This is a beautifull acroniem heavy heading. We are combining Enterprise User Security, e.g. Database users from an ldap directory with Oracle Authentication for Operating System, e.g. Operating System users from an ldap server.
An OS session where sqlplus is used looks as follows:
login as: HeemskerkACW
mailto:HeemskerkACW@linuxmachine1 password:
Last login: Wed Oct 1 15:15:59 2008 from 10.100.1.172
aliases: DB1
HeemskerkACW@linuxmachine1::/home/HeemskerkACW
$ DB1
HeemskerkACW@linuxmachine1:DB1:/home/HeemskerkACW
$ sqlplus HeemskerkACW@DB1
SQL*Plus: Release 10.2.0.3.0 - Production on Wed Oct 1 15:18:27 2008
Copyright (c) 1982, 2006, Oracle. All Rights Reserved.
Enter password: ********
Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.3.0 - 64bit Production
With the Partitioning, Real Application Clusters, OLAP and Data Mining options
SQL> show user
USER is "SHARED_SCHEMA_USER"
SELECT
SYS_CONTEXT('USERENV','EXTERNAL_NAME')
,SYS_CONTEXT('SYS_LDAP_USER_DEFAULT','mail')
,SYS_CONTEXT('SYS_LDAP_USER_DEFAULT','telephoneNumber')
,SYS_CONTEXT('SYS_LDAP_USER_DEFAULT','uid')
FROM DUAL
7 /
SYS_CONTEXT('USERENV','EXTERNA
--------------------------------------------------------------------------------
SYS_CONTEXT('SYS_LDAP_USER_DEF
--------------------------------------------------------------------------------
SYS_CONTEXT('SYS_LDAP_USER_DEF
--------------------------------------------------------------------------------
SYS_CONTEXT('SYS_LDAP_USER_DEF
--------------------------------------------------------------------------------
cn=heemskerk\, acw (xander),cn=users,dc=nl,dc=oracle,dc=nl
xheemske@googlemail.nl
+31 30 6698443
HeemskerkACW
SQL>
As can be seen the same userid is used for both the OS as the database session. What can't be seen but you can take on "my blog entry" is that the same password is used.
The userid and the password came from the Oracle Internet Directory ldap server.
How to set this up will be in a next blog.
Showing posts with label Oracle Enterprise Linux. Show all posts
Showing posts with label Oracle Enterprise Linux. Show all posts
Wednesday, 1 October 2008
Tuesday, 8 July 2008
Wrong password ?
Implementing the Oracle Authentication for Operating System (OAfOS) for a certain Oracle Enterprise Linux (OEL) server we got a Access Denied error when we tried to login the server using the credentials from the Oracle Internet Directory (OID) ldap server. When we looked in the /var/log/secure messages file we saw the error
sshd[22791]: Failed password for invalid user xander
This even though the same account xander worked fine for other OEL servers.
When we used the su xander from the root account on the OEL server we were able to create the directory:
It turned out that this specific machine had an extra access policy in the /etc/security/access.conf file. This policy only let users access the machine through SSH when they were member of a group.
When we added the same group to the OID and added the username to the group, the password error was gone and we were able login using SSH
sshd[22791]: Failed password for invalid user xander
This even though the same account xander worked fine for other OEL servers.
When we used the su xander from the root account on the OEL server we were able to create the directory:
$ su xander
Creating directory '/home/xander'.
Creating directory '/home/xander/.kde'.
Creating directory '/home/xander/.kde/Autostart'.
It turned out that this specific machine had an extra access policy in the /etc/security/access.conf file. This policy only let users access the machine through SSH when they were member of a group.
When we added the same group to the OID and added the username to the group, the password error was gone and we were able login using SSH
Tuesday, 1 July 2008
High Available setup of Oracle Authentication Services for Operating Systems
Oracle Authentication Services for Operating Systems (OASfOS) is the way to use the Oracle Internet Directory (OID) LDAP server for user management of the users on a Unix or Linux system.
This works fine and is explained in the manuals that come with the download from Oracle Technology Network: http://www.oracle.com/technology/products/oid/oracleauthenticationservices.html
But the scripts that come with this OASfOS download assume that a single instance OID ldap server is used. The script that should be run on the OID server get the host name of that server and creates the script that should be run on the Linux or Unix servers that will be using the OID as there user base.
But the strength of the OID is that it can be setup with a cluster database in the back-end. Using a hardware load balancer in from of the OID processes can mitigate against all kinds of hardware and software failures. The hardware load balancer will be setup with a Virtual DNS name which will direct the ldap requests to either of the OID processes in the cluster. The back-end of the OID processes a Real Application Cluster (RAC) database is used.
The procedure for setting up OASfOS in a cluster is slightly different from setting it up for a single instance.
The server script is that run on the first instance should be adjusted. Instead of getting the hostname of the machine on which this OID is running, it should use the LDAP Virtual Address that is used in the load balancer.
That adjusted script will create a client script that will the use the virtual address of the load balancer instead of one of the host addresses.
In the following text the bit that is changed in the server script is shown in red:
if [ "X$dmName" = "X(none)" -o "X$dmName" = "X" ]
then
dmName=""
# rootDN="cn=`hostname`,${realm}"
# hostName="`hostname`"
rootDN="cn=oid-virtualaddress.nl.oracle.com,${realm}"
hostName="oid-virtualaddress.nl.oracle.com"
else
# rootDN="cn=`hostname`.${dmName},${realm}"
# hostName="`hostname`.${dmName}"
rootDN="cn=oid-virtualaddress.nl.oracle.com,${realm}"
hostName="oid-virtualaddress.nl.oracle.com"
fi
On the other instance the only change that is made is that the Wallet for SSL traffic that is created on the first instance is copied to the same place on the second instance. The same instructions as described in the documentation for changing the standard certificate can be used.
The server script should not be run on the second instance, since it also changes the contents of the OID, but since RAC is used that is already changed when the script is run on the first instance.
This works fine and is explained in the manuals that come with the download from Oracle Technology Network: http://www.oracle.com/technology/products/oid/oracleauthenticationservices.html
But the scripts that come with this OASfOS download assume that a single instance OID ldap server is used. The script that should be run on the OID server get the host name of that server and creates the script that should be run on the Linux or Unix servers that will be using the OID as there user base.
But the strength of the OID is that it can be setup with a cluster database in the back-end. Using a hardware load balancer in from of the OID processes can mitigate against all kinds of hardware and software failures. The hardware load balancer will be setup with a Virtual DNS name which will direct the ldap requests to either of the OID processes in the cluster. The back-end of the OID processes a Real Application Cluster (RAC) database is used.
The procedure for setting up OASfOS in a cluster is slightly different from setting it up for a single instance.
The server script is that run on the first instance should be adjusted. Instead of getting the hostname of the machine on which this OID is running, it should use the LDAP Virtual Address that is used in the load balancer.
That adjusted script will create a client script that will the use the virtual address of the load balancer instead of one of the host addresses.
In the following text the bit that is changed in the server script is shown in red:
if [ "X$dmName" = "X(none)" -o "X$dmName" = "X" ]
then
dmName=""
# rootDN="cn=`hostname`,${realm}"
# hostName="`hostname`"
rootDN="cn=oid-virtualaddress.nl.oracle.com,${realm}"
hostName="oid-virtualaddress.nl.oracle.com"
else
# rootDN="cn=`hostname`.${dmName},${realm}"
# hostName="`hostname`.${dmName}"
rootDN="cn=oid-virtualaddress.nl.oracle.com,${realm}"
hostName="oid-virtualaddress.nl.oracle.com"
fi
On the other instance the only change that is made is that the Wallet for SSL traffic that is created on the first instance is copied to the same place on the second instance. The same instructions as described in the documentation for changing the standard certificate can be used.
The server script should not be run on the second instance, since it also changes the contents of the OID, but since RAC is used that is already changed when the script is run on the first instance.
Subscribe to:
Posts (Atom)