18 Introduction to Strong Authentication

Strong authentication supports tools such as Secure Sockets Layer (SSL) to verify the identities of users who log in to the database.

18.1 What Is Strong Authentication?

You use authentication to prove the identities of users who are attempting to log into the database.

Authenticating user identity is imperative in distributed environments, without which there can be little confidence in network security. Passwords are the most common means of authentication. Oracle Database enables strong authentication with Oracle authentication adapters that support various third-party authentication services, including SSL with digital certificates.

Figure 18-1 shows user authentication with an Oracle database instance configured to use a third-party authentication server. Having a central facility to authenticate all members of the network (clients to servers, servers to servers, users to both clients and servers) is one effective way to address the threat of network nodes falsifying their identities.

Figure 18-1 Strong Authentication with Oracle Authentication Adapters

Description of Figure 18-1 follows
Description of "Figure 18-1 Strong Authentication with Oracle Authentication Adapters"

18.2 Centralized Authentication and Single Sign-On

Single sign-on enables users to access multiple accounts and applications with a single password.

Centralized authentication also provides the benefit of single sign-on (SSO) for users.

In single sign-on, a user only needs to login once and can then automatically connect to any other service without having to give the user name and password again. Single sign-on eliminates the need for the user to remember and administer multiple passwords, reducing the time spent logging into multiple services.

18.3 How Centralized Network Authentication Works

A centralized network authentication system works with an Oracle server, an authentication server, and users who connect to the Oracle server.

Figure 18-2 shows how a centralized network authentication service typically operates.

Figure 18-2 How a Network Authentication Service Authenticates a User

Description of Figure 18-2 follows
Description of "Figure 18-2 How a Network Authentication Service Authenticates a User"

The following steps describe how centralized Network Authentication Process works.

  1. A user (client) requests authentication services and provides identifying information, such as a token or password.

  2. The authentication server validates the user's identity and passes a ticket or credentials back to the client, which may include an expiration time.

  3. The client passes these credentials to the Oracle server concurrent with a service request, such as connection to a database.

  4. The server sends the credentials back to the authentication server for authentication.

  5. The authentication server checks the credentials and notifies the Oracle server.

  6. If the credentials were accepted by the authentication server, then the Oracle server authenticates the user. If the authentication server rejected the credentials, then authentication fails, and the service request is denied.

18.4 Supported Strong Authentication Methods

Oracle Database supports industry-standard authentication methods.

18.4.1 About Kerberos

Oracle Database support for Kerberos provides the benefits of single sign-on and centralized authentication of Oracle users.

Kerberos is a trusted third-party authentication system that relies on shared secrets. It presumes that the third party is secure, and provides single sign-on capabilities, centralized password storage, database link authentication, and enhanced PC security. It does this through a Kerberos authentication server. Refer to Configuring Kerberos Authentication for information about configuring and using this adapter.

Note:

Oracle authentication for Kerberos provides database link authentication (also called proxy authentication). Kerberos is also an authentication method that is supported with Enterprise User Security.

18.4.2 About Remote Authentication Dial-In User Service (RADIUS)

RADIUS is a client/server security protocol that is most widely known for enabling remote authentication and access.

Oracle Database uses this standard in a client/server network environment to enable use of any authentication method that supports the RADIUS protocol. RADIUS can be used with a variety of authentication mechanisms, including token cards and smart cards.

  • Smart Cards. A RADIUS-compliant smart card is a credit card-like hardware device which has memory and a processor. It is read by a smart card reader located at the client workstation.

  • Token Cards. Token cards (Secure ID or RADIUS-compliant) can improve ease of use through several different mechanisms. Some token cards dynamically display one-time passwords that are synchronized with an authentication service. The server can verify the password provided by the token card at any given time by contacting the authentication service. Other token cards have a keypad and operate on a challenge-response basis. In this case, the server offers a challenge (a number) that the user enters into a token card. The token card provides a response (another number cryptographically derived from the challenge) that the user enters and sends to the server.

    You can use SecurID tokens through the RADIUS adapter.

18.4.3 About Secure Sockets Layer

Secure Sockets Layer (SSL) is an industry standard protocol for securing network connections.

SSL provides authentication, data encryption, and data integrity.

The SSL protocol is the foundation of a public key infrastructure (PKI). For authentication, SSL uses digital certificates that comply with the X.509v3 standard and a public and private key pair.

Oracle Database SSL can be used to secure communications between any client and any server. You can configure SSL to provide authentication for the server only, the client only, or both client and server. You can also configure SSL features in combination with other authentication methods supported by Oracle Database (database user names and passwords, RADIUS, and Kerberos).

To support your PKI implementation, Oracle Database includes the following features in addition to SSL:

  • Oracle wallets, where you can store PKI credentials

  • Oracle Wallet Manager, which you can use to manage your Oracle wallets

  • Certificate validation with certificate revocation lists (CRLs)

  • Hardware security module support

18.5 Oracle Database Native Network Encryption/Strong Authentication Architecture

The Oracle Database native network encryption and strong authentication architecture complements an Oracle database server or client installations.

Figure 18-3 shows the this architecture within an Oracle networking environment.

Figure 18-3 Oracle Native Network Encryption and Strong Authentication Architecture

Description of Figure 18-3 follows
Description of "Figure 18-3 Oracle Native Network Encryption and Strong Authentication Architecture"

Oracle Database supports authentication through adapters that are similar to the existing Oracle protocol adapters. As shown in Figure 18-4, authentication adapters integrate the Oracle Net interface, and allow existing applications to take advantage of new authentication systems transparently, without any changes to the application.

Figure 18-4 Oracle Net Services with Authentication Adapters

Description of Figure 18-4 follows
Description of "Figure 18-4 Oracle Net Services with Authentication Adapters"

See Also:

Oracle Database Net Services Administrator's Guide for more information about stack communications in an Oracle networking environment

18.6 System Requirements for Strong Authentication

Kerberos, RADIUS, and Secure Sockets Layer (SSL) have a set of system requirements for strong authentication.

Table 18-1 lists the SSL system requirements for strong authentication.

Table 18-1 Authentication Methods and System Requirements

Authentication Method System Requirements

Kerberos

  • MIT Kerberos Version 5, release 1.8 or above.

  • The Kerberos authentication server must be installed on a physically secure system.

RADIUS

  • A RADIUS server that is compliant with the standards in the Internet Engineering Task Force (IETF) RFC #2138, Remote Authentication Dial In User Service (RADIUS) and RFC #2139 RADIUS Accounting.

  • To enable challenge-response authentication, you must run RADIUS on an operating system that supports the Java Native Interface as specified in release 1.1 of the Java Development Kit from JavaSoft.

SSL

  • A wallet that is compatible with the Oracle Wallet Manager 10g release. Wallets created in earlier releases of the Oracle Wallet Manager are not forward compatible.

18.7 Oracle Database Native Network Encryption and Strong Authentication Restrictions

Oracle applications support Oracle Database native network encryption and strong authentication.

However, because Oracle Database native network encryption and strong authentication requires Oracle Net Services to transmit data securely, these external authentication features are not supported by some parts of Oracle Financial, Human Resource, and Manufacturing Applications when they are running on Microsoft Windows.

The portions of these products that use Oracle Display Manager (ODM) do not take advantage of Oracle Database native network encryption and strong authentication, because ODM does not use Oracle Net Services.