Oracle Advanced Networking Option Administrator's Guide
Release 8.0.3

A54084_01

Library

Product

Contents

Index

Prev Next

8
Configuring the DCE GSSAPI
Authentication Adapter

The DCE GSSAPI authentication adapter enables you to use DCE authentication even if you do not use other portions of the Oracle DCE Integration product in your environment.

Note:

If you are already using Oracle DCE Integration, you do not also have to use the DCE GSSAPI authentication adapter. The Oracle DCE Integration product described in Part II, "Oracle Advanced Networking Option - Oracle DCE Integration", includes DCE authentication.  

This chapter describes how to configure and use the DCE GSSAPI authentication adapter. It describes the following four steps:

  1. "Create the DCE Principal"
  2. "Set Up Parameters to Use the New DCE Principal, and Turn On DCE GSSAPI Authentication"
  3. "Set Up the Account You Will Use to Authenticate to the Database"
  4. "Connect to an Oracle Server Using DCE GSSAPI Authentication"

Note:

The instructions in this chapter assume that you are familiar with DCE terminology. For more information about DCE, refer to Part II,"Oracle Advanced Networking Option - Oracle DCE Integration", in this guide, your operating system-specific DCE administration guide, and the documentation listed in the "Preface".  

8.1 Create the DCE Principal

To create the DCE principal used by the Oracle Server to validate authentication, type the commands below shown in bold typeface. These instructions assume the Oracle Server principal is named "oracle_server". Type the following commands on the database server.

% su
password: (root password is not echoed)
# dce_login cell_admin cell_admin_password
# rgy_edit
Current site is: registry server at
/.../cellname/subsys/dce/sec/master
rgy_edit=> do p
Domain changed to: principal
rgy_edit=> add oracle_server
rgy_edit=> do a
Domain changed to: account
rgy_edit=> add oracle_server -g none -o none -pw oracle_server_password -mp cell_admin_password
rgy_edit=> ktadd -p oracle_server -pw oracle_server_password
rgy_edit=> quit
bye

8.2 Set Up Parameters to Use the New DCE Principal, and Turn On DCE GSSAPI Authentication

The following instructions assume that the Oracle Server principal is named "oracle_server".

Add the following lines to the SQLNET.ORA file. (This file is probably found in <ORACLE_HOME>/NETWORK/ADMIN.)

SQLNET.AUTHENTICATION_GSSAPI_SERVICE=/.../cellname/oracle_server
SQLNET.AUTHENTICATION_SERVICES=(DCEGSSAPI)
Note:

The Oracle Server principal name used above must be a fully qualified name, including the cell name.  

8.3 Set Up the Account You Will Use to Authenticate to the Database

Create the DCE principal used by the Oracle client to connect to the database. The following instructions assume the Oracle client principal is named "oracle".

% dce_login cell_admin cell_admin_password
% rgy_edit
Current site is : registry server at /.../cellname/subsys/dce/sec/master
rgy_edit=> do p
Domain changed to: principal
rgy_edit=> add oracle
rgy_edit=> do a
Domain changed to: account
rgy_edit=> add oracle -g none -o none -pw oracle_client_password - mp cell_admin_password
rgy_edit=> quit
bye

Create the Oracle database user account. The following instructions show how to use the Oracle Server Manager to do this.

% svrmgrl
Oracle Server Manager Release 2.3.3.0.0 -Production
Copyright (c) Oracle Corporation 1994,1995. All rights reserved.
Oracle8 Server Release 8.0.3.0.0 -Production Release
With the distributed, heterogeneous, replication, objects, parallel query, Parallel Server and Spatial Data options
PL/SQL Release 8.0.3.0.0 - Production SVRMGR> connect internal
Connected SVRMGR> create user "/.../CELLNAME/ORACLE" identified externally;
Statement processed. SVRMGR> grant connect to "/.../CELLNAME/ORACLE";
Statement processed. SVRMGR> exit Server Manager complete.
Note:

The Oracle client principal name must be a fully qualified principal (including full cell designation), must be in uppercase, and must be enclosed within quotes.  

8.4 Connect to an Oracle Server Using DCE GSSAPI Authentication

The following instructions assume the Oracle Server principal is "oracle_server", the Oracle client principal is "oracle", and the database service name is "sales".

  1. If your DCE authentication is not already encapsulated into the operating system authentication, log in:
    % dce_login <oracle_client_principal> <oracle_client_password>
    
    

    For example:

    % dce_login oracle oraclnt
    
    
  2. Connect to the Oracle database using DCE GSSAPI authentication.
    % sqlplus /@<database_service_name>
    
    

    For example:

    % sqlplus /@sales
    
    



Prev

Next
Oracle
Copyright © 1997 Oracle Corporation.

All Rights Reserved.

Library

Product

Contents

Index