OracleSecurity & users
CMU step 8: check the setup and a login
Shows the LDAP parameters, the CMU_WALLET location, the users and roles mapped to AD, and who the current session really is. Run it once as a DBA, then log in as an AD user and run it again. They can log in as "CORP\jsmith", as "jsmith@corp.example.com", or as plain jsmith if they're in the same domain as the service account. Expect PASSWORD_GLOBAL, GLOBAL SHARED or GLOBAL EXCLUSIVE, and AD, plus the roles from their AD groups.
Not yet verified. How scripts are tested
1CLEAR COLUMNS2SET LINESIZE 200 PAGESIZE 100 TRIMOUT ON TAB OFF3COLUMN name FORMAT A264COLUMN value FORMAT A125COLUMN username FORMAT A256COLUMN external_name HEADING "MAPPED TO" FORMAT A70 WORD_WRAPPED7COLUMN account_status HEADING "STATUS" FORMAT A168COLUMN role FORMAT A309COLUMN schema_user HEADING "SCHEMA" FORMAT A2010COLUMN ad_login HEADING "AD LOGIN" FORMAT A2511COLUMN ad_dn HEADING "AD DN" FORMAT A50 WORD_WRAPPED12COLUMN method HEADING "METHOD" FORMAT A1613COLUMN id_type HEADING "MAPPING" FORMAT A1614COLUMN ldap_type HEADING "LDAP" FORMAT A415 16PROMPT LDAP parameters in this container17SELECT name, value18FROM v$parameter19WHERE name LIKE 'ldap_directory%'20ORDER BY name;21 22PROMPT Wallet location from CMU_WALLET (no rows: default or sqlnet.ora location)23SELECT p.property_value AS name, d.directory_path AS external_name24FROM database_properties p25LEFT JOIN dba_directories d ON d.directory_name = p.property_value26WHERE p.property_name = 'CMU_WALLET';27 28PROMPT Database users mapped to AD29SELECT username, external_name, account_status30FROM dba_users31WHERE authentication_type = 'GLOBAL'32ORDER BY username;33 34PROMPT Roles mapped to AD groups35SELECT role36FROM dba_roles37WHERE authentication_type = 'GLOBAL'38ORDER BY role;39 40PROMPT Who this session is. As an AD user expect PASSWORD_GLOBAL, GLOBAL SHARED or GLOBAL EXCLUSIVE, and AD41SELECT SYS_CONTEXT('USERENV', 'SESSION_USER') AS schema_user,42 SYS_CONTEXT('USERENV', 'AUTHENTICATED_IDENTITY') AS ad_login,43 SYS_CONTEXT('USERENV', 'ENTERPRISE_IDENTITY') AS ad_dn,44 SYS_CONTEXT('USERENV', 'AUTHENTICATION_METHOD') AS method,45 SYS_CONTEXT('USERENV', 'IDENTIFICATION_TYPE') AS id_type,46 SYS_CONTEXT('USERENV', 'LDAP_SERVER_TYPE') AS ldap_type47FROM dual;48 49PROMPT Roles enabled in this session50SELECT role51FROM session_roles52ORDER BY role;Save it as ora-cmu-check.sql and run it with SQL> @ora-cmu-check.
Helps with
- ORA-28030: Server encountered problems accessing LDAP directory service
- ORA-28274: No ORACLE password attribute corresponding to user nickname exists
Part of these runbooks
More Oracle scripts: Security & users
- Accounts locked, expired or expiring soonApplication accounts that aren't OPEN, or whose passwords expire in the next 14 days. Catch service accounts before they break an application.
- Who has DBA, SYSDBA and powerful system privilegesNon-Oracle accounts and roles holding the DBA role or high-risk ANY privileges, then everyone in the password file. Worth reviewing every audit cycle.
- CMU step 1: prepare Active DirectoryDone once by an AD administrator before any database work: create the service account the database binds with, install Oracle's password filter on…
- CMU step 2: export the AD root certificateThe database talks to AD over LDAPS, so its wallet must trust the certificate authority that issued the domain controllers' certificates. Export that…
- CMU step 3: create the walletBuilds the auto-login wallet the database reads at login: the service account's user name, DN and password, plus the AD root certificate. With PDBs,…
- CMU step 4: create dsi.oraTells the database which domain controllers to use. Put it in the same folder as the wallet from step 3. Use fully qualified host names, and list at…