4
Using Oracle8i Client Directory Features with Active Directory

This chapter describes how to enable Oracle8i directory features with Microsoft's Active Directory.

Specific topics discussed are:

• Overview

• Oracle8i Directory Server Features

• Integration with Active Directory

• Requirements for Using Oracle8i with Active Directory

• Installing and Configuring Oracle8i in an Active Directory Environment

• Testing Connectivity

• Managing Access Control Lists for Oracle Directory Objects

• Creating Security Domains

Overview

This section provides an overview of the following topics:

• What are LDAP and a Directory Server?

• What is Active Directory?

What are LDAP and a Directory Server?

The Lightweight Directory Access Protocol (LDAP) is a networking and directory access protocol for accessing information in a directory server. The directory server centrally stores and manages information about all network resources and makes that information accessible to users and applications. Resources can include user names, databases, computers, fax servers, applications, e-mail addresses, and printers. A directory server is analogous to a telephone directory, which stores information such as phone numbers and addresses of telephone subscribers.

What is Active Directory?

Active Directory is the LDAP-compliant directory server included with Windows 2000. Active Directory centrally stores all Windows 2000 information, including users, groups, and policies. Active Directory also stores information about network resources such as databases, and makes this information available to application users and network administrators. Active Directory enables users to access network resources with a single login. The scope of Active Directory can range from storing all the resources of a small computer network to storing all the resources of several wide areas networks (WANs).

Oracle8i Directory Server Features

With Oracle8i release 8.1.6, two new features are provided for storing Oracle information in a directory server. These new features are briefly described in the following sections:

• Net8 Directory Naming Features

• Enterprise User Security Features

References are provided to additional documentation. Both features have been enabled to work with Microsoft's Active Directory.

Net8 Directory Naming Features

This feature enables you to create and store database service and net service name entries for use with Net8 as directory objects in Active Directory. These objects contain connectivity information that can be used by various Oracle client applications when connecting to an Oracle8i database.

During Oracle8i release 8.1.6 database creation, a database service entry is created with Oracle Database Configuration Assistant. Clients configured to access the directory server can use this entry in their connect strings to connect to the database without any additional configuration.

If you prefer not to expose the database service entry to clients, you can use Net8 Assistant to create net service name entries in the directory server, which eliminates the need to create and maintain separate TNSNAMES.ORA files on each client computer. When clients attempt an Oracle8i database connection, the net service name is instead retrieved from a directory server. The Directory Server Migration Wizard, available with Net8 Assistant, enables you to export net service names stored in an existing TNSNAMES.ORA file to the directory server.

Note: Database service and net service name entries stored in an Oracle Names server can migrated to a directory server using the NAMESCTL utility. See the Net8 Administrator's Guide for more information.

This chapter frequently references Net8 directory naming terms and concepts. Read the following documentation for descriptions of terms and concepts that an administrator and client user must understand before using an Oracle8i database with Active Directory.

See Section...	Which Describes...
"Net8 and an LDAP-Compliant Directory Server" in Chapter 2 of the Net8 Administrator's Guide	How client computers use a directory server to connect to an Oracle8i database Naming conventions and the location for Net8 and Oracle8i database entries in a directory server How Oracle8i database service and net service name entries are created or modified Database server requirements for using a directory server for lookups Client requirements for performing entry lookups in a directory server How to create connect strings to connect to an Oracle8i database using database service and net service names stored in a directory Access Control List security overview (the client's privileges in the directory)
"Configuring the Directory Naming Method" in Chapter 6 of the Net8 Administrator's Guide	The Oracle8i and Active Directory configuration process (at the end of or separate from server and client installation) Adding and removing users from the OracleNetAdmins group with the LDAPMODIFY utility Exporting information into Active Directory from an existing TNSNAMES.ORA file or Oracle Names server

Enterprise User Security Features

This feature enables you to create and store Oracle8i information as directory objects in Active Directory. This enables users to make natively-authenticated, Single Sign-On (SSO) connections to a database. An administrator can create and store enterprise users and roles for the Oracle8i in Active Directory, which helps centralize the administration of users and roles across multiple databases.

This chapter frequently references enterprise user security terms and concepts. Read the following documentation for descriptions of terms and concepts that an administrator and client user must understand before using an Oracle8i database with Active Directory.

See...	Which Describes...
Chapter 17, "Managing Enterprise User Security" of Oracle Advanced Security Administrator's Guide	Enterprise user security and management Descriptions of enterprise users, roles, domains, and concepts Location for enterprise user security entries in a directory server Installing and configuring enterprise user security
Chapter 20, "Using Oracle Enterprise Security Manager" of Oracle Advanced Security Administrator's Guide	Creating and managing enterprise users, roles, and domains

Note: Enterprise domains are directory constructs consisting of Oracle8i databases and enterprise users and roles. Enterprise domains are different from Windows 2000 domains, which are a collection of computers that share a common directory database.

Integration with Active Directory

In addition to Net8 directory naming and enterprise user security integration with a directory server, the following features have been specifically integrated into Active Directory:

• Automatic Discovery of Directory Servers

• Integration with Microsoft Tools

• User Interface Extensions for Net8 Directory Naming

• Enhancement of Directory Object Type Descriptions

• Integration with Windows Login Credentials

• How Do Oracle Directory Objects Display in Active Directory?

Automatic Discovery of Directory Servers

Net8 Configuration Assistant enables you to configure client computer and Oracle8i database server access to a directory server. When Net8 Configuration Assistant starts at the end of Oracle8i database installation or is manually started after installation, it prompts you to specify a directory server type to use. When you select Active Directory as your directory server type, Net8 Configuration Assistant automatically:

• Discovers the Active Directory server location

• Configures access to the Active Directory server

• Creates the administrative context (also known as your domain)

If the Active Directory server through which client connections are accessing an Oracle8i database is shut down, another Active Directory server is automatically discovered and begins providing connection information; this prevents any downtime for client connections.

You must be running your Oracle client and database software in a Windows 2000 domain to take advantage of the automatic directory server discovery features of Net8 Configuration Assistant. This is regardless of the Oracle client and database releases you are using.

If you are not running in a Windows 2000 domain, Net8 Configuration Assistant does not automatically discover your directory server, and instead prompts you for additional information, such as the naming context and Active Directory location.

Integration with Microsoft Tools

Oracle8i database service, Net8 net service name, and enterprise role entries in Active Directory display in the following Microsoft Windows 2000 tools:

Tool	Description	This Integration Enables You To...
Windows Explorer	A user tool that displays the hierarchical structure of files, directories, and local and network drives on your computer.	Display and test Oracle8i database service and Net8 net service name objects
Active Directory Users and Computers	An administrative tool installed on Windows servers configured as domain controllers. This tool enables you to add, modify, delete, and organize Windows 2000 accounts and groups, and publish resources in your organization's directory.	Display and test Oracle8i database service and Net8 net service name objects and manage access control

User Interface Extensions for Net8 Directory Naming

The property menus of Oracle8i database service and net service name objects in Windows Explorer and Active Directory Users and Computers have been enhanced. These enhancements enable you to test for object connectivity to the Oracle8i database and perform database administration. When you right click these Oracle directory objects, a menu presents you with two options for testing connectivity:

Menu Option	Description
Test	Starts an application that tests that the user name, password, and net service name you initially entered can connect to the Oracle8i database.
Connect with SQL*Plus	Starts SQL*Plus, which enables you to perform database administration, run scripts, and so on.

Enhancement of Directory Object Type Descriptions

Oracle directory object type descriptions in Active Directory have been enhanced to make them easier to understand. For example, here is the description for OracleDefaultDomain's type in the Type column of the right window pane:

Integration with Windows Login Credentials

SSO enables client users to access all authorized network resources (such as Active Directory) with a single authentication that is performed when they initially specify their user login credentials to access the network. SSO is included in Windows 2000 through the Kerberos and Secure Sockets Layer (SSL) authentication protocols.

The Oracle8i database and configuration tools can use the Windows user's login credentials to automatically connect to Active Directory without having to re-enter their login credentials. This enables:

• Oracle8i clients and databases to securely connect to Active Directory and retrieve net service name, enterprise user, and enterprise role information

• Configuration tools such as Oracle Enterprise Security Manager, Net8 Configuration Assistant, Net Assistant, and Oracle Database Configuration Assistant to connect automatically to Active Directory and configure the Oracle8i database and net service name objects

For Windows 2000, the default authentication protocol used is Kerberos.

How Do Oracle Directory Objects Display in Active Directory?

When the Oracle8i database and Net8 are installed and configured to access Active Directory, Oracle directory objects appear in Active Directory Users and Computers:

This table describes these Oracle directory objects:

Object	Description
domain	The domain (also known as the administrative context) in which you created your Oracle Context. The administrative context contains various Oracle entries to support directory naming and enterprise user security. Net8 Configuration Assistant automatically discovers this information during Oracle8i database integration with Active Directory.
OracleContext	The top-level Oracle entry in the Active Directory tree that can contain Oracle8i database service and Net8 net service name object information. All Oracle software information is placed in this container.
orcl	The Oracle8i database service name (for this example, orcl is the name).
Products	A container for Oracle security and domain information.
OracleDBSecurity	A container for security domains.
OracleDefaultDomain	The default enterprise domain created. You can create additional enterprise domains with Oracle Enterprise Security Manager.
sales	The net service name object (for this example, sales is the name).
Users	The folder for the three Oracle security groups. See section "Managing Access Control Lists for Oracle Directory Objects" for more information. Enterprise users and roles created with Oracle Enterprise Security Manager also appear in this folder.

Requirements for Using Oracle8i with Active Directory

The requirements that you must complete depend upon the Oracle features you want to use:

	Required For...
Requirement	Net8 Directory Naming?	Enterprise User Security?
"Oracle Schema Creation Requirements"	Yes	Yes
"Oracle Context Creation Requirements"	Yes	Yes
"Net8 Directory Naming Requirements"	Yes	No
"Enterprise User Security Requirements"	No	Yes

Note: You must be running your Oracle clients and database server in a Windows 2000 domain. This is regardless of the Oracle client and Oracle database server releases you are running.

Oracle Schema Creation Requirements

Complete the following Oracle schema creation requirements to use the Net8 directory naming and enterprise user security features with Active Directory. A schema is a set of rules for Net8 and Oracle8i database entries and their attributes stored in Active Directory.

• You can create only one Oracle schema per forest.

• Perform schema creation on a Windows 2000 domain controller.

• The Windows 2000 domain controller must be the operations master. See your Microsoft documentation for instructions.

• Log in as a member of the Schema Administrator group to create the schema. Domain administrators by default are in the Schema Administrator group.

• Create the Schema Update Allowed registry parameter prior to installation. See your Microsoft documentation for instructions.

• Use Net8 Configuration Assistant to create the Oracle schema. You can create your schema during or after installation. The schema can be created by running Net8 Configuration Assistant on the Oracle8i database or on a client computer.

  See Also: Net8 Administrator's Guide for configuration procedures and Oracle8i Client Installation Guide for Windows for a configuration overview.

Oracle Context Creation Requirements

You must complete the following Oracle Context creation requirements to use the Net8 directory naming and enterprise user security features with Active Directory. The Oracle Context is the top-level Oracle entry in the Active Directory tree that contains Oracle8i database service and Net8 net service name object information.

• You can create only one Oracle Context per Windows 2000 domain (administrative context).

• You must have the right to create domain objects in order to create the Oracle Context in Active Directory with Net8 Configuration Assistant. If you are a domain administrator, you automatically have these rights.

• Use Net8 Configuration Assistant to create your Oracle Context. You can create the Oracle Context during or after installation.

  See Also: Oracle8i Client Installation Guide for Windows for installation procedures and the Net8 Administrator's Guide for configuration procedures

Net8 Directory Naming Requirements

Ensure that you first satisfy the requirements described in:

• "Oracle Schema Creation Requirements"

• "Oracle Context Creation Requirements"

This table describes the Microsoft and Oracle software releases that must be installed to use Net8 directory naming with Active Directory:

For...	The Required Microsoft Software Is...	The Required Oracle Software Is...
Client Computers	Windows 2000 Windows 4.0 with Active Directory Service Interfaces (ADSI) Windows 95 or 98 with the Distributed Systems Client upgrade	Oracle8i Client release 8.1.6, which includes Net8 Client and these configuration tools: Net8 Configuration Assistant Net8 Assistant Note: See the Oracle8i Client Installation Guide for Windows for installation instructions and "Required Configuration Tools" for descriptions of the tasks that these configuration tools perform.
Database Server	Windows NT 4.0 Windows 2000	Oracle8i database release 8.1.6 is required for registering the database service as an object in Active Directory.

Enterprise User Security Requirements

Ensure that you first satisfy the requirements described in:

• "Oracle Schema Creation Requirements"

• "Oracle Context Creation Requirements"

This table describes the Microsoft and Oracle software releases required to use enterprise user security with Active Directory:

For...	Microsoft Software	Oracle Software
Client Computers	Windows 2000 Windows NT 4.0 with or without ADSI Windows 95 or 98 with or without the Distributed Systems Client upgrade	Oracle8i Client release 8.1.5 or greater
Database Server	Windows NT 4.0 with ADSI Windows 2000	Oracle database release 8.1.6, which automatically installs: Oracle Database Configuration Assistant
			Net8 Client, which includes these configuration tools:
			Net8 Configuration Assistant Net8 Assistant
Remote computer from which to manage the Oracle8i database		Oracle Enterprise Manager Console release 2.1, which includes: Oracle Enterprise Security Manager Net8 Client Note: Oracle Enterprise Security Manager is required if you want to create and manage enterprise users, roles, and domains.

Installing and Configuring Oracle8i in an Active Directory Environment

This section provides an overview of installation and configuration information. Specific topics covered include:

• Installation Tasks

• Required Configuration Tools

• Post-Installation Configuration Tasks

Installation Tasks

See Chapters 4 and 5 of the Oracle8i Client Installation Guide for Windows for Oracle8i installation instructions.

Required Configuration Tools

Several tools are required for configuring the Oracle clients and Oracle8i database for access to Active Directory. This table identifies:

• Tasks that these tools perform

• How to run these tools

• Documentation for additional information on using these tools

These tools are listed in the order in which to use them. After you configure your environment, you can take advantage of the Net8 directory naming and enterprise user security features.

To...	Run this Tool...	When Does This Tool Run?	For More Information...
Create an Oracle schema and Oracle Context in Active Directory (if one is not already installed) and Set up Access Control Lists for security in Active Directory	Net8 Configuration Assistant, which guides you through Oracle8i database server configuration with Active Directory. Run this tool either on the Oracle8i database server or from a client computer that connects to the server.	There are two methods: Automatically started at the end of Custom installation of Oracle8i Server (the Oracle8i database) Manually started after Oracle8i Server	Chapter 6 of Net8 Administrator's Guide Chapters 4 and 5 of Oracle8i Client Installation Guide for Windows online help included with Net8 Configuration Assistant
Register the Oracle8i database as an object in Active Directory Note: This task is not required if you are not using the enterprise user security feature.	Oracle Database Configuration Assistant	There are two methods: Automatically started after Net8 Configuration Assistant has created the Oracle schema, Oracle Context, and set up Access Control List security, if you installed the Oracle8i database through the Custom installation type. Manually started after Oracle8i Server installation and Active Directory access configuration by Net8 Configuration Assistant. Select the Change database configurations option.	Oracle8i Administrator's Guide for Windows NT Chapters 4 and 5 of Oracle8i Client Installation Guide for Windows
Configure an Oracle8i client computer to access Active Directory	Net8 Configuration Assistant, which guides you through client computer configuration with Active Directory by prompting you to: Select the Directory Naming Method as the naming method with which to connect to the Oracle8i database Identify the Active Directory with which to integrate the Oracle client	There are two methods for running Net8 Configuration Assistant: Automatically started at the end of any Oracle8i Client installation type: (Administrator, Application User, Programmer, or a Custom installation of Net8 Client) Manually started after installation of any Oracle8i Client installation type	Chapter 6 of Net8 Administrator's Guide Chapters 4 and 5 of Oracle8i Client Installation Guide for Windows online help included with Net8 Configuration Assistant
Create and modify net service name objects or modify Net8 attributes of the database	Net8 Assistant	You must manually start Net8 Assistant.	Net8 Administrator's Guide online help included with Net8 Assistant
Create enterprise users, roles, and domains in Active Directory (enterprise user security)	Oracle Enterprise Security Manager	Manually started as an integrated application of Oracle Enterprise Manager Console	Oracle Advanced Security Administrator's Guide

Post-Installation Configuration Tasks

You must set the OSAUTH_X509_NAME registry parameter to TRUE to use enterprise user security.

Testing Connectivity

This section describes how to connect to an Oracle8i database through Active Directory. Specific topics discussed include:

• Testing Connectivity from Client Computers

• Testing Connectivity from Microsoft Tools

Testing Connectivity from Client Computers

Client computers connect to an Oracle8i database by specifying the database entry that appears in the Oracle Context. For example, if the database service entry under the Oracle Context in Active Directory was sales, a user connects through SQL*Plus to the Oracle8i database as follows:

If the Client and Oracle8i database are in...	The Client Specifies The Following...
The same domain	SQL> CONNECT SCOTT/TIGER@SALES
Different domains	SQL> CONNECT SCOTT/TIGER@SALES@DOMAIN where domain is the domain in which the Oracle8i database is located.

The connect strings in this table follow DNS-style conventions. While Active Directory also supports connections using X.500 naming conventions, DNS-style conventions are the recommended method because of ease of use. DNS-style conventions enable client users to access an Oracle8i database through a directory server by entering minimal connection information; this is the case even when the client computer and Oracle8i database are in separate domains. X.500 names are longer; this is especially the case when the client and Oracle8i database are located in different domains (also known as administrative contexts).

To learn more about X.500 naming conventions, see Chapter 2, "Net8 Concepts", of the Net8 Administrator's Guide for information.

Testing Connectivity from Microsoft Tools

Oracle directory objects in Active Directory are integrated with Microsoft tools such as:

• Windows NT Explorer

• Active Directory Users and Computers

You can perform the following tasks from within these Microsoft tools:

• Connect with SQL*Plus to an Oracle8i database

• Test Oracle8i database connectivity

  Note: All clients accessing an Oracle8i database through Active Directory require read access on all Net8 net service name objects in the Oracle Context and must be able to authenticate anonymously with Active Directory. Net8 Configuration Assistant automatically sets this up.

Accessing Connectivity Tools

To access connectivity tools:

1. Start the Microsoft tool with which you want to connect:

   With...	Choose...
   Active Directory Users and Computers	Start > Programs > Administrative Tools > Active Directory Users and Computers.
   Windows Explorer	Start > Programs > Accessories > Windows Explorer Expand My Network Places. Expand Entire Network. Expand Directory.

2. Expand the domain in which your Oracle Context is located.

3. Go to your Oracle Context.

4. Right click the object that defines your net service name attributes.

   A menu appears with several options:

   
   
5. Make an appropriate selection:

   If You Want To...	Then...
   Test connectivity	Choose Test. Go to section "Testing Connectivity"
   Connect with SQL*Plus	Choose Connect with SQL*Plus. Go to section "Connecting With SQL*Plus"

Testing Connectivity

A status message appears describing the status of your connection attempt:

Connecting With SQL*Plus

The Oracle SQL*Plus Login dialog box appears:

1. Enter your user name and password.

   A status message appears describing the status of your connection attempt.

Managing Access Control Lists for Oracle Directory Objects

Access Control Lists provide Active Directory security by specifying:

• The user that can access the object attributes in the object

• Authentication method to access the entry

• Access rights, or what the user can do with the object (read/write) attributes in the object

Three security groups are automatically created when the Oracle Context is created in Active Directory. The user configuring access (and thus creating the Oracle Context) is automatically added to each:

Group	Description
OracleDBSecurityAdmin	Group for the creator of the Oracle Context. Users in this group can also: Manage the group membership for all three security groups Manage any object in the Oracle Context Use Oracle Enterprise Security Manager to create security domains
OracleDBCreator	Group for the creator of the Oracle8i database. Users in this group can: Modify the Oracle8i database objects that they create Read, but not modify, the membership for this group The domain administrator is automatically a member of this group. Note: The domain administrator can start Oracle Database Configuration Assistant and Net8 Assistant, but cannot use Oracle Enterprise Security Manager. You must be a member of the OracleDBSecurityAdmins group to use Oracle Enterprise Security Manager.
OracleNetAdmins	Users in this group can: Create and modify net service name objects Read the group membership of this group Modify the net service information in the database objects

Accessing the Security Groups

Active Directory Users and Computers enables you to add or remove users or change permission settings in the three security groups.

There are several tools available for adding or removing users:

If You Want to...	Use...
Add or remove users in OracleNetAdmins	Active Directory Users and Computers
Add or remove users in OracleDBSecurityAdmin or OracleDBCreator	Oracle Enterprise Security Manager or Active Directory Users and Computers

This section describes how to use Active Directory Users and Computers. See the Oracle Advanced Security Administrator's Guide for instructions on using Oracle Enterprise Security Manager.

Note: Use Active Directory Users and Computers to perform the procedures described in this section. Windows Explorer does not provide the functionality.

To add or remove users or change permission settings:

1. Choose Start > Programs > Administrative Tools > Active Directory Users and Computers.

2. Choose Advanced Features from the View main menu.

   This enables you to view and edit information that is normally hidden.

3. Expand the domain (administrative context) in which your Oracle Context is located.

4. Expand Users.

   The three security groups appear in the right window pane:

   
   
5. Right-click the Oracle security group that you want to view or modify.

   A menu appears with several options.

6. Choose Properties.

7. Make an appropriate selection:

   If You Want To...	Then...
   Add or remove users	Click the Members tab. Go to section "Adding or Removing Users".
   Change permissions	Click the Security tab. Go to section "Changing User Permissions".

Adding or Removing Users

To add or remove users:

1. Complete the access procedures in "Accessing the Security Groups".

   The Properties dialog box for the group you selected appears (in this example, OracleDBSecurityAdmins):

   
   
2. Make an appropriate selection:

   To...	Then...
   Add Users	Click Add. The Select Users, Contacts, Computers, or Groups dialog box appears. Select appropriate users or groups, and click Add. Your selections appear in the Select Users, Contacts, Computers, or Groups dialog box. Click OK.
   Remove Users	Select a user to remove. Click Remove. The user is removed. Click OK.

Changing User Permissions

To change user permissions:

1. Complete the access procedures in "Accessing the Security Groups".

   The Properties dialog box for the group you selected appears.

2. Click Advanced.

3. Click View/Edit.

   The Permission Entry dialog box for the security group you selected appears:

   
   
4. View or make appropriate changes to group permissions.

5. Click OK.

Creating Security Domains

A default security domain, OracleDefaultDomain, is created in your Oracle Context. If you do not want to use this domain or want to create another domain, use Oracle Enterprise Security Manager to create additional security domains (called enterprise domains). These domains are added under the OracleDBSecurity folder.