C
Integrating Authentication Devices Using RADIUS

This appendix explains how third party vendors of authentication devices customize the RADIUS challenge-response user interface to fit their particular device.

More Information: See Chapter 3, "Configuring RADIUS Authentication"

This appendix covers the following topics:

• About the RADIUS Challenge-Response User Interface

• Customizing the Challenge-Response User Interface

About the RADIUS Challenge-Response User Interface

You can set up any authentication device that supports the RADIUS standard to authenticate Oracle users. When your authentication device uses the challenge-response mode, a graphical interface prompts the user first for a password, then for additional information--for example, a dynamic password that the user obtains from a token card. This interface is Java-based to provide optimal platform independence.

Third party vendors of authentication devices must customize this graphical user interface to fit their particular device. For example, a smartcard vendor customizes the Oracle client to issue the challenge to the smartcard reader. Then, when the smartcard receives a challenge, it responds by prompting the user for more information, for example, a PIN.

Oracle has developed a Java interface class for this interface. It is a set of methods written in C code using the Java Native Interface as specified in release 1.1 of the Java Development Kit^TM from JavaSoft. This code, provided below, is system specific. You can find it in the file OracleRadiusInterface in the following directory: $ORACLE_HOME/network/security/classes.

Customizing the Challenge-Response User Interface

You customize this interface by creating your own class to handle the challenge-response conversation between the Oracle client and the RADIUS server. You then open your sqlnet.ora file, look up the SQLNET.RADIUS_AUTHENTICATION_INTERFACE parameter, and replace the name of the class listed there, namely, DefaultRadiusInterface, with the name of the new class you have just created. When you make this change in the sqlnet.ora file, this class is loaded on the Oracle client in order to handle the authentication process.

The third party must implement the Oracle RADIUS Interface which is located in the ORACLE.NET.RADIUS package.

public interface OracleRadiusInterface {
  public void radiusRequest();
  public void radiusChallenge(String challenge);
  public String getUserName();
  public String getPassword();
  public String getResponse();

  }

Parameter	Description
radiusRequest	Generally, this prompts the user for a user name and password which will later be retrieved through getUserName and getPassword.
getUserName	extracts the user name the user enters. If this method returns an empty String, it is assumed that the user wants to cancel the operation. The user then receives a message indicating that the authentication attempt failed.
getPassword	extracts the password the user enters. If getUserName returns a valid String, but getPassword returns an empty string, the "challenge keyword" is relayed as the password from the server. If the user enters a valid password, a challenge may or may not be returned by the server.
radiusChallenge	presents a request sent from the RADIUS server for the user to enter more information
getResponse	extracts the response the user enters. If this method returns a valid response, that information then populates the User-Password attribute in the new Access-Request packet. If an empty String is returned, the operation is aborted from both sides by returning the corresponding value.

---