Note:

Support for Oracle Advanced Security

Oracle Advanced Security provides the following security features:

• Data Encryption

  Sensitive information communicated over enterprise networks and the Internet can be protected by using encryption algorithms, which transform information into a form that can be deciphered only with a decryption key. Some of the supported encryption algorithms are RC4, DES, 3DES, and AES.

  To ensure data integrity during transmission, Oracle Advanced Security generates a cryptographically secure message digest, using MD5 or SHA-1 hashing algorithms, and includes it with each message sent across a network. This protects the communicated data from attacks, such as data modification, deleted packets, and replay attacks.

• Strong Authentication

  To ensure network security in distributed environments, it is necessary to authenticate the user and check his credentials. Password authentication is the most common means of authentication. Oracle Advanced Security enables strong authentication with Oracle authentication adapters, which support various third-party authentication services, including SSL with digital certificates. Oracle Advanced Security supports the following industry-standard authentication methods:

  • Kerberos

  • Remote Authentication Dial-In User Service (RADIUS)

  • Distributed Computing Environment (DCE)

  • Secure Sockets Layer (SSL)

JDBC OCI Driver Support for Oracle Advanced Security

If you are using the JDBC OCI driver, which presumes you are running from a computer with an Oracle client installation, then support for Oracle Advanced Security and incorporated third-party features is fairly similar to the support provided by in any Oracle client situation. Your use of Advanced Security features is determined by related settings in thesqlnet.ora file on the client computer.

Starting from Oracle Database 11g Release 1 (11.1), the JDBC OCI driver attempts to use external authentication if you try connecting to a database without providing a password. The following are some examples using the JDBC OCI driver to connect to a database without providing a password:

SSL Authentication

Example 9-1 uses SSL authentication to connect to the database.

import java.sql.*;import java.util.Properties; public class test{    public static void main( String [] args ) throws Exception    {        String url = "jdbc:oracle:oci:@"         +"(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=stadh25)(PORT=1529))"         +"(CONNECT_DATA=(SERVICE_NAME=mydatabaseinstance)))";        Driver driver = new oracle.jdbc.OracleDriver();        Properties props = new Properties();        Connection conn = driver.connect( url, props );        conn.close();    }}

Using Data Source

Example 9-2 uses a data source to connect to the database.

import java.sql.*; import javax.sql.*; import java.util.Properties; import oracle.jdbc.pool.*;  public class testpool {     public static void main( String args ) throws Exception     { String url = "jdbc:oracle:oci:@" +"(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=stadh25)(PORT=1529))" +"(CONNECT_DATA=(SERVICE_NAME=mydatabaseinstance)))";     OracleConnectionPoolDataSource ocpds = new OracleConnectionPoolDataSource();     ocpds.setURL(url);     PooledConnection pc = ocpds.getPooledConnection();     Connection conn = pc.getConnection();     }     }

JDBC Thin Driver Support for Oracle Advanced Security

The JDBC Thin driver cannot assume the existence of an Oracle client installation or the presence of thesqlnet.ora file. Therefore, it uses a Java approach to support Oracle Advanced Security. Java classes that implement Oracle Advanced Security are included in theojdbc5.jar andojdbc6.jar files. Security parameters for encryption and integrity, usually set insqlnet.ora, are set using a JavaProperties object or through system properties.

Support for Login Authentication

Basic login authentication through JDBC consists of user names and passwords, as with any other means of logging in to an Oracle server. Specify the user name and password through a Java properties object or directly through thegetConnection method call. This applies regardless of which client-side Oracle JDBC driver you are using, but is irrelevant if you are using the server-side internal driver, which uses a special direct connection and does not require a user name or password.

Starting with 11g release 1 (11.1), the Oracle JDBC Thin driver implements a challenge-response protocol to authenticate the user.

Support for Strong Authentication

Oracle Advanced Security enables Oracle Database users to authenticate externally. External authentication can be with RADIUS, KERBEROS, Certificate-Based Authentication, Token Cards, Smart Cards, and DCE. This is called strong authentication. Oracle JDBC drivers provide support for the following strong authentication methods:

• Kerberos

• RADIUS

• SSL (certificate-based authentication)

Support for OS Authentication

Operating System (OS) authentication allows Oracle to pass control of user authentication to the operating system. It allows the users to connect to the database by authenticating their OS username in the database. No password is associated with the account since it is assumed that OS authentication is sufficient. In other words, the server delegates the authentication to the client OS. You need to perform the following steps to achieve this:

• Use the following command to check the value of the OracleOS_AUTHENT_PREFIX initialization parameter:

  SQL> SHOW PARAMETER os_authent_prefixNAME                                 TYPE        VALUE------------------------------------ ----------- ------------------------------os_authent_prefix                    string      ops$SQL>

  Note:

  Remember the OS authentication prefix. You need to create a database user to allow an OS authenticated connection, where the username must be the prefix value concatenated to the OS username.

• Add the following line in thet_init1.ora file:

  REMOTE_OS_AUTHENT = TRUE

When a connection is attempted from the local database server, the OS username is passed to the Oracle server. If the username is recognized, the Oracle the connection is accepted, otherwise the connection is rejected.

String url = "jdbc:oracle:thin:@oracleserver.mydomain.com:5521:dbja"Driver driver = new oracle.jdbc.OracleDriver();DriverManager.registerDriver(driver);Properties props = new Properties();Connection conn = DriverManager.getConnection( url, props);

ORA-17443=Null user or password not supported in THIN driver

Support for Data Encryption and Integrity

You can use Oracle Advanced Security data encryption and integrity features in your Java database applications, depending on related settings in the server. When using the JDBC OCI driver, set parameters as you would in any Oracle client situation. When using the Thin driver, set parameters through a Java properties object.

Encryption is enabled or disabled based on a combination of the client-side encryption-level setting and the server-side encryption-level setting. Similarly, integrity is enabled or disabled based on a combination of the client-side integrity-level setting and the server-side integrity-level setting.

Encryption and integrity support the same setting levels,REJECTED,ACCEPTED,REQUESTED, andREQUIRED.Table 9-1 shows how these possible settings on the client-side and server-side combine to either enable or disable the feature. By default, remote OS authentication (through TCP) is disabled in the database for obvious security reasons.

Table 9-1 shows, for example, that if encryption is requested by the client, but rejected by the server, it is disabled. The same is true for integrity. As another example, if encryption is accepted by the client and requested by the server, it is enabled. And, again, the same is true for integrity.

This section covers the following topics:

• JDBC OCI Driver Support for Encryption and Integrity

• JDBC Thin Driver Support for Encryption and Integrity

• Setting Encryption and Integrity Parameters in Java

...Properties prop = new Properties();prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_ENCRYPTION_LEVEL, "REQUIRED");prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_ENCRYPTION_TYPES, "( DES40C )");prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_CHECKSUM_LEVEL, "REQUESTED");prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_CHECKSUM_TYPES, "( MD5 )");OracleDataSource ods = new OracleDataSource();ods.setProperties(prop);ods.setURL("jdbc:oracle:thin:@localhost:1521:main");Connection conn = ods.getConnection();...

  SQLNET.ENCRYPTION_SERVER = ACCEPTED   SQLNET.CRYPTO_CHECKSUM_SERVER = ACCEPTED   SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER= (MD5, SHA1)   SQLNET.ENCRYPTION_TYPES_SERVER= (AES256, AES192, AES128)  SQLNET.CRYPTO_SEED = 2z0hslkdharUJCFtkwbjOLbgwsj7vkqt3bGoUylihnvkhgkdsbdskkKGhdk

import java.sql.*;import java.util.Properties;import oracle.net.ano.AnoServices;import oracle.jdbc.*; public class DemoAESAndSHA1{  static final String USERNAME= "scott";  static final String PASSWORD= "tiger";  static final String URL = "jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=WXYZ)(PORT=5561))"  +"(CONNECT_DATA=(SERVICE_NAME=mydatabaseinstance)))";   public static final void main(String[] argv)  {    DemoAESAndSHA1 demo = new DemoAESAndSHA1();    try    {      demo.run();    }catch(SQLException ex)    {      ex.printStackTrace();    }  }   void run() throws SQLException  {    OracleDriver dr = new OracleDriver();    Properties prop = new Properties();     // We require the connection to be encrypted with either AES256 or AES192.    // If the database doesn't accept such a security level, then the connection attempt will fail.        prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_ENCRYPTION_LEVEL,AnoServices.ANO_REQUIRED);    prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_ENCRYPTION_TYPES,"( " + AnoServices.ENCRYPTION_AES256     + "," + AnoServices.ENCRYPTION_AES192 + ")");     // We also require the use of the SHA1 algorithm for data integrity checking.        prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_CHECKSUM_LEVEL,AnoServices.ANO_REQUIRED);    prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_CHECKSUM_TYPES,"( " + AnoServices.CHECKSUM_SHA1 + " )");    prop.setProperty("user",DemoAESAndSHA1.USERNAME);    prop.setProperty("password",DemoAESAndSHA1.PASSWORD);    OracleConnection oraConn = (OracleConnection)dr.connect(DemoAESAndSHA1.URL,prop);    System.out.println("Connection created! Encryption algorithm is: " + oraConn.getEncryptionAlgorithmName() + ", data     integrity algorithm is: " + oraConn.getDataIntegrityAlgorithmName());        oraConn.close();  }  }

Support for SSL

Oracle Database 11g provides support for the Secure Sockets Layer (SSL) protocol. SSL is a widely used industry standard protocol that provides secure communication over a network. SSL provides authentication, data encryption, and data integrity. It provides a secure enhancement to the standard TCP/IP protocol, which is used for Internet communication..

SSL uses digital certificates that comply with the X.509v3 standard for authentication and a public and private key pair for encryption. SSL also uses secret key cryptography and digital signatures to ensure privacy and integrity of data. When a network connection over SSL is initiated, the client and server perform an SSL handshake that includes the following steps:

• Client and server negotiate about the cipher suites to use. This includes deciding on the encryption algorithms to be used for data transfer.

• Server sends its certificate to the client, and the client verifies that the certificate was signed by a trusted certification authority (CA). This step verifies the identity of the server.

• If client authentication is required, the client sends its own certificate to the server, and the server verifies that the certificate was signed by a trusted CA.

• Client and server exchange key information using public key cryptography. Based on this information, each generates a session key. All subsequent communications between the client and the server is encrypted and decrypted by using this set of session keys and the negotiated cipher suite.

SSL Terminology

The following terms are commonly used in the SSL context:

• certificate: A certificate is a digitally signed document that binds a public key with an entity. The certificate can be used to verify that the public key belongs to that individual.

• certification authority: A certification authority (CA), also known as certificate authority, is an entity which issues digitally signed certificates for use by other parties.

• cipher suite: A cipher suite is a set of cryptographic algorithms and key sizes used to encrypt data sent over an SSL-enabled network.

• private key: A private key is a secret key, which is never transmitted over a network. The private key is used to decrypt a message that has been encrypted using the corresponding public key. It is also used to sign certificates. The certificate is verified using the corresponding public key.

• public key: A public key is an encryption key that can be made public or sent by ordinary means such as an e-mail message. The public key is used for encrypting the message sent over SSL. It is also used to verify a certificate signed by the corresponding private key.

• wallet: A wallet is a password-protected container that is used to store authentication and signing credentials, including private keys, certificates, and trusted certificates required by SSL.

Java Version of SSL

The Java Secure Socket Extension (JSSE) provides a framework and an implementation for a Java version of the SSL and TLS protocols. JSSE provides support for data encryption, server and client authentication, and message integrity. It abstracts the complex security algorithms and handshaking mechanisms and simplifies application development by providing a building block for application developers, which they can directly integrate into their applications. JSSE is integrated into Java Development Kit (JDK) 1.4 and later, and supports SSL version 2.0 and 3.0.

Oracle strongly recommends that you have a clear understanding of the JavaTM Secure Socket Extension (JSSE) framework by Sun Microsystems before using SSL in the Oracle JDBC drivers.

The JSSE standard application programming interface (API) is available in thejavax.net,javax.net.ssl, andjavax.security.cert packages. These packages provide classes for creating and configuring sockets, server sockets, SSL sockets, and SSL server sockets. The packages also provide a class for secure HTTP connections, a public key certificate API compatible with JDK1.1-based platforms, and interfaces for key and trust managers.

SSL works the same way, as in any networking environment, in Oracle Database 11g. This section covers the following:

• Managing Certificates and Wallets

• Keys and certificates containers

Support for Kerberos

Oracle Database 11g Release 1 (11.1) introduces support for Kerberos. Kerberos is a network authentication protocol that provides the tools of authentication and strong cryptography over the network. Kerberos helps you secure your information systems across your entire enterprise by using secret-key cryptography. The Kerberos protocol uses strong cryptography so that a client or a server can prove its identity to its server or client across an insecure network connection. After a client and server have used Kerberos to prove their identity, they can also encrypt all of their communications to assure privacy and data integrity as they go about their business.

The Kerberos architecture is centered around a trusted authentication service called the key distribution center, or KDC. Users and services in a Kerberos environment are referred to as principals; each principal shares a secret, such as a password, with the KDC. A principal can be a user such asscott or a database server instance.

import com.sun.security.auth.module.Krb5LoginModule;import java.io.IOException; import java.security.PrivilegedExceptionAction;import java.sql.Connection;import java.sql.ResultSet;import java.sql.SQLException;import java.sql.Statement; import java.util.HashMap;import java.util.Properties;import javax.security.auth.Subject;import javax.security.auth.callback.Callback;import javax.security.auth.callback.CallbackHandler;import javax.security.auth.callback.PasswordCallback;import javax.security.auth.callback.UnsupportedCallbackException; import oracle.jdbc.OracleConnection;import oracle.jdbc.OracleDriver;import oracle.net.ano.AnoServices;public class KerberosJdbcDemo{  String url ="jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)"+    "(HOST=oracleserver.mydomain.com)(PORT=5561))(CONNECT_DATA=" +    "(SERVICE_NAME=mydatabaseinstance)))";   public static void main(String[] arv)  {    /* If you see the following error message [Mechanism level: Could not load     * configuration file c:\winnt\krb5.ini (The system cannot find the path      * specified] it's because the JVM cannot locate your kerberos config file.     * You have to provide the location of the file. For example, on Windows,     * the MIT Kerberos client uses the config file: C\WINDOWS\krb5.ini:     */    // System.setProperty("java.security.krb5.conf","C:\\WINDOWS\\krb5.ini");    System.setProperty("java.security.krb5.conf","/home/Jdbc/Security/kerberos/krb5.conf");        KerberosJdbcDemo kerberosDemo = new KerberosJdbcDemo();    try    {      System.out.println("Attempt to connect with the default user:");      kerberosDemo.connectWithDefaultUser();    }    catch (Exception e)    {      e.printStackTrace();    }    try    {      System.out.println("Attempt to connect with a specific user:");      kerberosDemo.connectWithSpecificUser();    }    catch (Exception e)    {      e.printStackTrace();    }  }     void connectWithDefaultUser() throws SQLException  {    OracleDriver driver = new OracleDriver();    Properties prop = new Properties();        prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_AUTHENTICATION_SERVICES,      "("+AnoServices.AUTHENTICATION_KERBEROS5+")");      prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_AUTHENTICATION_KRB5_MUTUAL,      "true");         /* If you get the following error [Unable to obtain Princpal Name for      * authentication] although you know that you have the right TGT in your     * credential cache, then it's probably because the JVM can't locate your     * cache.     *     * Note that the default location on windows is "C:\Documents and Settings\krb5cc_username".     */     // prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_AUTHENTICATION_KRB5_CC_NAME,    /*      On linux:         > which kinit         /usr/kerberos/bin/kinit         > ls -l /etc/krb5.conf          lrwxrwxrwx    1 root  root   47 Jun 22 06:56 /etc/krb5.conf -> /home/Jdbc/Security/kerberos/krb5.conf             > kinit client         Password for client@US.ORACLE.COM:          > klist         Ticket cache: FILE:/tmp/krb5cc_5088         Default principal: client@US.ORACLE.COM          Valid starting     Expires            Service principal         11/02/06 09:25:11  11/02/06 19:25:11  krbtgt/US.ORACLE.COM@US.ORACLE.COM           Kerberos 4 ticket cache: /tmp/tkt5088         klist: You have no tickets cached    */    prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_AUTHENTICATION_KRB5_CC_NAME,                     "/tmp/krb5cc_5088");    Connection conn  = driver.connect(url,prop);    String auth = ((OracleConnection)conn).getAuthenticationAdaptorName();    System.out.println("Authentication adaptor="+auth);    printUserName(conn);    conn.close();  }     void connectWithSpecificUser() throws Exception  {    Subject specificSubject = new Subject();        // This first part isn't really meaningful to the sake of this demo. In    // a real world scenario, you have a valid "specificSubject" Subject that    // represents a web user that has valid Kerberos credentials.    Krb5LoginModule krb5Module = new Krb5LoginModule();    HashMap sharedState = new HashMap();    HashMap options = new HashMap();    options.put("doNotPrompt","false");    options.put("useTicketCache","false");    options.put("principal","client@US.ORACLE.COM");        krb5Module.initialize(specificSubject,newKrbCallbackHandler(),sharedState,options);    boolean retLogin = krb5Module.login();    krb5Module.commit();    if(!retLogin)      throw new Exception("Kerberos5 adaptor couldn't retrieve credentials (TGT) from the cache");           // to use the TGT from the cache:       // options.put("useTicketCache","true");    // options.put("doNotPrompt","true");    // options.put("ticketCache","C:\\Documents and Settings\\Jean de Lavarene\\krb5cc");    // krb5Module.initialize(specificSubject,null,sharedState,options);      // Now we have a valid Subject with Kerberos credentials. The second scenario    // really starts here:    // execute driver.connect(...) on behalf of the Subject 'specificSubject':    Connection conn =       (Connection)Subject.doAs(specificSubject, new PrivilegedExceptionAction()        {          public Object run()          {            Connection con = null;            Properties prop = new Properties();            prop.setProperty(AnoServices.AUTHENTICATION_PROPERTY_SERVICES,                              "(" + AnoServices.AUTHENTICATION_KERBEROS5 + ")");            try            {              OracleDriver driver = new OracleDriver();              con = driver.connect(url, prop);             } catch (Exception except)            {              except.printStackTrace();            }            return con;          }        });     String auth = ((OracleConnection)conn).getAuthenticationAdaptorName();    System.out.println("Authentication adaptor="+auth);    printUserName(conn);    conn.close();  }    void printUserName(Connection conn) throws SQLException  {    Statement stmt = null;    try    {      stmt = conn.createStatement();      ResultSet rs = stmt.executeQuery("select user from dual");      while(rs.next())        System.out.println("User is:"+rs.getString(1));      rs.close();    }    finally    {      if(stmt != null)        stmt.close();    }  }} class KrbCallbackHandler implements CallbackHandler{ public void handle(Callback[] callbacks) throws IOException,                                                  UnsupportedCallbackException {   for (int i = 0; i < callbacks.length; i++)   {     if (callbacks[i] instanceof PasswordCallback)     {       PasswordCallback pc = (PasswordCallback)callbacks[i];       System.out.println("set password to 'welcome'");       pc.setPassword((new String("welcome")).toCharArray());     } else     {       throw new UnsupportedCallbackException(callbacks[i],                                               "Unrecognized Callback");     }   } }}

Support for RADIUS

Oracle Database 11g Release 1 (11.1) introduces support for Remote Authentication Dial-In User Service (RADIUS). RADIUS is a client/server security protocol that is most widely known for enabling remote authentication and access. Oracle Advanced Security uses this standard in a client/server network environment to enable use of any authentication method that supports the RADIUS protocol. RADIUS can be used with a variety of authentication mechanisms, including token cards and smart cards. This section contains the following sections:

• Configuring Oracle Database to Use RADIUS

• Code Example

import java.sql.Connection;import java.sql.ResultSet;import java.sql.SQLException;import java.sql.Statement;import java.util.Properties;import oracle.jdbc.OracleConnection;import oracle.jdbc.OracleDriver;import oracle.net.ano.AnoServices;public class RadiusJdbcDemo{    String url ="jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)"+    "(HOST=oracleserver.mydomain.com)(PORT=5561))(CONNECT_DATA=" +    "(SERVICE_NAME=mydatabaseinstance)))";   public static void main(String[] arv)  {    RadiusJdbcDemo radiusDemo = new RadiusJdbcDemo();    try    {      radiusDemo.connect();    }    catch (Exception e)    {      e.printStackTrace();    }  }    /*   * This method attempts to logon to the database using the RADIUS   * authentication protocol.   *    * It should print the following output to stdout:   * -----------------------------------------------------   * Authentication adaptor=RADIUS   * User is:ASO   * -----------------------------------------------------   */  void connect() throws SQLException  {    OracleDriver driver = new OracleDriver();    Properties prop = new Properties();        prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_AUTHENTICATION_SERVICES,      "("+AnoServices.AUTHENTICATION_RADIUS+")");    // The user "aso" needs to be properly setup on the radius server with    // password "1234".    prop.setProperty("user","aso");    prop.setProperty("password","1234");        Connection conn  = driver.connect(url,prop);    String auth = ((OracleConnection)conn).getAuthenticationAdaptorName();    System.out.println("Authentication adaptor="+auth);    printUserName(conn);    conn.close();  }     void printUserName(Connection conn) throws SQLException  {    Statement stmt = null;    try    {      stmt = conn.createStatement();      ResultSet rs = stmt.executeQuery("select user from dual");      while(rs.next())        System.out.println("User is:"+rs.getString(1));      rs.close();    }    finally    {      if(stmt != null)        stmt.close();    }  }}

Secure External Password Store

As an alternative for large-scale deployments where applications use password credentials to connect to databases, it is possible to store such credentials in a client-side Oracle wallet. An Oracle wallet is a secure software container that is used to store authentication and signing credentials.

Storing database password credentials in a client-side Oracle wallet eliminates the need to embed user names and passwords in application code,batch jobs, orscripts. This reduces the risk of exposing passwords in the clear in scripts and application code, and simplifies maintenance because you need not change your code each time user names and passwords change. In addition, not having to change application code also makes it easier to enforce password management policies for these user accounts.

When you configure a client to use the external password store, applications can use the following syntax to connect to databases that use password authentication:

CONNECT /@database_alias

Note that you need not specify database login credentials in thisCONNECT statement. Instead your system looks for database login credentials in the client wallet.