Index

A B C D E F G H I J K L M N O P R S T U V W X

< h2 class="GroupTitlesIX">A

accounting, RADIU S, 5-19

activating checksumming and encryption, 3-6

adapters, 1-15

asynchronous authentication mode in RADIUS, 5-5

ATTENTION_DESCRIPTION column, G-5

authenticated RPC

protocol adapter includes, 10-3

authentication, 1-15

configuring multiple methods, 9-4

methods, 1-10

modes in RADIUS, 5-3

B

benefits of Oracle Advanced Security, 1-4

C

CASCA DE parameter, G-6

CASCADE_FLAG column, G-5, < a href="asoappg.htm#634772">G-6

CDS. See Cell Di rectory Service (CDS)

Cell Directory Service (CDS)

cds_attributes file

modifying for name resolution in CDS, 10-20

naming adapter components, 10-3

naming adapter includes, 10-3

Oracle service names, 10-3

using to perform name lookup, 10-19

certificate, 7-6

certificate authority, 7-6

certi ficate revocation lists, 7-7

manipulating with orapki tool, 7-40

uploading to LDAP directory, 7-40

where to store them, 7-37

certificate revocation status checking

disabling on server, 7-40

certificate validation error message

CRL could not be found, 7-46

CRL date verification failed with RSA status, 7-46

CRL signature verification failed with RSA status, 7-46

Fetch CRL from CRL DP

No CRLs found, 7-47

OID hostname or port number not set, 7-47

challenge-response authentication in R ADIUS, 5-5

cipher block chaining mode, 1-6

cipher suites

Secure Sockets Layer (SSL), B- 8

client authentication in SSL, 7-21

confi guration files

Kerberos, B-1

con figuring

clients for DCE integration, 10-16

clients to use DCE CDS naming, 10-19

DCE to use DCE Integration, 10-5

Entrust-enabled Secure Sockets Layer (SSL)

on the client, F-8

Kerberos authentication service parameters, 6-5

Oracle Net/DCE external roles, 10-12

Oracle server with Kerberos, 6-2

RADIUS authentication, 5-9

shared schemas, 11-20

SSL, 7-15

on the client, 7-23

on the server, 7-15

thin JDBC support, 4-1

connecting

across cells, 10-12

to an Oracle database

to verify roles, 10-14

to an Oracle server in DCE, 10- 23

with username and password, 10-25

without username and password, 10-24

with username and password, 9-1

creating

Oracle directories in CDS, 10-6

principals and accounts, 10-5

CRL, 7-7

CRLAdmins directory administrative group, E-11

CRLs

disabling on server, 7-40

where to store them, 7-37

cryptographic hardware devices, 7-8

D

Data Encry ption Standard (DES), 3-2

DES encryption algorithm, 1-6

DES40 encryption algorithm, 3-3

Triple-DES encryption algorithm, 1-6, 3-2

data integrity, 1-7

database links

RADIUS not supported, 5-2, 11-24

DBPASSWORD column, G-5

DBPASSWORD_EXIST_FLAG column, G-5, G-6

DCE. See Distributed Computing Environment (DCE)

DCE.AUTHENTICATION parameter, 10-17

DCE.LOCAL_CELL_USERNAMES parameter, 10-17

DCE.PROTECTION parameter, 10-17

DCE.TNS_ADDRESS_OID parameter, 10-17

DCE.TNS_ADDRESS.OID parameter

modifyi ng in protocol.ora file, 10-20

DES. See Data Encryption Standard (DES)

Diffie-Hellman key negotiation algorithm, 3-4

DIRPASSWORD column, G-5

Distributed Computing Environment (DCE)

backward compatibility, 10-2

CDS naming adapter components, 10-3

communica tion and security, 10-3

components, 10-2< /dd>

configuration files required, 10-9

configuring a serve r, 10-9

configuring clients for DCE integration, 10-16

configuring clients to use DCE CDS naming, 10-19

configuring server, 10-9

configuring to use DCE Integration, 10-5

connecting

to an Oracle database, 10-23

connecting clients without access to DCE and CDS, 10-25

connecting to an Oracle server, 10-23

externally authenticated accounts, 10-10

listener.ora parameters, 10-8

mapping groups to Oracle roles,syntax, 10- 13

Multi-Protocol Interchange, 10-4

overview, 10-2

protocol.ora file parameters, 10-17

REMOTE_OS_AUTHENT parameter, 10-11

sample address in tnsna mes.ora file, 10-21

sample listener.ora file, 10-25

sample parameter files, 10-25

sample tnsnam es.ora file, 10-25

Secure Core services, 10-4

setting up external roles, 10-12

starting the lis tener, 10-23

tnsnames.ora files, 10-8

verifying DCE group mapping, 10-14

verifying dce_service_ name, 10-24

Domain Naming Service (DNS), 10-4

E

encryption, 1-16

encry ption and checksumming

activating, 3-6

c lient profile encryption, A-8

negotiating, 3-6< /a>

parameter settings, 3-9

server encryption level se tting, A-4

Enterprise Security Manager (ESM)

initial installation and configuration, 2-15

enterpri se user security

components, 11-25

confi guration flow chart, 12-3

configuration roadmap, 12-4

directory entries, 11-11

enterprise domai ns, 11-14

enterprise roles, 11-12

enterprise users, 11-11

mapping, 11-20

global roles, 11-12

groups

OracleContextAdmins, 11-18

Ora cleDBCreators, 11-18

OracleDBSecurityAdmins, 11-18

OraclePasswordAccessibleDomains, 11-18

Oracl eUserSecurityAdmins, 11-18

overview, 11-2

shared schemas, 11-19

configu ring, 11-20

tools summary, 2-13

using third-party directories, 11-5

Entrust Authority

creating database users, F-12

Entrust Authority for Oracle, F-3

Entrust Authority Software

authentication, F-5, F-6

certificate revocation, F-2

components, F -3, F-4

configuring

client, F-8

server, F-9

Entelli gence, F-4

etbinder command, F-10

issues and restrictions, F-12

key management, F-2

profiles, F-6

administrato r-created, F-6

user-created, F-7

Self-Administration Server, F-4

versions supported, F-3

Entrust, Inc., F-1

Entrust-enabled SSL

troubleshooting, F-13

Entrust/PKI Software, 1-12

error messages

< dd class="L2IX">ORA-12650, 3-6, 3-7, A-6, A-7, A-8

ORA-28890, F-13

etbinder command, F-10

F

Federal Information Processing Standard

configuration, i-xxix

Federal Information Processing Standard (FIPS), 1-7, D-1

sqlnet.ora parameters, D-1< /a>

FIPS. See Federal Information Processing Standard (FIPS)

G

GDS. See Global Di rectory Service (GDS)

Global Directory Service (GDS), 10-4

grid computing

benefits, 1-2

define d, 1-2

GT GlossaryTitle, Glossary-1

H

handshake

SSL, 7-4

I

initialization parameter file

parameters for clients and servers using Kerberos, B-1

parameters for clients and servers using RADI US, B-2

parameters for clients and servers using SSL, B-7

installing

key of server, 10-6

J

Java Byte Code Obfuscation, 4-3

Java Database Connectivity (JDBC)

configuration parameters, 4-4

Oracle extensions, 4-2

Oracle O3LOGO N, 4-2

thin driver features, 4-2

< /dd>

Java Database connectivity (JDBC)

implementation of Oracle Advanced Securit y, 4-1

JDBC. S ee Java Database Connectivity

K

Kerberos, 1-10

authentication adapter utilities, 6-11

configuring authentication, 6-2, 6-5

kinstance, 6-3

kservice, 6-3

realm, 6-3

sqlnet.ora file sample, A-2

system requirements, 1-17

kinstance (Kerberos), 6-3

kservice (Kerberos), 6-3

L

LAN environments

vulnerabilities of, 1-3

ldap.ora

which directory SSL port to use for no authentication, 7-43

listener

endpoint

SSL configuration, 7-23

starting in the DCE envi ronment, 10-23

listener.ora file

parameters for DCE, 10-10

logging into Oracle

using DCE authentication, 10-24

M

managing roles with RADIUS server, 5-21

mapping DCE groups

to Oracle roles, 10-13

MAPPING_LEVEL column, G-5, G-6

MAPPING_TYPE column, G-5, G-6

MD5 message digest algorithm, 3-4

mkstore utility, 12-25

N

NAMES.DIRECTORY_PATH parameter, 10-23

nCipher hardware security module

using Oracle Net tracing to troubleshoot, 7-50

NEEDS_ATTENTION_FLAG column, G-5

Netscape Communications Corpora tion, 7-2

network protocol boundaries, 1-16

O< /h2>

obfuscation, 4-3

of, 11-4

okdstry

Kerberos adapter utility, 6-11

okinit

Kerberos adapter utility, 6-11

oklist

Kerberos adapter utility, 6-11

OLD_SCHEMA_TYPE column, G-5

ORA-12650 error message, A-7

ORA-28885 error, 8-6

ORA-40300 error message, 7-51

O RA-40301 error message, 7-51

ORA-40302 error message, 7-51

Oracle Advanced Security

checksum sample for sqlnet.ora file, A-2

configuration parameters, 4-4

disabling authentication, 9-2

encryption sample for sqlnet.ora f ile, A-2

Java implementation, 4-1, 4-3

SSL features, 7-3

Oracle Applications wallet location, 8-18

Oracle Connection Manager, 1-16

Oracle Enterprise Security Manager (ESM), 11-2 0

introduction, 2-14

starting, 2-16

Oracle Internet Directory

Diff ie-Hellman SSL port, 7-43

version supported by Enterprise User Security, 11-5

Oracle JDBC OCI driver

used by user migration utility, G-2

Oracle parameters
authentication, 9-5

Oracle Password Protocol, 4-3

Oracle service names, 10-3

loading into CDS, 10-22

Oracle Wallet Manager

importing PKCS #7 certificate chains, 8-22

OracleContextAdmins group, 11-18

OracleDBCreators group, 11-18

OracleDBSecurityAdmins group, 11-18
< dd class="L1IX">OraclePasswordAccessibleDomains group, 11-18
OracleUserSecur ityAdmins group, 11-18

orapki

adding a c ertificate request to a wallet with, E-5

adding a root certificate to a wallet with, E-5

adding a trusted certificate to a wallet with, E-5

adding user certificates to a wallet with, E-5

creating a signed certificate for testing, E-3

creating a wallet with, E-4

creating an auto login wallet with, E-4< /dd>
exporting a certificate from a wallet with, E-6

exportin g a certificate request from a wallet with, E-6

viewing a test certificate wit h, E-3

viewing a wallet with, E-4

orapki tool, 7-40

ORCL_GLOBAL_USR_MIGRATION_DATA interfac e table, G-3

access to, G-4

ATTENTION_DESCRIPTION column, G-5

CASCADE_FLAG column, G-5, G-6

DBPASSWORD column, G-5

DBPASSWORD_EXIST_FLAG column, G-5, G-6

DIRPASSWORD column, G-5

MAPPING_LEVEL column, G-5, G-6

MAPPING_TYPE column, G-5, G-6

NEEDS_ATTENTION_FLAG column, G-5

OLD_SCHEMA_TYPE column, G-5

PASSWORD_VERI FIER column, G-5

PHASE_COMPLETED column, G-5, G-6

SHARED_SCHEMA column, G-5, G-6

USERDN column, G-5, G-6

USERDN_EXIST_FLAG column, G-5, G-6
USERNAME column, G-5

OS_AUTHENT_PREFIX parameter, 9-6

OS_ROLES parameter

setting, 10-12

OSS.SOURCE.MY_WALLET parameter, 7-17, < a href="asossl.htm#1006789">7-27

P

paragraph tags

GT Glo ssaryTitle, Glossary-1

parameters

authentication

Kerberos, B-1

RADIUS, B-2

Secure Sockets Layer (SSL), B-7

configuration for JDBC, 4-4

encryption and checksumming, < a href="asoconfg.htm#1006519">3-9

PASSWORD_VERIFIER column, G-5< /dd>

PHASE_COMPLETED column, G-5, G-6

PKCS #11 devices, 7-8

PKCS #11 error messages

ORA-40300, 7-51

ORA-40301, 7-51

ORA-40302, 7-51

PKCS #7 certificate chain, 8-22

difference from X.509 certificate, 8-22

PKI. See public key infras tructure

protocol.ora file

DCE.AUTHENTICATION parameter, 10-17

DCE.LOCAL_CELL_USERNAMES parameter, 10-17

DCE.PROTECTION parameter, 10-17

DCE.TNS_ADDRESS_OID parameter, 10-17

parameter for CDS, 10-18

Public Key Infrastructure (PKI)

certificate, 7-6

certificate authority, 7-6

certificate revocation l ists, 7-7

PKCS #11 hardware devices, 7-8

wallet, 7-8

public key infrastructure (PKI), 1-11, 1-12

RADIUS, 1-10

accounting, 5-19

asynchronous authentication mode, 5-5

authentication modes, 5-3

authentication parameters, B-2

challenge-response

authentication, 5-5

user interface, C-1, C-2

config uring, 5-9

database links not supported, 5-2< /a>, 11-24

location of secret key, 5-14

smartcards and, 1-11, 5-7, 5-14, C-1

sqlnet.ora file sample, A-3

synchronous authentication mode, 5-3

syst em requirements, 1-17

RC4 encryption algorithm, 1-6, 3-3

realm (Kerberos), 6- 3

restrictions, 1-17

revocation, F-2

roles

managing with RADIUS server, 5-21

roles, external, mapping to DCE groups, 10-12< /dd>

RSA Security, Inc. (RSA), 1-6

S

secret key

location in RADIUS, 5-14

S ecure Sockets Layer (SSL), 1-11, 7-1

architecture, 7-10

authentication parameters, B-7

authentication process in an Oracle environment, 7-4

cipher suites, B-8

client authentication parameter, B-10

client configuration, 7-23

combini ng with other authentication methods, 7-10

configuring, 7-15

configuring Entrust-enabled SSL on the client, F-8

enabling, 7-15

enabling Entrust-enabled SSL, F-6

handshake, 7-4

industry standard protocol , 7-2

requiring client authentication, 7-21

server configuration, 7-15

sqlnet.ora file sample, A-2

system requirements, 1-17

version parameter, B-9

wallet location, parameter, B-12

SecurID, 5-5

tok en cards, 5-5

security

Interne t, 1-2

Intranet, 1-2

threats, 1-3

data tampering, 1-3

dictionary attacks, 1-4

eavesdropping, 1-3

falsifying identities, 1-3

password-related, 1-4

Security Sockets Layer (SSL)

use of term includes TLS, 7-2

sh ared schemas, 11-20

SHARED_SCHEMA column, G-5, G-6

single sign-on (SSO), 1-12, 10-24, F-2

smartcards, 1-11

and RADIUS, 1-11, 5-7, 5-14, C-1

SQLNET.AUTHENT ICATION_KERBEROS5_SERVICE parameter, 6-8

SQLNET.AUTHENTICATION_SERVICES param eter, 5-10, 6-8, 7-22, 7-23, 7-30, 7-31, 9-3, 9-4

SQLNET.CRYPTO_CHECKSUM_CLIENT parameter, 3-13

SQLNET.CRYPTO_CHECKSUM_SERVER parameter, 3-13

SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT parameter, 3-13, A -8

SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER parameter, 3-13, A-8

SQLNET.CRYPTO_SEED parameter, A-8

S QLNET.ENCRYPTION_CLIENT parameter, 3-11, A-5

SQLNET.ENCRYPTION_SERVER parameter, 3-11, A-4

SQLNET.ENCRYPTION_TYPES_CLIENT parameter, 3-11, A-7

SQLNET.ENCRYPTION_TYPES_SERVER parameter, 3-11, A-6

SQLNET.FIPS_140 parameter, D-3

SQLNET.KERBEROS5_CC_NAME parameter, 6-8

SQLNET.KERBEROS5_CLOCKSKEW parameter, 6-9

SQLNET.KERBEROS5_CONF parameter, 6-9

SQL NET.KERBEROS5_CONF_MIT parameter, 6-9

SQLNET.KERBEROS5_KEYTAB parameter, 6-9

SQLNET.KERBEROS5_REALMS parameter, 6-9

sqlnet.ora file

Common sample, A-2

FIPS 140-1 parameters, D-1

Kerberos sample, A-2

modifying so CDS can resolve names, 10-22

NAMES.DIRECTORY_PATH parameter, 10-23

Oracle Advanced Security checksum sa mple, A-2

Oracle Advanced Security encryption sample, A-2

OSS.SOURCE.MY_WALLET parameter, 7-17, 7-27

parameters for clients and servers using Kerberos, B-1

parameters for clients and servers using RADIUS, B-2

parameters for clients and servers using SSL, B-7

RADIUS sample, A-3

sample, A-1

SQLNET.AUTHENTICATION_KERBEROS5_SER VICE parameter, 6-8

SQLNET.AUTHENTICATION_SERVICES parameter, 6-8, 7-22, 7-23, 7- 30, 7-31, 9-3, 9-4

SQLNET.CRYPTO_CHECKSUM_CLIENT parameter, 3-13

SQLNET.CRYPTO_CHE CKSUM_SERVER parameter, 3-13

SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT parameter, 3-13, A-8

SQLNET.CRYPTO_CHECKSUM_TYPES_SERV ER parameter, 3-13, A-8

SQLNET.CRYPTO_SEED parameter, A-8

SQLNET.ENCRYPTION_CLIENT parameter, A-5

SQLNET.ENCRYPTION_SERVER parameter, 3-11, A-4

SQLNET.ENCRYPTION_TYPES_CLIENT parameter, 3-11, A-7

SQLNET.ENCRYPTION_TYPES_SERVER parameter, 3-11, A-6

SQLNET.FIPS_140 parameter, D-3

SQLNET.KERBEROS5_CC_NAME parameter, 6-8

SQLNET.KERBEROS5_CLOCKSKEW para meter, 6-9

SQLNET.KERBEROS5_CONF parameter, 6-9

SQLNET.KERBEROS5_CONF_MIT parameter, 6-9

SQLNET.KE RBEROS5_KEYTAB parameter, 6-9

SQLNET.KERBEROS5_REALMS parameter, 6-9

SSL sample, A-2

SSL_CLIENT_AUT HENTICATION parameter, 7-22

SSL_CLIENT_AUTHETNICATION parameter, 7-27

SSL_VERSION parameter, 7-21, 7-30

Trace File Set Up sample, A-1

SQ LNET.RADIUS_ALTERNATE parameter, 5-16

SQLNET.RADIUS_ALTERNATE_PORT parameter , 5-16

SQLNET.RADIUS_ALTERNATE_RETRIES parameter, 5-16

SQLNET.RADIUS_ALTERNATE_TIMEOUT parameter, 5-16

SQLNET.RADIUS_SEND_ACCOUNTING parameter, 5-19

SSL. See Secure Sockets Layer (SSL)

SSL wallet location, 8-11, 8-18

SSL_CLIENT_AUTHENTICATION parameter, 7-22, 7-27

SSL_VERSION parameter, 7-21, 7-30

SSO. See single sign-on (SSO)

SSO wallets, 8-19

sync hronous authentication mode, RADIUS, 5-3

SYS schema, G-3

system requirements, 1-16

DCE integration, 10-2

Kerberos, 1-17

RADIUS, 1-17

SSL, 1-17< /dd>

T

thin JDBC support, 4-1

TLS See Secure Sockets Layer (SSL)

tnsnames.ora file

loading into CDS using tnnfg, 10-22

modifying to load connect descriptors into CDS, 10-21

renaming, 10-22

token cards, 1-11

trace f ile

set up sample for sqlnet.ora file, A-1

Triple-DES encryption algorithm, 1-6

troubleshooting, 6-18

Entrust-enabled SSL, F-13

< /dd>

U

user migration utility

access to interface table, G-4

accessing help, G-12

ATTENT ION_DESCRIPTION column, G-5

CASCADE parameter, G- 6

CASCADE_FLAG column, G-5, G-6

certificate authenticated users, G-7

DBPASSWORD column, G-5

DBPASSWORD_EXIST_FLAG column, G-5, G-6

directory location of utility, G-8

DIRPASSWORD column, G-5

example

parameter text file (par.txt), G-25

users list text file (usrs.txt), G-25

using CASCADE=NO, G-21

using CASCADE =YES, G-22

using MAPSCHEMA=PRIVATE, G-20

using MAPSCHEMA=SHARED, G-21

using MAPTYPE options, G-24

using PARFILE, USERSFILE, and LOGFILE parameters, G- 26

LOGFILE precedence, G-26

MAPPING_LEVEL column, G-5, G-6

MAPPING_TYPE column, G-5, G-6

MAPSCHEMA parameter

PRIVATE, G-16

SHARED, G-16
< /dl>

MAPTYPE parameter

DB mapping type, G-17

DOMAIN mapping type, G-17

ENTRY mapping level, G-17

SUBTREE mapping level, G-17, G-24

NEEDS_ATTENTION_FLAG column, G-5

OLD_SCHEMA_TYPE column, G-5

ORCL_GLOBAL_USR_MIGRATION_DATA interface t able, G-3

password authenticated users, G-7
PASSWORD_VERIFIER column, G-5

PHASE_COMPLETED column, G-5, G-6

retrieving dropped schema objects, G-23

shared schema mapping, G-6

SHARED_SCHEMA column, G-5, G-6

SSL authe ntication for current release, G-8

SYS schema, G- 3

USER parameter

ALL_EXTERNAL, G-14
ALL_GLOBAL, G-14

LIST, G-14

USERSFILE, G-14

USERDN column, G-5, G-6

USERDN_EXIST_FLAG column, G-5, G-6

USERNAME column, G-5

uses Oracle JDBC OCI driver, G-2

X.509 v3 certificates, G-7

USERDN column, G-5, G-6

USERDN_EXIST_FLAG column, G-5, G-6

USERNAME column, G-5

V

viewin g mapping in CDS namespace, for listener endpoint, 10-24

viewing the databas e wallet DN, 12-25

W

wallet, 7-8

wallets

auto login, 8-19

changing a password, 8-18

closing, 8-13

creating, 8-10

deleting, 8-18

managing, 8-9

managing certifica tes, 8-20

managing trusted certificates, 8-25

opening, 8-13

Oracle Applications wallet location , 8-18

saving, 8-17

setting location, 7-16

SSL wallet location, 8- 11, 8-18

SSO wallets, 8-19

< /dd>

Index

B

C

D

E

F

G

H

I

J

K

L

M

N

P

S

T

V

W

X X.509 certificate difference from PKCS #7 certificate chai n, 8-22 X.509 PKI certificate standard, F-2

X

X.509 certificate

difference from PKCS #7 certificate chai n, 8-22

X.509 PKI certificate standard, F-2