Oracle® Database

2.1 About Microsoft Active Directory

Active Directory is the LDAP-compliant directory server included with Windows 2000. Active Directory stores all Windows 2000 information, including users, groups, and policies. Active Directory also stores information about network resources (such as databases) and makes this information available to application users and network administrators. Active Directory enables users to access network resources with a single login. The scope of Active Directory can range from storing all the resources of a small computer network to storing all the resources of several wide areas networks (WANs).

2.2 Accessing Active Directory

When using Oracle features that support Active Directory, ensure that the Active Directory computer can be successfully reached using all possible TCP/IP hostname forms to reach the domain controller. For example, if the hostname of the domain controller is server1 in the domain acme.com, then ensure that you can ping that computer using all of the following:

• server1.acme.com

• acme.com

• server1

Active Directory often issues referrals back to itself in one or more of these forms, depending upon the operation being performed. If any of the forms cannot reach the Active Directory computer, then some LDAP operations may fail.

3.1 Directory Naming

Oracle Database provides the Directory Naming feature which makes use of a directory server. This feature has been enabled to work with Microsoft Active Directory.

Directory Naming enables clients to connect to the database making use of information stored centrally in an LDAP-compliant directory server such as Active Directory. For example, any net service name previously stored in the tnsnames.ora file can now be stored in Active Directory.

3.2 Automatic Discovery of Directory Servers

Oracle Net Configuration Assistant provides automatic discovery of directory servers. When you select Active Directory as the directory server type, Oracle Net Configuration Assistant automatically discovers the directory server location and performs related tasks.

3.3 Integration with Microsoft Tools

Oracle database services, net service names, and enterprise role entries in Active Directory can be displayed and tested in two Windows 2000 tools:

• Windows Explorer

• Active Directory Users and Computers

Windows Explorer displays the hierarchical structure of files, directories, and local and network drives on your computer. It can display and test Oracle database service and net service name objects.

Active Directory Users and Computers is an administrative tool installed on Windows servers configured as domain controllers. This tool enables you to add, modify, delete, and organize Windows 2000 accounts and groups, and publish resources in the directory of your organization. Like Windows Explorer, it can display and test Oracle database service and net service name objects. Additionally, it can manage access control.

3.4 User Interface Extensions for Oracle Net Directory Naming

The property menus of Oracle database service and net service name objects in Windows Explorer and Active Directory Users and Computers have been enhanced. When you right-click these Oracle directory objects, you now see two new options for testing connectivity:

• Test

• Connect with SQL*Plus

The Test option tests whether the username, password, and net service name you initially entered can actually connect to the Oracle database. The Connect with SQL*Plus option starts SQL*Plus, which enables you to perform database administration, run scripts, and so on.

3.5 Enhancement of Directory Object Type Descriptions

Oracle directory object type descriptions in Active Directory have been enhanced to make them easier to understand. In the right pane of Figure 1, for example, the Type column reveals that sales is an Oracle Net Service name.

Figure 1 Directory Object Type Descriptions in Active Directory

Description of the illustration adtest.gif

3.6 Integration with Windows Login Credentials

The Oracle database and configuration tools can use the login credentials of the Windows user currently logged on, to connect to Active Directory automatically (that is, without having to re-enter the login credentials). This feature has two benefits:

• Oracle clients and databases can securely connect to Active Directory and retrieve the net service name.

• Oracle configuration tools can connect automatically to Active Directory and configure the Oracle database and net service name objects. The enabled tools include Oracle Net Configuration Assistant and Database Configuration Assistant.

3.7 Oracle Directory Objects in Active Directory

If the Oracle database and Oracle Net Services are installed and configured to access Active Directory, then Active Directory Users and Computers displays Oracle directory objects, as illustrated in Figure 2:

Figure 2 Oracle Directory Objects in Active Directory Users and Computers

Description of the illustration adusrext.gif

Table 1 describes the Oracle directory objects appearing in Figure 2

4.1 Directory Naming Software Requirements

For client computers from which you want to manage Oracle Database enterprise users, roles and domains, you must have Oracle8i Client release 8.1.6 or later and one of the following Microsoft products:

• Windows XP, Windows 2000, or Windows Server 2003

• Windows NT 4.0 with Active Directory Service Interfaces (ADSI)

For the database, you must have Oracle8i Database release 8.1.6 or later. This is required for registering the database service as an object in Active Directory. The database can use either of the following Microsoft products:

• Windows 2000 or Windows Server 2003

• Windows NT 4.0 with ADSI

Both the client computers and the database must be members of a Windows 2000 domain.

4.2 Oracle Schema Creation

You must create an Oracle schema to use net directory naming features with Active Directory. A schema is a set of rules for Oracle Net Services and Oracle database entries and their attributes stored in Active Directory. The following restrictions apply to creating an Oracle schema to use with Active Directory:

• Only one Oracle schema can be created for each forest.

• Schema creation is performed on a Windows 2000 domain controller.

• The Windows 2000 domain controller must be the operations master that allows schema updates. See your Windows operating system documentation for instructions.

To create an Oracle schema:

1. Log in as a member of the Schema Administrator group. Domain administrators are in the Schema Administrator group by default.

2. Use Oracle Net Configuration Assistant to create the Oracle schema. You can create your schema during or after database installation.

Oracle schema creation can fail while Oracle Net Configuration Assistant is configuring Active Directory as the directory server if the Active Directory display is not configured to accept all 24 default languages. Before running Oracle Net Configuration Assistant to complete directory access configuration, verify that the display specifiers for all 24 languages are populated by entering the following at the command prompt:

ldifde -p OneLevel -d cn=DisplaySpecifiers,cn=Configuration,domain context -f temp file

where:

• domain context is the domain context for this Active Directory server. For example dc=acme,dc=com.

• temp file is a file where you want to put the output.

If the command reports that less than 24 entries were found, you can still use Oracle Net Configuration Assistant. However, the report will indicate that Oracle schema creation failed, rather than simply reporting that display specifiers for some languages were not created.

4.3 Oracle Context Creation

You must create an Oracle Context to use net directory naming features with Active Directory. Oracle Context is the top-level Oracle entry in the Active Directory tree. It contains Oracle database service and Oracle Net service name object information.

• You can create only one Oracle Context for each Windows 2000 domain (administrative context).

• You must have the right to create domain and enterprise objects in order to create the Oracle Context in Active Directory with Oracle Net Configuration Assistant.

• Use Oracle Net Configuration Assistant to create your Oracle Context. You can create the Oracle Context during or after Oracle Database Custom installation.

6.1 Testing Connectivity from Client Computers

When using Oracle Net directory naming, client computers connect to a database by specifying the database or net service name entry that appears in the Oracle Context. For example, if the database entry under the Oracle Context in Active Directory is orcl, and the client and Oracle database are in the same domain, then a user connects to the database through SQL*Plus by entering the following connect string:

SQL> CONNECT scott/tiger@orcl

If the client and Oracle database are in different domains, a user connects to the database through SQL*Plus by entering:

SQL> CONNECT scott/tiger@orcl.domain

where domain is the domain in which the Oracle database is located.

These connect strings follow DNS-style conventions. While Active Directory also supports connections using X.500 naming conventions, Oracle recommends DNS-style conventions because they are easier to use.

DNS-style conventions enable client users to access an Oracle database through a directory server by entering minimal connection information, even when the client computer and Oracle database are in separate domains. Names following the X.500 convention are longer, especially when the client and Oracle database are located in different domains (also known as administrative contexts).

6.2 Testing Connectivity from Microsoft Tools

Oracle directory objects in Active Directory are integrated with two Microsoft tools:

• Windows Explorer

• Active Directory Users and Computers

You can perform the following tasks from within these Microsoft tools:

• Connect with SQL*Plus to an Oracle database

• Test Oracle database connectivity

To test connectivity:

1. Start Windows Explorer or Active Directory Users and Computers.

   To start Windows Explorer:

   1. Choose Start > Programs > Accessories > Windows Explorer.

   2. Expand My Network Places.

   3. Expand Entire Network.

   4. Expand Directory.

   To start Active Directory Users and Computers:

   Choose Start > Programs > Administrative Tools > Active Directory Users and Computers.

   
   

   Note: All clients accessing an Oracle database through Active Directory require read access on all net service name objects in the Oracle Context and must be able to authenticate anonymously with Active Directory. Oracle Net Configuration Assistant automatically sets this up.

   
   

2. Expand the domain in which your Oracle Context is located.

3. Expand your Oracle Context.

4. Right-click a database service or Oracle Net Service name object.

   A menu appears with several options. This sections covers the Test and Connect with SQL*Plus options.

   
   Description of the illustration adtest.gif
   
   

5. If you want to test the database connection without actually connecting to it, choose Test.

   A status message appears describing the status of your connection attempt.

   
   Description of the illustration adtstcon.gif
   
   

6. If you want to test the database connection by connecting to it, choose Connect with SQL*Plus.

   The Oracle SQL*Plus Login dialog appears.

   
   Description of the illustration adsqlpls.gif
   
   

7. Enter your username and password, then click OK.

   A status message appears describing the status of your connection attempt.

7.1 Security Groups

Security groups are automatically created when the Oracle Context is created in Active Directory. The user configuring access (and thus creating the Oracle Context) is automatically added to each group. The relevant groups are:

• OracleDBCreators

• OracleNetAdmins

7.2 Accessing the Security Groups

You can add or remove users in the security groups with Active Directory Users and Computers.

To add or remove users:

1. Choose Start > Programs > Administrative Tools > Active Directory Users and Computers.

2. Choose Advanced Features from the View main menu.

   This enables you to view and edit information that is normally hidden.

3. Expand the domain (administrative context) in which your Oracle Context is located.

4. Expand Users.

   The security groups appear in the right window pane.

   
   Description of the illustration adsecgrp.gif
   
   

5. Right-click the Oracle security group that you want to view or modify.

   A menu appears with several options.

6. Choose Properties.

7. Choose the Members tab.

   The Properties dialog for the group you selected appears (in this example, OracleDBCreators).

   
   Description of the illustration admembrs.gif
   
   

8. To add users, click Add.

   The Select Users, Contacts, Computers, or Groups dialog appears.

9. Select the users or groups you want to add and click Add.

   Your selections appear in the Select Users, Contacts, Computers, or Groups dialog.

10. To remove a user, select the user name from the Members list and click Remove.

11. When you are finished adding and removing users, click OK.