11 Configuring RADIUS Authentication

11.3.2.1 Step 2A: Configure RADIUS on the Oracle Client

1. Start Oracle Net Manager.

   • (UNIX) From $ORACLE_HOME/bin, enter the following command at the command line:

     netmgr
     

   • (Windows) Select Start, Programs, Oracle - HOME_NAME, Configuration and Migration Tools, then Net Manager.

2. Expand Oracle Net Configuration, and from Local, select Profile.

3. From the Naming list, select Network Security.

   The Network Security tabbed window appears.

4. Select the Authentication tab. (It should be selected by default.)
   Description of the illustration ''radu0001.gif''
   
   

5. From the Available Methods list, select RADIUS.

6. Select the right-arrow (>) to move RADIUS to the Selected Methods list. Move any other methods you want to use in the same way.

7. Arrange the selected methods in order of required usage by selecting a method in the Selected Methods list, and clicking Promote or Demote to position it in the list.

   For example, put RADIUS at the top of the list for it to be the first service used.

8. From the File menu, select Save Network Configuration.

   The sqlnet.ora file is updated with the following entry:

   SQLNET.AUTHENTICATION_SERVICES=(RADIUS)
   

11.3.2.2 Step 2B: Configure RADIUS on the Oracle Database Server

This section contains:

• Step 2B(1): Create the RADIUS Secret Key File on the Oracle Database Server

• Step 2B(2): Configure RADIUS Parameters on the Server (sqlnet.ora File)

• Step 2B(3): Set Oracle Database Server Initialization Parameters

Step 2B(1): Create the RADIUS Secret Key File on the Oracle Database Server

1. Obtain the RADIUS secret key from the RADIUS server.

   For each RADIUS client, the administrator of the RADIUS server creates a shared secret key, which must be less than or equal to 16 characters.

2. On the Oracle database server, create a directory:

   • (UNIX) $ORACLE_HOME/network/security

   • (Windows) ORACLE_BASE\ORACLE_HOME\network\security

3. Create the file radius.key to hold the shared secret copied from the RADIUS server. Place the file in the directory you created in Step 2.

4. Copy the shared secret key and paste it (and nothing else) into the radius.key file created on the Oracle database server.

5. For security purposes, change the file permission of radius.key to read only, accessible only by the Oracle owner.

   Oracle relies on the file system to keep this file secret.

   See Also:

   The RADIUS server administration documentation, for information about obtaining the secret key

Step 2B(2): Configure RADIUS Parameters on the Server (sqlnet.ora File)

1. Start Oracle Net Manager.

   • (UNIX) From $ORACLE_HOME/bin, enter the following command at the command line:

     netmgr
     

   • (Windows) Select Start, Programs, Oracle - HOME_NAME, Configuration and Migration Tools, then Net Manager.

2. Expand Oracle Net Configuration, and from Local, select Profile.

3. From the Naming list, select Network Security.

   The Network Security tabbed window appears.

4. Select the Authentication tab.

5. From the Available Methods list, select RADIUS.

6. Move RADIUS to the Selected Methods list by choosing the right-arrow (>).

7. To arrange the selected methods in order of desired use, select a method in the Selected Methods list, and select Promote or Demote to position it in the list.

   For example, if you want RADIUS to be the first service used, put it at the top of the list.

8. Select the Other Params tab.

9. From the Authentication Service list, select RADIUS.

10. In the Host Name field, accept the localhost as the default primary RADIUS server, or enter another host name.

    
    Description of the illustration ''radu0002.gif''
    
    

11. Ensure that the default value of the Secret File field is valid.

12. From the File menu, select Save Network Configuration.

    The sqlnet.ora file is updated with the following entries:

    SQLNET.AUTHENTICATION_SERVICES=RADIUS
    SQLNET.RADIUS_AUTHENTICATION=RADIUS_server_{hostname|IP_address}
    

    Note:

    The IP_address can either be an Internet Protocol Version 4 (IPv4) or Internet Protocol Version 6 (IPv6) address. The RADIUS adapter supports both IPv4 and IPv6 based servers.

Step 2B(3): Set Oracle Database Server Initialization Parameters

1. Add the following setting to the init.ora initialization file.

   OS_AUTHENT_PREFIX=""
   

   By default, the init.ora file is located in the ORACLE_HOME/dbs directory (or the same location of the data files) on Linux and UNIX systems, and in the ORACLE_HOME\database directory on Windows.

2. Restart the database.

   For example:

   SQL> SHUTDOWN
   SQL> STARTUP
   

11.3.2.3 Step 2C: Configure Additional RADIUS Features

This section contains:

• Step 2C(1): Change Default Settings

• Step 2C(2): Configure Challenge-Response

• Step 2C(3): Set Parameters for an Alternate RADIUS Server

Step 2C(1): Change Default Settings

1. Start Oracle Net Manager.

   • (UNIX) From $ORACLE_HOME/bin, enter the following command at the command line:

     netmgr
     

   • (Windows) Select Start, Programs, Oracle - HOME_NAME, Configuration and Migration Tools, then Net Manager.

2. Expand Oracle Net Configuration, and from Local, select Profile.

3. From the Naming list, select Network Security.

   The Network Security tabbed window appears.

4. Click the Other Params tab.

5. From the Authentication Service list, select RADIUS.

6. Change the default setting for any of the following fields:

   • Port Number: Specifies the listening port of the primary RADIUS server. The default value is 1645.

   • Timeout (seconds): Specifies the time the Oracle database server waits for a response from the primary RADIUS server. The default is 15 seconds.

   • Number of Retries: Specifies the number of times the Oracle database server resends messages to the primary RADIUS server. The default is three retries. For instructions on configuring RADIUS accounting, see Step 5: Configure RADIUS Accounting.

   • Secret File: Specifies the location of the secret key on the Oracle database server. The field specifies the location of the secret key file, not the secret key itself. For information about specifying the secret key, see Step 2B(1): Create the RADIUS Secret Key File on the Oracle Database Server.

7. From the File menu, select Save Network Configuration.

   The sqlnet.ora file is updated with the following entries:

   SQLNET.RADIUS_AUTHENTICATION_PORT=(PORT)
   SQLNET.RADIUS_AUTHENTICATION_TIMEOUT=
   (NUMBER OF SECONDS TO WAIT FOR response)
   SQLNET.RADIUS_AUTHENTICATION_RETRIES=
   (NUMBER OF TIMES TO RE-SEND TO RADIUS server)
   SQLNET.RADIUS_SECRET=(path/radius.key)
   

Step 2C(2): Configure Challenge-Response

The challenge-response (asynchronous) mode presents the user with a graphical interface requesting first a password, then additional information (for example, a dynamic password that the user obtains from a token card). With the RADIUS adapter, this interface is Java-based to provide optimal platform independence.

To configure challenge-response:

1. If you are using JDK 1.1.7 or JRE 1.1.7, then set the JAVA_HOME environment variable to the JRE or JDK location on the system where the Oracle client is run:

   • On UNIX, enter this command at the prompt:

     % setenv JAVA_HOME /usr/local/packages/jre1.1.7B
     

   • On Windows, select Start, Settings, Control Panel, System, Environment, and set the JAVA_HOME variable as follows:

     c:\java\jre1.1.7B
     

   This step is not required for any other JDK/JRE version.

2. Start Oracle Net Manager.

   • (UNIX) From $ORACLE_HOME/bin, enter the following command at the command line:

     netmgr
     

   • (Windows) Select Start, Programs, Oracle - HOME_NAME, Configuration and Migration Tools, then Net Manager.

3. Expand Oracle Net Configuration, and from Local, select Profile.

4. From the Naming list, select Network Security.

   The Network Security tabbed window appears.

5. From the Authentication Service list, select RADIUS.

6. In the Challenge Response field, enter ON to enable challenge-response.

7. In the Default Keyword field, accept the default value of the challenge or enter a keyword for requesting a challenge from the RADIUS server.

   The keyword feature is provided by Oracle and supported by some, but not all, RADIUS servers. You can use this feature only if your RADIUS server supports it.

   By setting a keyword, you let the user avoid using a password to verify identity. If the user does not enter a password, the keyword you set here is passed to the RADIUS server which responds with a challenge requesting, for example, a driver's license number or birth date. If the user does enter a password, the RADIUS server may or may not respond with a challenge, depending upon the configuration of the RADIUS server.

8. In the Interface Class Name field, accept the default value of DefaultRadiusInterface or enter the name of the class you have created to handle the challenge-response conversation.

   If other than the default RADIUS interface is used, then you also must edit the sqlnet.ora file to enter SQLNET.RADIUS_CLASSPATH=(location), where location is the complete path name of the jar file. It defaults to
   $ORACLE_HOME/network/jlib/netradius.jar: $ORACLE_HOME/JRE/lib/vt.jar

9. From the File menu, select Save Network Configuration.

   The sqlnet.ora file is updated with the following entries:

   SQLNET.RADIUS_CHALLENGE_RESPONSE=([ON | OFF])
   SQLNET.RADIUS_CHALLENGE_KEYWORD=(KEYWORD)
   SQLNET.RADIUS_AUTHENTICATION_INTERFACE=(name of interface including the package name delimited by "/" for ".")
   

Step 2C(3): Set Parameters for an Alternate RADIUS Server

If you are using an alternate RADIUS server, set these parameters in the sqlnet.ora file using any text editor.

SQLNET.RADIUS_ALTERNATE=(hostname or ip address of alternate radius server)
SQLNET.RADIUS_ALTERNATE_PORT=(1812)
SQLNET.RADIUS_ALTERNATE_TIMEOUT=(number of seconds to wait for response)
SQLNET.RADIUS_ALTERNATE_RETRIES=(number of times to re-send to radius server)

11.3.4.1 Step 4A: Configure the Oracle Server (RADIUS Client)

1. Add the OS_ROLE parameter to the init.ora file and set this parameter to TRUE as follows:

   OS_ROLE=TRUE
   

2. Restart the database so that the system can read the change to the init.ora file.

   For example:

   SQL> SHUTDOWN 
   SQL> STARTUP
   

3. Set the RADIUS challenge-response mode to ON for the server if you have not already done so by following the steps listed in "Step 2C(2): Configure Challenge-Response".

4. Add externally identified users and roles.

11.3.4.2 Step 4B: Configure the Oracle Client Where Users Log In

Set the RADIUS challenge-response mode to ON for the client if you have not already done so by following the steps listed in "Step 2C(2): Configure Challenge-Response".

11.3.4.3 Step 4C: Configure the RADIUS Server

1. Add the following attributes to the RADIUS server attribute configuration file:

   ATTRIBUTE NAME	CODE	TYPE
   VENDOR_SPECIFIC	26	Integer
   ORACLE_ROLE	1	String

   
   

2. Assign a Vendor ID for Oracle in the RADIUS server attribute configuration file that includes the SMI Network Management Private Enterprise Code of 111.

   For example, enter the following in the RADIUS server attribute configuration file:

   VALUE     VENDOR_SPECIFIC     ORACLE     111

3. Using the following syntax, add the ORACLE_ROLE attribute to the user profile of the users who will use external RADIUS authorization:

   ORA_databaseSID_rolename[_[A]|[D]]

   where:

   • ORA designates that this role is used for Oracle purposes

   • databaseSID is the Oracle system identifier that is configured in the database server's init.ora file

   • rolename is the name of role as it is defined in the data dictionary.

   • A is an optional character that indicates the user has administrator's privileges for this role

   • D is an optional character that indicates this role is to be enabled by default

   Ensure that RADIUS groups which map to Oracle roles adhere to the ORACLE_ROLE syntax.

   For example:

   USERNAME     USERPASSWD="user_password",
                SERVICE_TYPE=login_user,
                VENDOR_SPECIFIC=ORACLE,
                ORACLE_ROLE=ORA_ora920_sysdba
   

   See Also:

   The RADIUS server administration documentation for information about configuring the server.

11.3.5.1 Step 5A: Set RADIUS Accounting on the Oracle Database Server

1. Start Oracle Net Manager.

   • (UNIX) From $ORACLE_HOME/bin, enter the following command at the command line:

     netmgr
     

   • (Windows) Select Start, Programs, Oracle - HOME_NAME, Configuration and Migration Tools, then Net Manager.

2. Expand Oracle Net Configuration, and from Local, select Profile.

3. From the Naming list, select Network Security.

   The Network Security tabbed window appears.

4. Select the Other Params tab.

5. From the Authentication Service list, select RADIUS.

6. In the Send Accounting field, enter ON to enable accounting or OFF to disable accounting.

7. From the File menu, select Save Network Configuration.

   The sqlnet.ora file is updated with the following entry:

   SQLNET.RADIUS_SEND_ACCOUNTING= ON
   

11.3.5.2 Step 5B: Configure the RADIUS Accounting Server

RADIUS Accounting Server consists of an accounting server residing on either the same host as the RADIUS authentication server or on a separate host.