You use authentication to prove the identities of users who are attempting to log into the database.

Authenticating user identity is imperative in distributed environments, without which there can be little confidence in network security. Passwords are the most common means of authentication. Oracle Database enables strong authentication with Oracle authentication adapters that support various third-party authentication services, including SSL with digital certificates.

Figure 18-1 shows user authentication with an Oracle database instance configured to use a third-party authentication server. Having a central facility to authenticate all members of the network (clients to servers, servers to servers, users to both clients and servers) is one effective way to address the threat of network nodes falsifying their identities.

Figure 18-1 Strong Authentication with Oracle Authentication Adapters

Description of "Figure 18-1 Strong Authentication with Oracle Authentication Adapters"

Single sign-on enables users to access multiple accounts and applications with a single password.

Centralized authentication also provides the benefit of single sign-on (SSO) for users.

In single sign-on, a user only needs to login once and can then automatically connect to any other service without having to give the user name and password again. Single sign-on eliminates the need for the user to remember and administer multiple passwords, reducing the time spent logging into multiple services.

A centralized network authentication system works with an Oracle server, an authentication server, and users who connect to the Oracle server.

Figure 18-2 shows how a centralized network authentication service typically operates.

Figure 18-2 How a Network Authentication Service Authenticates a User

Description of "Figure 18-2 How a Network Authentication Service Authenticates a User"

The following steps describe how centralized Network Authentication Process works.

1. A user (client) requests authentication services and provides identifying information, such as a token or password.

2. The authentication server validates the user's identity and passes a ticket or credentials back to the client, which may include an expiration time.

3. The client passes these credentials to the Oracle server concurrent with a service request, such as connection to a database.

4. The server sends the credentials back to the authentication server for authentication.

5. The authentication server checks the credentials and notifies the Oracle server.

6. If the credentials were accepted by the authentication server, then the Oracle server authenticates the user. If the authentication server rejected the credentials, then authentication fails, and the service request is denied.

Oracle Database supports industry-standard authentication methods.

• About Kerberos
  Oracle Database support for Kerberos provides the benefits of single sign-on and centralized authentication of Oracle users.
• About Remote Authentication Dial-In User Service (RADIUS)
  RADIUS is a client/server security protocol that is most widely known for enabling remote authentication and access.
• About Secure Sockets Layer
  Secure Sockets Layer (SSL) is an industry standard protocol for securing network connections.

The Oracle Database native network encryption and strong authentication architecture complements an Oracle database server or client installations.

Figure 18-3 shows the this architecture within an Oracle networking environment.

Figure 18-3 Oracle Native Network Encryption and Strong Authentication Architecture

Description of "Figure 18-3 Oracle Native Network Encryption and Strong Authentication Architecture"

Oracle Database supports authentication through adapters that are similar to the existing Oracle protocol adapters. As shown in Figure 18-4, authentication adapters integrate the Oracle Net interface, and allow existing applications to take advantage of new authentication systems transparently, without any changes to the application.

Figure 18-4 Oracle Net Services with Authentication Adapters

Description of "Figure 18-4 Oracle Net Services with Authentication Adapters"

Kerberos, RADIUS, and Secure Sockets Layer (SSL) have a set of system requirements for strong authentication.

Oracle applications support Oracle Database native network encryption and strong authentication.

However, because Oracle Database native network encryption and strong authentication requires Oracle Net Services to transmit data securely, these external authentication features are not supported by some parts of Oracle Financial, Human Resource, and Manufacturing Applications when they are running on Microsoft Windows.

The portions of these products that use Oracle Display Manager (ODM) do not take advantage of Oracle Database native network encryption and strong authentication, because ODM does not use Oracle Net Services.