Oracle Network Products Getting Started Release 2.3.4 for Windows Platforms

Library

Product

Contents

Index

Using the Advanced Networking Option

• Setting Up Network Security and Single Sign-On for Windows NT and Windows 95
• Setting Up for Network Security and Single Sign-On for Windows 3.1x

 

Note:  The Distributed Computing Environment (DCE) Integration component of ANO requires no platform-specific configuration steps. All ANO features are discussed in the Oracle Advanced Networking Option Administrator's Guide.

   

Setting Up Network Security and Single Sign-On for 
Windows NT and Windows 95

Biometric (Identix) Authentication Adapter

• General Configuration Instructions
• Configuring the TouchSafe II Device Driver
• Corrections to the Oracle Advanced Networking Option Administrator's Guide

General Configuration Instructions

Configuring the TouchSafe II Device Driver

1. Change directories to ORACLE_HOME\IDENTIX.
2. Modify the IoPortAddress parameter in ETSIINT.INI to the current TouchSafe II Encrypt I/O port setting. For example:

IoPortAddress = REG_DWORD 0x00000360  for I/O port 0x360

3. Modify the Windows NT directory setting in ETSIINT.BAT.

For example:

COPY ETSIINT.SYS C:\WINNT35\SYSTEM32\DRIVERS

-> COPY ETSIINT.SYS C:\WINNT351\SYSTEM32\DRIVERS

4. Run batch file ETSIINT.BAT.
5. Use the SetKey utility in the Identix demo program to set a hash key in Hex. Set the key to C001BABE, for example. (Do not use this value!). Make sure the hash key matches exactly the one set in the DEFAULT Security policy.
6. Reboot the system, and the device driver starts to work.
7. To make sure the device driver is running, check the Control Panel's Devices dialog box after reboot. The device ETSIINT should already be started.

Corrections to the Oracle Advanced Networking Option 
Administrator's Guide

Configuring the Biometric Authentication Service (page 9) 
The Biometric Authentication Service can be created on any 7.3 database using the PL/SQL scripts located in the IDENTIX subdirectory of your Oracle home.

If you plan to use your local Oracle database for Windows NT as your Biometric Authentication Service, you can set up your database using Server Manager as follows:

1. Change directories to ORACLE_HOME\IDENTIX.
2. Connect to your database as user SYSTEM from Server Manager. Enter:

C:\>SVRMGR23

SVRMGR>CONNECT SYSTEM/MANAGER

3. Enter @nauicat from within Server Manager. For example,

SVRMGR>@nauicat

If you plan to use a remote Oracle7 database, you may either:
• Set your TWO_TASK environment variable to be the SQL*Net alias of this remote database, then carry out the steps above.

Or,

• Copy all the PL/SQL files (*.SQL) in your ORACLE_HOME\IDENTIX directory over to the machine on which the remote Oracle7 database is running and then carry out the same steps.
4. Once you have configured the database server that is to become the authentication server, test the connection by connecting as OFM_ADMIN/OFM_ADMIN.

SVRMGR>CONNECT OFM_ADMIN/OFM_ADMIN

Before you add users, use the Identix SetKey utility to configure a (hex) hash key on each of the clients (for example: 0001BABE). The key must be the same for each client and match the DEFAULT policy hashkey. See "Add Policy (page 19)".

Add Policy (page 19) 

To add a new policy:

1. Click Policies.
2. Click the [+] sign (called the Create button) on the Tool Bar. The dialog box appears.
3. Tab to or click the boxes in which the data is to be entered.
4. Type the policy's name and the three threshold levels. See the Identix documentation for a detailed explanation of how to set these three levels.
5. Choose a hash key (hex) for this policy. For example: C001BABE.
6. Click the [Create] box.

Configuring the Kerberos Authentication Adapter

Configuring the SecurID Authentication Adapter

• SDCONF.REC file present in the root drive :\TMP
• port numbers and service names present in the Windows NT SERVICES file

Configuring the CyberSAFE Authentication Adapter

• install the CyberSAFE Application Security Toolkit
• run the CyberSAFE Challenger Client to get your ticket-granting ticket

 

Additional Information: See the CyberSAFE Application Security Toolkit documentation.

   

Setting Up for Network Security and Single Sign-On for Windows 3.1x

Configuring the CyberSAFE Authentication Adapter

• install the CyberSAFE Application Security Toolkit
• run the CyberSAFE Challenger Client to get your ticket-granting ticket
• have the two configuration files in the directory specified by the CSFC5CONFIG and CSFC5REALMS parameters in AUTOEXEC.BAT

For example:

SET CSFC5CONFIG=C:\CSFC5\KRB.CNF

SET CSFC5REALMS=C:\CSFC5\KRB.REA

• set the credentials cache path and file name with the CSFC5CCNAME parameter

For example:

SET CSFC5CCNAME=C:\CSFC5\KRBCCNAME

Configuring the Kerberos Authentication Adapter

• have the two Kerberos configuration files, *.CNF and *.REA, in the directory specified by the SQLNET.KERBEROS5_CONF and SQLNET.KERBEROS5_REALMS parameters in SQLNET.ORA

For example:

SQLNET.KERBEROS5_CONF=C:\ORAWIN\NETWORK\ADMIN\KRB.CNF

Attention: You must specify the drive. In this example, the drive is C:\.

 

• run the Oracle Kerberos Utility to obtain a ticket-granting ticket

Using the Oracle Kerberos Utility

To complete configuration for Windows 3.1x:

1. Log on and select Get Ticket.

If you do not have a valid ticket-granting ticket, request one by providing your user name and password to log in to a Kerberos server. You can change the default attributes of the ticket by clicking the Options button.

2. Select your Options.
• Cache file-- By default, the cache file is C:\ORAWIN\BIN\KRB.TC, where C represents the drive for your ORAWIN\BIN directory. You can also specify the cache file in the SQLNET.ORA file.

For example:

SQLNET.KERBEROS5_CC_NAME=C:\ORAWIN\NETWORK\
ADMIN\KRB.TC

• Lifetime-- By default, the ticket-granting ticket is valid for 8 hours. You may want shorter or longer-lived credentials. Note that the Key Distribution Center can ignore this option or put site-configured limits on what can be specified. The lifetime value is represented by a string consisting of numbers qualified by w, d, h, m, or s. These letters mean weeks, days, hours, minutes, or seconds, respectively.

For example:

2w1d6h20m30s

means ask for a ticket-granting ticket with a lifetime of 2 weeks, 1 day, 6 hours, 20 minutes, and 30 seconds.
• Forwardability-- Check this attribute box if a database link is required later.
3. Choose OK to save changes.
4. Choose Browse to select the cache file you want to use.

You can view the ticket information by clicking Show. To remove the cache file, click Remove.

You can leave the OKU by clicking Cancel/Close at any time.

Configuring the SecurID Authentication Adapter

• SCCONF.REC file present in the root directory drive :\TMP
• port numbers and service names present in NT services file

 

Note: The SecurID Authentication Adapter does not support database roles and database links.

   

Prev Next

Copyright © 1997 Oracle Corporation.   All Rights Reserved.

Library

Product

Contents

Index