Release 8.1.5
A67766-01
 Library |
 Product |
 Contents |
 Index |
| Oracle Advanced Security Administrator's Guide Release 8.1.5 A67766-01 |
|
This chapter discusses how to configure Oracle and Net8 to use Oracle DCE Integration after it has been successfully installed. The following sections describe the parameters you need to configure for servers and clients.
DCE addresses in the listener.ora and tnsnames.ora configuration files are defined by DCE parameters. These parameters consist of both mandatory and optional fields, which are described below:
ADDRESS=(PROTOCOL=DCE)
(SERVER_PRINCIPAL=server_name)
(CELL_NAME=cell_name)
(SERVICE=dce_service_name))
where the components are:
You can specify a service as:
SERVICE=/.../cell_name/subsys/oracle/service_registry/dce_service_name
or it can be specified as
SERVICE=dce_service_name
provided that CELL_NAME=cell_name is also specified.
A third option is to specify SERVICE=dce_service_name, in which case the cell name defaults to the local cell. However, this third way of specifying service names only works well if you are working within a single cell.
To configure a server for DCE Integration, you need to configure the following Net8 files with DCE address and parameter information as described in "DCE Address Parameters" and in the following sections.
|
Note: Use the Net8 Assistant to create the necessary configuration files. For explanations of the configuration files, refer to the Net8 Administrator's Guide |
Note the following prerequisites:
For a database server to receive connections from Net8 clients in a DCE environment, there must be a Net8 listener active on the server platform. A listener listens for connections on a network address that is defined in the listener configuration file (listener.ora).
The SERVER_PRINCIPAL parameter designates what DCE principal the listener should be running under. In the sample below, the listener is running under principal "oracle".
Below is a sample DCE address as it would appear in the listener.ora file.
LSNR_DCE=
(ADDRESS=
(PROTOCOL=DCE) (SERVER_PRINCIPAL=oracle) (CELL_NAME=cell1) (SERVICE=dce_svc))
SID_LIST_LSNR_DCE=
(SID_DESC=
(SID_NAME=ORASID)
(ORACLE_HOME=/private/oracle7))
To use DCE authentication for logging onto the Oracle database, you need to create database accounts that are "authenticated externally".
|
More Information:
For more information on external authentication, see Oracle8i Distributed Database Systems |
To enable secure external authentication, do the following:
REMOTE_OS_AUTHENT=FALSE
OS_AUTHENT_PREFIX=""
mts_dispatchers="dce, 3"
If users will be connecting within a local cell, use the following format.
SQL> CREATE USER server_principal IDENTIFIED EXTERNALLY; SQL> GRANT CREATE SESSION TO server_principal;
For example:
SQL> CREATE USER oracle IDENTIFIED EXTERNALLY; SQL> GRANT CREATE SESSION TO oracle;
If connecting to the database across multiple cells, specify both the cell_name and the server_principal.
SQL> CREATE USER "CELL_NAME/SERVER_PRINCIPAL" IDENTIFIED EXTERNALLY; SQL> GRANT CREATE SESSION TO "CELL_NAME/SERVER_PRINCIPAL";
For example:
SQL> CREATE USER "CELL1/ORACLE" IDENTIFIED EXTERNALLY; SQL> GRANT CREATE SESSION TO "CELL1/ORACLE";
This section explains the steps you follow to set up external roles for DCE integration, and how you connect to an Oracle database as SYSOPER or SYSDBA with DCE credentials.
OS_ROLES=TRUE
Then restart the database.
ORA_<global_name>_<role>[_[a][d]]
where the components are:
Following is some sample output showing a listing of external roles (DBA, CONNECT, RESOURCE, and ROLE1) that have been mapped to DCE groups.
SQL> SELECT * FROM session_roles;
ROLE
------------------------------
CONNECT
RESOURCE
ROLE1
SQL> SET ROLE all;
Role set.
SQL> SELECT * FROM session_roles;
ROLE
------------------------------
DBA
EXP_FULL_DATABASE
IMP_FULL_DATABASE
CONNECT
RESOURCE
ROLE1
6 rows selected.
SQL> EXIT
To connect to an Oracle database as SYSOPER or SYSDBA with DCE credentials, do the following:
$ dce_login cell_admin <cell_admin password> $rgy_edit rgy_edit=> domain group DOmain changed to: group rgy_edit=> add ora_dce222_dba_ad rgy_edit=> add ora_dce222_operator_ad rgy_edit=> member ora_dce222_dba_ad -a oracle rgy_edit=> member ora_dce222_operator_ad -a oracle
ORADCE= (ADDRESS= (PROTOCOL=DCE) (SERVER_PRINCIPAL=oracle) (CELL_NAME=cell1) (SERVICE=dce_svc)) (CONNECT_DATA= (SID=ORASID) (GLOBAL_NAME=dce222)))
$ dce_login oracle <oracle password> $klist DCE Identity Information: Warning: Identity information is not certified Global Principal: /.../dce.dlsun685.us.oracle.com/oracle Cell: 00af8052-7e94-11d2-b261-9019b88baa77 /.../dce.dlsun685.us.ora cle.com Principal: 0000006d-88b9-21d2-9300-9019b88baa77 oracle Group: 0000000c-7e94-21d2-b201-9019b88baa77 none Local Groups: 0000000c-7e94-21d2-b201-9019b88baa77 none 0000006a-7e94-21d2-ad01-9019b88baa77 subsys/dce/cds-server 00000076-8b53-21d2-9301-9019b88baa77 ora_dce222_dba_ad 00000077-8b53-21d2-9301-9019b88baa77 ora_dce222_operator_ad Identity Info Expires: 1998-12-04-10:28:22 Account Expires: never Passwd Expires: never Kerberos Ticket Information: Ticket cache: /opt/dcelocal/var/security/creds/dcecred_43ae2600 Default principal: oracle@dce.dlsun685.us.oracle.com Server: krbtgt/dce.dlsun685.us.oracle.com@dce.dlsun685.us.oracle.com valid 1998-12-04-00:28:22 to 1998-12-04-10:28:22 Server: dce-rgy@dce.dlsun685.us.oracle.com valid 1998-12-04-00:28:22 to 1998-12-04-10:28:22 Server: dce-ptgt@dce.dlsun685.us.oracle.com valid 1998-12-04-00:28:26 to 1998-12-04-02:28:26 Client: dce-ptgt@dce.dlsun685.us.oracle.com Server: krbtgt/dce.dlsun685.us.o racle.com@dce.dlsun685.us.oracle.com valid 1998-12-04-00:28:26 to 1998-12-04-02:28:26 Client: dce-ptgt@dce.dlsun685.us.oracle.com Server: dce-rgy@dce.dlsun685.us. oracle.com valid 1998-12-04-00:28:27 to 1998-12-04-02:28:26
SQL> connect /@oradce as SYSDBA
To configure a client for DCE Integration, you need to configure the following Net8 files with DCE address and parameter information, as described below:
Typically, CDS is used for name resolution. Thus, a local naming configuration file (tnsnames.ora) is not used, except when loading names and addresses into CDS.
There are four DCE parameters located in protocol.ora. Each parameter begins with the prefix "DCE." to distinguish it from parameters relevant to other protocols. If default values are used for these four parameters, DCE Integration does not require a protocol.ora file. The parameters and their current defaults are:
Configuration parameters are not case-sensitive: you can enter them in either upper-case or lower-case.
DCE.AUTHENTICATION--This parameter is optional. It indicates the authentication value to be used for each DCE RPC. The client's DCE_AUTHENTICATION value must be the same as the server's DEC_AUTHENTICATION value. The choices are:
DCE.PROTECTION--This is an optional field. It specifies the data integrity protection levels for data transmission. The client's DCE_PROTECTION level must be equal to or greater than the server's DCE_PROTECTION level. The choices are:
DCE.TNS_ADDRESS_OID--This optional parameter enables you to specify an alternative to the default DCE.TNS_ADDRESS_OID (shown below):
DCE.TNS_ADDRESS_OID=1.3.22.1.x.x
|
More Information:
For information on how to determine if you need to include this parameter, and how to specify it, see "Modify the CDS Attributes File and Restart the CDS". |
DCE.LOCAL_CELL_USERNAMES--This optional parameter defines the format used to specify the principal name (username) either with or without the cell name.
The choices are:
TRUE: This is the default. Choose TRUE when using just the SERVER_PRINCIPAL format, without the CELL_NAME. An example of a user specified in this format would be:
oracle
This choice would be appropriate if users are making connections within a single cell, or if naming conventions in your network assure that users in different cells do not have duplicate names.
FALSE: Choose FALSE when using the CELLNAME/SERVER_PRINCIPAL format. An example of a user specified in this format would be:
CELL1/ORACLE
This choice would be appropriate if users are making connections across cells and there may be users in different cells with identical names.
Clients will typically use CDS to resolve Oracle service names to addresses. Follow the instructions below to configure CDS.
To use CDS for name resolution, the DCE Integration CDS Naming Adapter must be installed on all clients and servers that will use CDS. Also, the CDS namespace must have been configured for use by DCE Integration.
|
More Information:
For instructions on how to install and configure the CDS Naming Adapter, see the DCE Integration installation instructions and "Step 3: Configure DCE CDS for Use by Oracle DCE Integration". |
For example, a service name such as "ORADCE" and its network address can be stored in DCE's CDS.
Typically, users can connect to Oracle services using the familiar Oracle service name (if there are no domains or the database is in the user's default domain): For example:
sqlplus /@ORADCE
This example assumes that DCE externally-authenticated accounts are in use.
As an alternative name resolution service, you can use a local naming configuration file (tnsnames.ora) when CDS is inaccessible. To do this, you must locate names and addresses of all Oracle servers in the local naming configuration file (tnsnames.ora).
On all DCE machines where CDS naming will be used, add the object ID for the CDS attribute TNS_Address to the CDS attributes file. (The object ID must be the same across all machines.)
1.3.22.1.5.1 TNS_Address char
If the default TNS_Address OID (Object Identifier) value (1.3.22.1.5.1) already exists in the cds_attributes file, then you need to specify a value for the OID that is not already in use.
If you are unable to use the default value for the OID, you need to specify the OID in the protocol.ora file on the client.
If you had to specify a value other than the default (1.3.22.1.5.1), then you need to add the following parameter to the protocol.ora file:
DCE.TNS_ADDRESS_OID=1.3.22.1.x.y
To load the Oracle service names and addresses into CDS, create or modify a local naming configuration file (tnsnames.ora) containing service names (or aliases) and addresses. A sample file is shown below. The local naming configuration file (tnsnames.ora) is used to map service names to addresses for use by Net8.
This section describes the parameters that you need to include in the tnsnames.ora file. tnsnames.ora contains a list of Oracle service names mapped to connect descriptors of destinations or endpoints in the network. The sample DCE address below shows a network address for an Oracle server with the Oracle service name "ORADCE". It is used to connect to the service registered as "DCE_SVC" in the CDS directory /.../cell_name/subsys/oracle/names.
ORADCE=(DESCRIPTION=
(ADDRESS=
(PROTOCOL=DCE)
(SERVER_PRINCIPAL=oracle)
(CELL_NAME=cell1)
(SERVICE=DCE_SVC))
(CONNECT_DATA=
(SID=ORASID)))
The keyword value pair PROTOCOL=DCE is mandatory. It appears in the address section of a listener configuration file (listener.ora) and in the address section of a local naming configuration file (tnsnames.ora). It must be the same in both places.
The DCE parameter SERVER_PRINCIPAL is optional in a local naming configuration file (tnsnames.ora).
The DCE parameter SERVICE is mandatory. The value given for the DCE parameter (SERVICE= dce_service_name) must be the same in the listener configuration file (listener.ora) and local naming configuration file (tnsnames.ora).
The Oracle parameter SID is mandatory. It identifies the Oracle system ID; each SID value must be unique on a node. This parameter is strictly local and is not used in DCE CDS.
|
More Information:
For information on the local naming configuration file (tnsnames.ora), see the Net8 Administrator's Guide |
A separate utility called "tnnfg" is provided with Oracle DCE Integration to load connect descriptors into CDS.
To load the Oracle service names or aliases into CDS, perform the following steps:
% dce_login cell_admin % tnnfg dceload full_pathname_to_TNSNAMES.ORA % Enter Password:(password will not display)
This procedure loads the service names in tnsnames.ora into DCE's CDS.
If you are using SQL*Net 2.2 or earlier, after having loaded the tnsnames.ora file into DCE's CDS, Oracle recommends that you rename it to another name--tnsnames.bak, for example, or delete it. Otherwise, tnsnames.ora may be searched instead of CDS to resolve the service name to an address.
If you are using SQL*Net 2.3 or Net8, you can keep tnsnames.ora available as a backup in case CDS becomes unavailable. To assure that CDS will routinely be searched instead of tnsnames.ora, configure the NAMES.DIRECTORY_PATH parameter in a profile (sqlnet.ora), as described in the next section: "Modify SQLNET.ORA Parameter File to Have Names Resolved in CDS".
The parameters required in a profile (sqlnet.ora) depend upon the version of SQL*Net or Net8 you are using.
For a client or server to use the DCE CDS Naming, the administrator needs to do the following:
NAMES.DIRECTORY_PATH=(dce, tnsnames, onames)
The first name resolution service listed as a value for this parameter is used. If it is unavailable for some reason, the next name resolution service is used, and so forth.
|
More Information:
For information on how to connect to Oracle databases in a DCE environment, see Chapter 14, "Connecting to an Oracle Database in DCE". |
