8
Configuring DCE GSSAPI Authentication

DCE GSSAPI authentication enables you to use DCE authentication even if you do not use other portions of the Oracle DCE Integration product in your environment.

This chapter describes how to configure and use DCE GSSAPI authentication.

Note: Check your platform-specific installation documentation to be sure that release 8.1.5 of the Oracle Advanced Security option supports Oracle DCE integration for your platform.

Note: If you are already using Oracle DCE Integration, you do not also have to use the DCE GSSAPI authentication adapter. The Oracle DCE Integration product, described in Part II, "Oracle Advanced Security and Oracle DCE Integration", includes DCE authentication.

Note: The instructions in this chapter assume that you are familiar with DCE terminology. For more information about DCE, see: Part II,"Oracle Advanced Security and Oracle DCE Integration", in this guide your operating system-specific DCE administration guide the documentation listed in "Related Publications"in the Preface of this guide

Configuring DCE GSSAPI Authentication

To configure DCE GSSAPI authentication you follow these four general steps, each of which is explained below:

Step 1: Create the DCE principal

Step 2: Configure the new DCE principal and turn on DCE GSSAPI authentication

Step 3: Set up the account you will use to authenticate to the database

Step 4: Connect to an Oracle server using DCE GSSAPI authentication

Step 1: Create the DCE principal

To create the DCE principal used by the Oracle server to validate authentication, type the commands below shown in bold typeface. These instructions assume the Oracle Server principal is named "oracle_server". Type the following commands on the database server.

% su

  password:    (root password is not echoed)

# dce_login cell_admin cell_admin_password

# rgy_edit

Current site is: registry server at 

    /.../cellname/subsys/dce/sec/master

rgy_edit=> do p

Domain changed to: principal

rgy_edit=> add oracle_server

rgy_edit=> do a

Domain changed to: account

rgy_edit=> add oracle_server -g none -o none -pw oracle_server_
password -mp cell_admin_password

rgy_edit=> ktadd -p oracle_server -pw oracle_server_password

rgy_edit=> quit

bye

Step 2: Configure the new DCE principal and turn on DCE GSSAPI authentication

The following instructions assume that the Oracle server principal is named "oracle_server."

Add the following lines to the sqlnet.ora file.

SQLNET.AUTHENTICATION_GSSAPI_SERVICE=/.../cellname/oracle_server

SQLNET.AUTHENTICATION_SERVICES=(DCEGSSAPI)

Note: The Oracle Server principal name used above must be a fully qualified name, including the cell name.

Step 3: Set up the account you will use to authenticate to the database

Create the DCE principal used by the Oracle client to connect to the database. The following instructions assume the Oracle client principal is named "oracle".

% dce_login cell_admin cell_admin_password

% rgy_edit

Current site is : registry server at /.../cellname/subsys/dce/sec/master

rgy_edit=> do p

Domain changed to: principal

rgy_edit=> add oracle

rgy_edit=> do a

Domain changed to: account

rgy_edit=> add oracle -g none -o none -pw oracle_client_password 	
-mp cell_admin_password

rgy_edit=> quit

bye

Create the Oracle database user account. The following instructions show how to use the SQL*Plus to do this.

SQL> connect internal

Connected
SQL> create user "/.../CELLNAME/ORACLE" identified externally;

Statement processed.
SQL> grant connect to "/.../CELLNAME/ORACLE";

Statement processed.
SQL> exit

Note: The Oracle client principal name must be a fully qualified principal (including full cell designation), must be in uppercase, and must be enclosed within quotes.

Step 4: Connect to an Oracle server using DCE GSSAPI authentication

The following instructions assume the Oracle Server principal is "oracle_server", the Oracle client principal is "oracle", and the database service name is "sales".

1. If your DCE authentication is not already encapsulated into the operating system authentication, log in:

   % dce_login oracle_client_principal oracle_client_password
   
   

   For example:

   % dce_login oracle oraclnt
   
   

2. Connect to the Oracle database using DCE GSSAPI authentication.

   % SQLPLUS /@<database_service_name>
   
   

   For example:

   % SQLPLUS /@sales
   

---