6 Configuring RADIUS Authentication

6.2.1 Synchronous Authentication Mode

In the synchronous mode, RADIUS lets you use various authentication methods, including passwords and SecurID token cards. Figure 6-2 shows the sequence in which synchronous authentication occurs:

Figure 6-2 Synchronous Authentication Sequence

Description of "Figure 6-2 Synchronous Authentication Sequence"

Following steps describe the Synchronous Authentication Sequence:

1. A user logs in by entering a connect string, pass code, or other value. The client system passes this data to the Oracle database server.

2. The Oracle database server, acting as the RADIUS client, passes the data from the Oracle client to the RADIUS server.

3. The RADIUS server passes the data to the appropriate authentication server, such as Smart Card or SecurID ACE for validation.

4. The authentication server sends either an Access Accept or an Access Reject message back to the RADIUS server.

5. The RADIUS server passes this response to the Oracle database server/RADIUS client.

6. The Oracle database server/RADIUS client passes the response back to the Oracle client.

Example: Synchronous Authentication with SecurID Token Cards

With SecurID authentication, each user has a token card that displays a dynamic number that changes every sixty seconds. To gain access to the Oracle database server/RADIUS client, the user enters a valid pass code that includes both a personal identification number (PIN) and the dynamic number currently displayed on the user's SecurID card. The Oracle database server passes this authentication information from the Oracle client to the RADIUS server, which in this case is the authentication server for validation. Once the authentication server (RSA ACE/Server) validates the user, it sends an accept packet to the Oracle database server, which, in turn, passes it to the Oracle client. The user is now authenticated and able to access the appropriate tables and applications.

6.2.2 Challenge-Response (Asynchronous) Authentication Mode

When the system uses the asynchronous mode, the user does not need to enter a user name and password at the SQL*Plus CONNECT string. Instead, a graphical user interface asks the user for this information later in the process.

Figure 6-3 shows the sequence in which challenge-response (asynchronous) authentication occurs.

Figure 6-3 Asynchronous Authentication Sequence

Description of "Figure 6-3 Asynchronous Authentication Sequence"

Following steps describe the Asynchronous Authentication Sequence:

1. A user seeks a connection to an Oracle database server. The client system passes the data to the Oracle database server.

2. The Oracle database server, acting as the RADIUS client, passes the data from the Oracle client to the RADIUS server.

3. The RADIUS server passes the data to the appropriate authentication server, such as a Smart Card, SecurID ACE, or token card server.

4. The authentication server sends a challenge, such as a random number, to the RADIUS server.

5. The RADIUS server passes the challenge to the Oracle database server/RADIUS client.

6. The Oracle database server/RADIUS client, in turn, passes it to the Oracle client. A graphical user interface presents the challenge to the user.

7. The user provides a response to the challenge. To formulate a response, the user can, for example, enter the received challenge into the token card. The token card provides a dynamic password that is entered into the graphical user interface. The Oracle client passes the user's response to the Oracle database server/RADIUS client.

8. The Oracle database server/RADIUS client sends the user's response to the RADIUS server.

9. The RADIUS server passes the user's response to the appropriate authentication server for validation.

10. The authentication server sends either an Access Accept or an Access Reject message back to the RADIUS server.

11. The RADIUS server passes the response to the Oracle database server/RADIUS client.

12. The Oracle database server/RADIUS client passes the response to the Oracle client.

Example: Asynchronous Authentication with Smart Cards

With smart card authentication, the user logs in by inserting the smart card, a plastic card (like a credit card) with an embedded integrated circuit for storing information into a hardware device which reads the card. The Oracle client sends the login information contained in the smart card to the authentication server by way of the Oracle database server/RADIUS client and the RADIUS server. The authentication server sends back a challenge to the Oracle client, by way of the RADIUS server and the Oracle database server, prompting the user for authentication information. The information could be, for example, a PIN as well as additional authentication information contained on the smart card.

The Oracle client sends the user's response to the authentication server by way of the Oracle database server and the RADIUS server. If the user has entered a valid number, the authentication server sends an accept packet back to the Oracle client by way of the RADIUS server and the Oracle database server. The user is now authenticated and authorized to access the appropriate tables and applications. If the user has entered incorrect information, the authentication server sends back a message rejecting user's access.

Example: Asynchronous Authentication with ActivCard Tokens

One particular ActivCard token is a hand-held device with a keypad and which displays a dynamic password. When the user seeks access to an Oracle database server by entering a password, the information is passed to the appropriate authentication server by way of the Oracle database server/RADIUS client and the RADIUS server. The authentication server sends back a challenge to the client, by way of the RADIUS server and the Oracle database server. The user types that challenge into the token, and the token displays a number for the user to send in response.

The Oracle client then sends the user's response to the authentication server by way of the Oracle database server and the RADIUS server. If the user has typed a valid number, the authentication server sends an accept packet back to the Oracle client by way of the RADIUS server and the Oracle database server. The user is now authenticated and authorized to access the appropriate tables and applications. If the user has entered an incorrect response, the authentication server sends back a message rejecting the user's access.

6.3.1 Task 1: Install RADIUS on the Oracle Database Server and on the Oracle Client

RADIUS is installed with Oracle Advanced Security during a typical installation of Oracle Database.

6.3.2 Task 2: Configure RADIUS Authentication

This task includes the following steps:

• Step 1: Configure RADIUS on the Oracle Client

• Step 2: Configure RADIUS on the Oracle Database Server

• Step 3: Configure Additional RADIUS Features

Unless otherwise indicated, perform these configuration tasks by using Oracle Net Manager or by using any text editor to modify the sqlnet.ora file.

6.3.2.1 Step 1: Configure RADIUS on the Oracle Client

Use Oracle Net Manager to configure RADIUS on the Oracle client (See "Starting Oracle Net Manager"):

1. Navigate to the Oracle Advanced Security profile (For details, refer to "Navigating to the Oracle Advanced Security Profile") The Oracle Advanced Security tabbed window is displayed (Figure 6-4):

Figure 6-4 Oracle Advanced Security Authentication Window

Description of "Figure 6-4 Oracle Advanced Security Authentication Window"

1. Click the Authentication tab.

2. From the Available Methods list, select RADIUS.

3. Select the right-arrow (>) to move RADIUS to the Selected Methods list. Move any other methods you want to use in the same way.

4. Arrange the selected methods in order of required usage by selecting a method in the Selected Methods list, and clicking Promote or Demote to position it in the list. For example, put RADIUS at the top of the list for it to be the first service used.

5. Select File, Save Network Configuration.

   The sqlnet.ora file is updated with the following entry:

   SQLNET.AUTHENTICATION_SERVICES=(RADIUS)
   

6.3.2.2 Step 2: Configure RADIUS on the Oracle Database Server

Following are the steps to configure RADIUS:

• Create the RADIUS Secret Key File on the Oracle Database Server

• Configure RADIUS Parameters on the Server (sqlnet.ora file)

• Set Oracle Database Server Initialization Parameters

Create the RADIUS Secret Key File on the Oracle Database Server

Following are the steps to create Oracle Database Server:

1. Obtain the RADIUS secret key from the RADIUS server. For each RADIUS client, the administrator of the RADIUS server creates a shared secret key, which must be longer than 16-characters.

2. On the Oracle database server, create a directory:

   • (UNIX) $ORACLE_HOME/network/security

   • (Windows) ORACLE_BASE\ORACLE_HOME\network\security

3. Create the file radius.key to hold the shared secret copied from the RADIUS server. Place the file in the directory you created in Step 2.

4. Copy the shared secret key and paste it (and nothing else) into the radius.key file created on the Oracle database server.

5. For security purposes, change the file permission of radius.key to read only, accessible only by the Oracle owner. Oracle relies on the file system to keep this file secret.

   See Also:

   The RADIUS server administration documentation, for information about obtaining the secret key

Configure RADIUS Parameters on the Server (sqlnet.ora file)

Use Oracle Net Manager to configure RADIUS parameters on the server (Refer to "Starting Oracle Net Manager"):

1. Navigate to the Oracle Advanced Security profile. (Refer to "Navigating to the Oracle Advanced Security Profile") The Oracle Advanced Security tabbed window is displayed. (Figure 6-4).

2. Click the Authentication tab.

3. From the Available Methods list, select RADIUS.

4. Move RADIUS to the Selected Methods list by choosing the right-arrow (>).

5. To arrange the selected methods in order of desired use, select a method in the Selected Methods list, and select Promote or Demote to position it in the list. For example, if you want RADIUS to be the first service used, put it at the top of the list.

6. Click Other Params as shown in (Figure 6-5):

Figure 6-5 Oracle Advanced Security Other Params Window

Description of "Figure 6-5 Oracle Advanced Security Other Params Window"

1. From the Authentication Service list, select RADIUS.

2. In the Host Name field, accept the localhost as the default primary RADIUS server, or enter another host name.

3. Ensure that the default value of the Secret File field is valid.

4. Select File, Save Network Configuration.

   The sqlnet.ora file is updated with the following entries:

   SQLNET.AUTHENTICATION_SERVICES=RADIUS
   SQLNET.RADIUS_AUTHENTICATION=RADIUS_server_{hostname|IP_address}
   

Set Oracle Database Server Initialization Parameters

Configure the initialization parameter file, located in

• (UNIX) $ORACLE_HOME/admin/db_name/pfile

• (Windows) ORACLE_BASE\ORACLE_HOME\admin\db_name\pfile

with the following values:

REMOTE_OS_AUTHENT=FALSE
OS_AUTHENT_PREFIX=""

Caution:

Setting REMOTE_OS_AUTHENT to TRUE can enable a security breach because it lets someone using a non-secure protocol, such as TCP, perform an operating system-authorized login (formerly called an OPS$ login).

Note:

In addition to setting the REMOTE_OS_AUTHENT initialization parameter file to FALSE, you should issue the startup command with a PFILE option. This ensures that the parameters from your initSID.ora are used.

See Also:

Oracle Database Reference and the Oracle Database Administrator's Guide for information about setting initialization parameters on an Oracle Database server

SQLNET.RADIUS_ALTERNATE=(hostname or ip address of alternate radius server)
SQLNET.RADIUS_ALTERNATE_PORT=(1812)
SQLNET.RADIUS_ALTERNATE_TIMEOUT=(number of seconds to wait for response)
SQLNET.RADIUS_ALTERNATE_RETRIES=(number of times to re-send to radius server)

6.3.3 Task 3: Create a User and Grant Access

To grant user access:

1. Launch SQL*Plus and execute these commands to create and grant access to a user identified externally on the Oracle database server.

   SQL> CONNECT system/manager@database_name;
   SQL> CREATE USER username IDENTIFIED EXTERNALLY;
   SQL> GRANT CREATE SESSION TO USER username;
   SQL> EXIT
   

   If you are using Windows, you can use the Security Manager tool in the Oracle Enterprise Manager.

   See Also:

   • Oracle Database Administrator's Guide

   • Oracle Database Heterogeneous Connectivity Administrator's Guide

2. Enter the same user in the RADIUS server's users file.

   See Also:

   Administration documentation for the RADIUS server

6.3.4 Task 4: Configure External RADIUS Authorization (optional)

If you require external RADIUS authorization for RADIUS users who connect to an Oracle database, then you must perform the following steps to configure the Oracle server, the Oracle client, and the RADIUS server:

To configure the Oracle server (RADIUS client):

Following steps describes how to configure Oracle Server (RADIUS Client):

1. Add the OS_ROLE parameter to the init.ora file and set this parameter to TRUE as follows:

   OS_ROLE=TRUE
   

   Then restart the database so the system can read the change to the init.ora file.

2. Set the RADIUS challenge-response mode to ON for the server if you have not already done so by following the steps listed in "Configure Challenge-Response".

3. Add externally identified users and roles.

To configure the Oracle client (where users log in):

Set the RADIUS challenge-response mode to ON for the client if you have not already done so by following the steps listed in "Configure Challenge-Response".

To configure the RADIUS server:

Following steps describe how to configure the RADIUS Server:

1. Add the following attributes to the RADIUS server attribute configuration file:

   ATTRIBUTE NAME	CODE	TYPE
   VENDOR_SPECIFIC	26	Integer
   ORACLE_ROLE	1	String

   
   

2. Assign a Vendor ID for Oracle in the RADIUS server attribute configuration file that includes the SMI Network Management Private Enterprise Code of 111.

   For example, enter the following in the RADIUS server attribute configuration file:

   VALUE     VENDOR_SPECIFIC     ORACLE     111

3. Using the following syntax, add the ORACLE_ROLE attribute to the user profile of the users who will use external RADIUS authorization:

   ORA_databaseSID_rolename[_[A]|[D]]

   where:

   • ORA designates that this role is used for Oracle purposes

   • databaseSID is the Oracle system identifier that is configured in the database server's init.ora file

   • rolename is the name of role as it is defined in the data dictionary. For example, SYSDBA

   • A is an optional character that indicates the user has administrator's privileges for this role

   • D is an optional character that indicates this role is to be enabled by default

   Ensure that RADIUS groups which map to Oracle roles adhere to the ORACLE_ROLE syntax.

   For example:

   USERNAME     USERPASSWD="user_password",
                SERVICE_TYPE=login_user,
                VENDOR_SPECIFIC=ORACLE,
                ORACLE_ROLE=ORA_ora920_sysdba
   

   See Also:

   The RADIUS server administration documentation for information about configuring the server.

6.3.5 Task 5: Configure RADIUS Accounting

RADIUS accounting logs information about access to the Oracle database server and stores it in a file on the RADIUS accounting server. Use this feature only if both the RADIUS server and authentication server support it.

6.3.6 Task 6: Add the RADIUS Client Name to the RADIUS Server Database

You can use virtually any RADIUS server that complies with the standards in the Internet Engineering Task Force (IETF) RFC #2138, Remote Authentication Dial In User Service (RADIUS) and RFC #2139 RADIUS Accounting. Because RADIUS servers vary, consult the documentation for your particular RADIUS server for any unique interoperability requirements.

Perform the following steps to add the RADIUS client name to a Livingston RADIUS server:

1. Open the clients file, which can be found at /etc/raddb/clients. The following text and table appear:

   @ (#) clients 1.1 2/21/96 Copyright 1991 Livingston Enterprises Inc
   This file contains a list of clients which are allowed to make authentication requests and their encryption key. The first field is a valid hostname. The second field (separated by blanks or tabs) is the encryption key.
   Client Name                     Key
   

2. In the CLIENT NAME column, enter the host name or IP address of the host on which the Oracle database server is running. In the KEY column, type the shared secret.

   The value you enter in the CLIENT NAME column, whether it is the client's name or IP address, depends on the RADIUS server.

3. Save and close the clients file.

   See Also:

   Administration documentation for the RADIUS server

6.3.7 Task 7: Configure the Authentication Server for Use with RADIUS

Refer to the authentication server documentation for instructions about configuring the authentication servers.

6.3.8 Task 8: Configure the RADIUS Server for Use with the Authentication Server

Refer to the RADIUS server documentation.

6.3.9 Task 9: Configure Mapping Roles

If the RADIUS server supports vendor type attributes, you can manage roles by storing them in the RADIUS server. The Oracle database server downloads the roles when there is a CONNECT request using RADIUS.

To use this feature, configure roles on both the Oracle database server and the RADIUS server.

Perform these steps to configure roles on the Oracle database server:

1. Use a text editor to set the OS_ROLES parameter in the initialization parameters file on the Oracle database server.

2. Stop and restart the Oracle database server.

3. Create each role that the RADIUS server will manage on the Oracle database server with the value IDENTIFIED EXTERNALLY.

   To configure roles on the RADIUS server, refer to Table 6-2 and use the following syntax:

   ORA_DatabaseName.DatabaseDomainName_RoleName
   

   Example:

   ORA_USERDB.US.ORACLE.COM_MANAGER
   

1. Configure RADIUS challenge-response mode.

   See Also:

   • Challenge-Response (Asynchronous) Authentication Mode

   • Configure Challenge-Response