /krb5/admin/kadmin.local as root to create a new Kerberos user, such as
The following example is UNIX-specific:
# ./kadmin.local kadmin.local: addprinc krbuser Enter password for principal: "krbuser@SOMECO.COM": (password does not display) Re-enter password for principal: "krb user@SOMECO.COM": (password does not display) kadmin.local: exit
Run SQL*Plus on the Oracle database serve
r to create the Oracle user that corresponds to the Kerberos user. In the following example, OS_AUTHENT_PREFIX is set to
null (""). The Oracle user name is in uppercase enclosed in double quotation marks as shown in the following example:
SQL> CONNECT / AS SYSDBA; SQL> CREATE USER "KRBUSER@SOMECO.COM" IDENTIFIED EXTERNALLY; SQL> GRANT CREATE SESSION TO "KRBUSER@SOMECO.COM";< !--TOC=h2-"1006497"-->
Before you can connect to the database, you mu st ask the Key Distribution Center (KDC) for an initial ticket. To do so, run the following on the client:
% okinit use rname
If, when making a database connection, a reference such
as the following follows a database link, you must use the forwardable flag (-f) option:
sqlplus /@oracle
Executing okinit -f enables credenti als that can be used across database links. Run the following commands on the Oracle client:
< /a>% okinit -f Password for krbuser@SOMECO.COM:password< h2 class="H1">Utilities for the Kerberos Authentication Adapter
Three utilities are shipped with the Oracle Kerberos authentication adapter. The se utilities are intended for use on an Oracle client with Oracle Kerberos authentication support installed. Use the following utilit ies for these specified tasks:
The okinit utility obtains and caches Kerberos tickets. This utility i s typically used to obtain the ticket-granting ticket, using a password entered by the user to decrypt the credential from the key di stribution center (KDC). The ticket-granting ticket is then stored in the user's credential cache.
The options available with okinit are listed in Table 6-1:
| Option | Description |
|---|---|
|
|
Ask for a forwardable ticket-granting ticket. This option is necessary to follow database links. |
|
|
Specify the lifetime of the ticket-granting ticket and all subsequent tickets. By default, the ticket-granting ticket is good for eight (8) hours, but shorter or longer-lived credenti als may be desired. Note that the KDC can ignore this option or put site-configured limits on what can be specified. The lifetime val ue is a string that consists of a number qualified by w (weeks), d (days), h (hours), m (minutes), or s (seconds), as in the followin g example: The example requests a ticket-granting ticket that has a life time of 2 weeks, 1 day, 6 hours, 20 minutes, and 30 seconds. |
|
|
Specify an alternative credential cache. For UNIX, the default is |
|
|
List comm and line options. |
Run the oklist utility to display the list of tickets held; available oklist options are listed in Table 6-2:
| Option | |
|---|---|
|
|
Show flags with cred entials. Relevant flags are I, credential is a ticket-granting ticket, F, credential is forwardable, and f, credential is forwarded.< /p> |
|
|
Specify an alternative credential cache. In UNIX, the default is <
code>/tmp/krb5cc_ |
|
List the entries in the service table (default |
The show flag option (-f) displays additional information, as shown in the follow
ing example:
% oklist -f 27-Jul-1999 21:57:51 28-Jul-1999 05:58:14 krbtgt/SOMECO.COM@SOMECO.COM Flags: FI
Use the okdstry utility to remove credentials from the cre dentials cache file:
$ okdstry -f
where the -f command option lets you specify an alternative credential cache. For UNIX, the default is
/tmp/krb5cc_uid. You can also specify the alternate credential cache by using the SQLNET.KRB5_CC_N
AME parameter in the sqlnet.ora file.
You can now connect to an Oracle database server without using a user name or password. Enter a command similar to the following:
$ sqlplus /@net_service_name
where net_service_name is an Oracle Net Services serv
ice name. For example:
$ sqlplus /@oracle_dbname< div align="center">
| See Also:
Chapter 1, "Introduction to Oracle Advanced Security", for information about external authentication and Oracle Database Heterogeneous Connectivity A dministrator's Guide |
Oracle Advanced Security, which complies with MIT Kerberos, can interoperate with tickets that are issued by a Kerberos Key Distribution Center (KDC) on a Windows 2000 domain controller to enable Kerberos authentica tion with an Oracle database. To configure Kerberos authentication that uses a Windows 2000 domain controller KDC, perform the follow ing tasks:
The following steps mus t be performed on the Oracle Kerberos client.
Create the following Kerberos client configuration files that refer to th
e Windows 2000 domain controller as the Kerberos KDC. In the examples that follow, the Windows 2000 domain controller is running on a
node named sales3854.us.acme.com.
krb.conf file
For example:
S ALES3854.US.ACME.COM SALES3854.US.ACME.COM sales3854.us.acme.com admin server
krb5.conf file
For example:
[libdefaults] default_realm=SALES.US .ACME.COM [realms] SALES.US.ACME.COM= {
kdc=sales3854.us.acme.com:88 }
[domain_realm] .us.acme.com=SALES.US.ACME.COM
krb5.realms file
For example:
us.acme.com SALES.US.ACME.COM
Configuring an Oracle client to interoperate with a
Windows 2000 domain controller KDC uses the same sqlnet.ora file parameters that are listed in "Step 1: Configure Kerberos on the Client and on the Database Server".
Set the following parameters in the sqlnet.ora file on the client:
SQLNET.KERBEROS5_CONF=pathname_to_Kerberos_configuration_file SQLNET.KERBEROS5_CONF_MIT=TR UE SQLNET.AUTHENTICATION_KERBEROS5_SERVICE=Kerberos_service_name SQLNET.AUTHENTI CATION_SERVICES=(BEQ,KERBEROS5)
|
Note: Ensure that the |
The Windows 2000 domain controller KDC listens on UDP/TCP port 88. Ensure that the system file entry for kerbe
ros5 is set to UDP/TCP port 88 as follows:
The following steps must be performed on the Windows 2000 domain controller.
< /a>Create a new user for the Oracle client in Microsoft Active Directo ry.
For example, if the Oracle database runs on the host sales3854.us.acme.com, then use Active Directory to create a us
er with the username sales3854.us.acme.com and the password oracle.
|
Note: Do not create a user as
|
Ktpass command line utility
to extract the keytab file with the following syntax:
Ktpass -princ service/hostname@NT- DNS-REALM-NAME -mapuser account -pass password -out keytab.file
Using the database user created in the previous step, the following is an example of Ktpass usage:
C:> Ktpass -princ oracle/sales3854.us.acme.com@SALES.US.COM< /em> -mapuser sales3854 -pass oracle -out C:\temp\v5srvtab
This utility is part of the Windows 2000 Support Tools and can be found on the Windows 2000 distribution media
in the \support\reskit\netmgmt\security folder.
For example, the keytab that was created in the previous step can be copied to /krb5/v5svrtab.
| See Also:
Detailed information about Windows 2000 interoperability with Kerberos 5 that is available at the following URL: http: //www.microsoft.com/WINDOWS2000/techinfo/planning/security/ kerbsteps.asp |
The following steps must be performed on the host computer where the Oracle database is installed.
Specify values for the following parameters in the sqlnet.ora file for the database server:
SQLNET.KERBEROS5_CONF=pathname_to_Ker beros_configuration_file SQLNET.KERBEROS5_KEYTAB=pathname_to_Kerberos_principal/key_table SQLNET.KERBEROS5_CONF_MIT=TRUE SQLNET.AUTHENTICATION_KERBEROS5_SERVICE=Kerberos_service_name SQLNET.AUTHENTICATION_SERVICES=(BEQ,KERBEROS5)
|
Note: Ensure that the |
Follow the task information for "Task 9: Create an Externally Authenticated Oracle User" to create an externally authenticated
Oracle user. Ensure that the username is created in all uppercase characters. For example, ORAKRB@SALES.US.ACME.COM.
See Also:
|
Before a client can connect to the database, the client must request an initial ticket. To request an initial ticket, follow the task information for "Task 1 0: Get an Initial Ticket for the Kerberos/Oracle User".
This section lists some common configuration problems and explains how to resolve them.
sqlnet.ora file on the database server side has a service name that correspond
s to a service known by Kerberos.SQLNET.KERBEROS5_CLOCKSKEW parameter in
thesqlnet.ora file).sqlnet.ora parameters).sqlnet.ora file on the database
server side.
|
 Copyright © 1996, 2003 Oracle Corporation All Rights Reserved. |
|
