EUS and Grid Control next

Yesterday I explained how to get Enterprise User Security (EUS) and Grid Control (GC) to work together. This is without integrating GC with the Oracle Single Sign On Server that would also use the Oracle Internet Directory (OID) for storage of the user credentials.
When a EUS user is logged into GC and the administrator would want to administer a database automatically the preferred credential screen is displayed. The data in this screen is already filled in with the EUS information. The administrator should also be a EUS for that database and then transparently the DBA can administer the database.
This way using an ldap server like the OID and setting up EUS for a hundreds of databases dba's can in a simple way be added and removed from databases.

EUS and Grid Control

According to the Oracle documentation Enterprise User Security (EUS) works with Oracle Enterprise Manager Grid Control. The steps in the documentation: http://download.oracle.com/docs/cd/B16240_01/doc/em.102/e10954/security2.htm#i1036425.

The steps explained there are easy to follow and correct. The repository of the Grid Control (GC) is setup for EUS and works fine. But just for sqlplus sessions to the repository and one would want to login to the Grid Control console. That unfortunately didn't work. The authentication went ago, but the user didn't have the propers authorization. But even giving the EUS user the proper GC authorization didn't make it work:

SQL> grant MGMT_USER to EMGC_EUS;

Grant succeeded.

Login still din't work, see the picture.

The work around waqs to create a regular GC user thru the GC administration console. Then drop this user from the GC repository. That means the database user droppped, but the GC user is still defined. Then the EUS user can login to the GC console.

Single Sign On ?

You may ask is the previous entry Single Sign On between an OS and Oracle database. The answer is: "no". This is single account usage. Single Sign On between the OS and the database can be achieved using Kerberos authentication. We will discuss that in a later blog entry.
The advantage of this solution is that in one place the account with which a user enters the database or the OS is maintained.
This can make the solution more secure, because the user only has to remember one userid and password. The alternative would be userid's and passwords in all the machines used and in all the databases used. These would have password expiry policies. But these would only be enforced when a user would enter a machine or database. With different moments of accessing machines and database the risk would be that different passwords with then different expiry dates would be used. The maintaince of userdid and password would be made more complex and users would choose easier passwords or other kinds of workarounds.
With the single password for all the databases and all the machines it would be very simple to change the password for all those resources. This would make it easier for the user to accept that a password has to be more complex and changed in a regular interval.

Enterprise User Security (EUS)

The past weeks we have been working on Enterprise User Security. In this solution the Oracle database users are stored in the Oracle Internet Directory (OID) .
Together with the solution described in the previous blog entries in, which the Linux users are stored in the OID too, this makes the OID the central point of the user management.
So the databases as wel as the Linux user are refering to the same OID user.
More details in coming blogs.