7 Configuring Kerberos Authentication

7.1.1 Task 1: Install Kerberos

Install Kerberos on the system that functions as the authentication server.

7.1.2 Task 2: Configure a Service Principal for an Oracle Database Server

To enable the Oracle database server to validate the identity of clients that authenticate themselves using Kerberos, you must create a service principal for Oracle Database.

The name of the principal should have the following format:

kservice/kinstance@REALM

Each of the fields in the service principal specify the following values:

For example, suppose kservice is oracle, the fully qualified name of the system on which Oracle Database is running is dbserver.example.com and the realm is EXAMPLE.COM. The principal name then is:

oracle/dbserver.example.com@EXAMPLE.COM

It is a convention to use the DNS domain name as the name of the realm. To create the service principal, run kadmin.local. On UNIX, run this command as the root user, by using the following syntax:

# cd /kerberos-install-directory/sbin
# ./kadmin.local

To add a principal named oracle/dbserver.example.com@EXAMPLE.COM to the list of server principals known by Kerberos, enter the following:

kadmin.local:addprinc -randkey oracle/dbserver.example.com@EXAMPLE.COM

7.1.3 Task 3: Extract a Service Key Table from Kerberos

Extract the service key table from Kerberos and copy it to the Oracle database server/Kerberos client system.

For example, use the following steps to extract a service key table for dbserver.example.com:

1. Enter the following to extract the service key table:

   kadmin.local:  ktadd -k /tmp/keytab oracle/dbserver.example.com
   
   Entry for principal oracle/dbserver.example.com with kvno 2, encryption DES-CBC-CRC added to the keytab WRFILE: 'WRFILE:/tmp/keytab
   
   kadmin.local:  exit
   
   oklist -k -t /tmp/keytab
   

2. After the service key table has been extracted, verify that the new entries are in the table in addition to the old ones. If they are not, or you need to add more, use kadmin.local to append to them.

   If you do not enter a realm when using ktadd, it uses the default realm of the Kerberos server. kadmin.local is connected to the Kerberos server running on the localhost.

3. If the Kerberos service key table is on the same system as the Kerberos client, you can move it. If the service key table is on a different system from the Kerberos client, you must transfer the file with a program such as FTP. If using FTP, transfer the file in binary mode.

   The following example shows how to move the service key table on a UNIX platform:

   # mv /tmp/keytab /etc/v5srvtab
   

   The default name of the service file is /etc/v5srvtab.

4. Verify that the owner of the Oracle database server executable can read the service key table (/etc/v5srvtab in the previous example). To do so, set the file owner to the Oracle user, or make the file readable by the group to which Oracle belongs.

   Caution:

   Do not make the file readable to all users. This can cause a security breach.

7.1.4 Task 4: Install an Oracle Database Server and an Oracle Client

Install the Oracle database server and client software.

7.1.5 Task 5: Install Oracle Net Services and Oracle Advanced Security

Install Oracle Net Services and Oracle Advanced Security on the Oracle database server and Oracle client systems.

7.1.6 Task 6: Configure Oracle Net Services and Oracle Database

Configure Oracle Net Services on the Oracle database server and client.

7.1.7 Task 7: Configure Kerberos Authentication

Perform these tasks to set required parameters in the Oracle database server and client sqlnet.ora files:

• Step 1: Configure Kerberos on the Client and on the Database Server

• Step 2: Set the Initialization Parameters

• Step 3: Set sqlnet.ora Parameters (optional)

7.1.7.1 Step 1: Configure Kerberos on the Client and on the Database Server

Use Oracle Net Manager to perform the following steps to configure Kerberos authentication service parameters on the client and on the database server (Refer to, "Starting Oracle Net Manager"):

1. Navigate to the Oracle Advanced Security profile. ( Refer to "Navigating to the Oracle Advanced Security Profile") The Oracle Advanced Security window is displayed (Figure 7-1):

Figure 7-1 Oracle Advanced Security Authentication Window (Kerberos)

Description of "Figure 7-1 Oracle Advanced Security Authentication Window (Kerberos)"

2. Click the Authentication tab.

3. From the Available Methods list, select KERBEROS5.

4. Move KERBEROS5 to the Selected Methods list by clicking the right arrow (>).

5. Arrange the selected methods in order of use. To do this, select a method in the Selected Methods list, then click Promote or Demote to position it in the list. For example, if you want KERBEROS5 to be the first service used, move it to the top of the list.

6. Click the Other Params tab (Figure 7-2).

Figure 7-2 Oracle Advanced Security Other Params Window (Kerberos)

Description of "Figure 7-2 Oracle Advanced Security Other Params Window (Kerberos)"

1. From the Authentication Service list, select KERBEROS(V5).

2. Type Kerberos into the Service field. This field defines the name of the service Oracle Database uses to obtain a Kerberos service ticket. When you provide the value for this field, the other fields are enabled.

3. Optionally enter values for the following fields:

   • Credential Cache File

   • Configuration File

   • Realm Translation File

   • Key Table

   • Clock Skew

     See Also:

     Oracle Net Manager online Help, and "Step 3: Set sqlnet.ora Parameters (optional)", for more information about the fields and the parameters they configure

4. Select File, Save Network Configuration.

   The sqlnet.ora file is updated with the following entries:

   SQLNET.AUTHENTICATION_SERVICES=(KERBEROS5)
   SQLNET.AUTHENTICATION_KERBEROS5_SERVICE=kservice
   

OS_AUTHENT_PREFIX=""

SQLNET.KERBEROS5_CONF_MIT = TRUE

...
[libdefaults]
...
kdc_timesync = 1
ccache_type = 4

7.1.8 Task 8: Create a Kerberos User

To create Oracle users that Kerberos can authenticate, perform this task on the Kerberos authentication server where the administration tools are installed. The realm must already exist.

Run /krb5/admin/kadmin.local as root to create a new Kerberos user, such as krbuser.

The following example is UNIX-specific:

# ./kadmin.local
kadmin.local: addprinc krbuser
Enter password for principal: "krbuser@EXAMPLE.COM": (password does not display)
Re-enter password for principal: "krbuser@EXAMPLE.COM": (password does not display)
kadmin.local: exit

7.1.9 Task 9: Create an Externally Authenticated Oracle User

Run SQL*Plus on the Oracle database server to create the Oracle user that corresponds to the Kerberos user. In the following example, OS_AUTHENT_PREFIX is set to null (""). The Oracle user name is in uppercase enclosed in double quotation marks as shown in the following example:

SQL> CONNECT / AS SYSDBA;
SQL> CREATE USER "KRBUSER@EXAMPLE.COM" IDENTIFIED EXTERNALLY; 
SQL> GRANT CREATE SESSION TO "KRBUSER@EXAMPLE.COM"; 

If the user's Kerberos principal name is longer than 30 characters, and up to 1024 characters, then create the user as follows:

SQL> CREATE USER db_user_name IDENTIFIED EXTERNALLY AS 'kerberos_principal_name'

For example:

SQL> CREATE USER KRBUSER IDENTIFIED EXTERNALLY AS 'KerberosUser@EXAMPLE.COM';

7.1.10 Task 10: Get an Initial Ticket for the Kerberos/Oracle User

Before you can connect to the database, you must ask the Key Distribution Center (KDC) for an initial ticket. To do so, run the following on the client:

% okinit username

If, when making a database connection, a reference such as the following follows a database link, you must use the forwardable flag (-f) option:

sqlplus /@oracle

Executing okinit -f enables credentials that can be used across database links. Run the following commands on the Oracle client:

% okinit -f
Password for krbuser@EXAMPLE.COM:password

7.2.1 Obtaining the Initial Ticket with the okinit Utility

The okinit utility obtains and caches Kerberos tickets. This utility is typically used to obtain the ticket-granting ticket, using a password entered by the user to decrypt the credential from the key distribution center (KDC). The ticket-granting ticket is then stored in the user's credential cache.

The options available with okinit are listed in Table 7-1:

okinit -l 2wld6h20m30s

okinit -e 1 -e 16 krbuser@REALM

7.2.2 Displaying Credentials with the oklist Utility

Run the oklist utility to display the list of tickets held. Available oklist options are listed in Table 7-2:

The show flag option (-f) displays additional information, as shown in the following example:

% oklist -f
27-Jul-1999 21:57:51   28-Jul-1999 05:58:14
krbtgt/EXAMPLE.COM@EXAMPLE.COM
Flags: FI

7.2.3 Removing Credentials from the Cache File with the okdstry Utility

Use the okdstry utility to remove credentials from the credentials cache file:

$ okdstry -f

where the -f command option lets you specify an alternative credential cache. For UNIX, the default is /tmp/krb5cc_uid. You can also specify the alternate credential cache by using the SQLNET.KRB5_CC_NAME parameter in the sqlnet.ora file.

7.2.4 Connecting to an Oracle Database Server Authenticated by Kerberos

You can now connect to an Oracle database server without using a user name or password. Enter a command similar to the following:

$ sqlplus /@net_service_name

where net_service_name is an Oracle Net Services service name. For example:

$ sqlplus /@oracle_dbname

7.3.1 Task 1: Configure an Oracle Kerberos Client to Interoperate with a Windows 2000 Domain Controller KDC

The following steps must be performed on the Oracle Kerberos client.

kdc=sales3854.us.example.com:88
}

[domain_realm]
.us.example.com=SALES.US.EXAMPLE.COM

SQLNET.KERBEROS5_CONF=pathname_to_Kerberos_configuration_file
SQLNET.KERBEROS5_CONF_MIT=TRUE
SQLNET.AUTHENTICATION_KERBEROS5_SERVICE=Kerberos_service_name
SQLNET.AUTHENTICATION_SERVICES=(BEQ,KERBEROS5)

7.3.2 Task 2: Configure a Windows 2000 Domain Controller KDC to Interoperate with an Oracle Client

The following steps must be performed on the Windows 2000 domain controller.

7.3.3 Task 3: Configure an Oracle Database to Interoperate with a Windows 2000 Domain Controller KDC

The following steps must be performed on the host computer where the Oracle database is installed.

SQLNET.KERBEROS5_CONF=pathname_to_Kerberos_configuration_file
SQLNET.KERBEROS5_KEYTAB=pathname_to_Kerberos_principal/key_table
SQLNET.KERBEROS5_CONF_MIT=TRUE
SQLNET.AUTHENTICATION_KERBEROS5_SERVICE=Kerberos_service_name
SQLNET.AUTHENTICATION_SERVICES=(BEQ,KERBEROS5)

7.3.4 Task 4: Obtain an Initial Ticket for the Kerberos/Oracle User

Before a client can connect to the database, the client must request an initial ticket. To request an initial ticket, follow the task information for "Task 10: Get an Initial Ticket for the Kerberos/Oracle User".