
Oracle Advanced Security
Release 8.1.5


*******************************************

Copyright (C) 1998, 1999 Oracle Corporation

This software/documentation contains proprietary information of Oracle
Corporation; it is provided under a license agreement containing
restrictions on use and disclosure and is also protected by copyright
law. Reverse engineering of the software is prohibited.

If this software/documentation is delivered to a U.S. Government
Agency on the Department of Defense, then it is delivered with
Restricted Rights and the following legend is applicable:

RESTRICTED RIGHTS LEGEND:

Use, duplication, or disclosure by the government is subject to
restrictions as set forth in subparagraph (c) (1) (ii) of DFARS
252.227-7013, Rights in Technical Data and Computer Software (October
1988).

If this software/documentation is delivered to a U.S. Government
Agency the Department of Defense, then it is delivered with
"Restricted Rights," as defined in FAR 52.227-14, Rights in Data -
General, including Alternate III (June 1987).

Oracle Corporation, 500 Oracle Parkway, Redwood City, CA 94065.

This product contains encryption and/or authentication engines from
RSA Data Security, Inc. Copyright 1996 RSA Data Security, Inc. All
rights reserved.

Oracle and SQL*Net are registered trademarks of Oracle Corporation,
Redwood City, California. Oracle Advanced Networking Option, Net8, 
Oracle8 and Oracle8i are trademarks of Oracle Corporation, Redwood City,
California.  All other products or company names are used for
identification purposes only, and may be trademarks of their
respective owners.


*********************************************


Changes in This Release
-----------------------

The Oracle Advanced Security option, release 8.1.5, (formerly Advanced 
Networking Option) contains the same feature set as the Advanced Networking
Option, with the addition of new internet standard protocols: RADIUS and SSL
support. 

In this release, the Oracle Advanced Security option installs automatically 
during Typical Install. In order to use it, you must purchase appropriate 
licenses, install (either automatically in Typical Install or manually using 
Custom Install), then configure it on the clients and servers. Although 
installed by default, it is an extra cost item and must be purchased when used. 
This licensing requirement also affects customers wishing to use security 
features in combination with Java Beans (EJB over IIOP/SSL), Database Global 
Users (Net8/SSL) or the Java Web Server (HTTP/SSL).


Changes in Authentication and Single Sign-On Support
----------------------------------------------------

This release contains authentication support for integration with
RADIUS-compliant (Remote Authentication Dial-In User Service)
devices. In this implementation, the Oracle8i database acts as the RADIUS
client which communicates with a RADIUS server provided by a RADIUS server
vendor. A Java-based client interface is available for authentication
vendors to customize for interoperability.  This allows any
authentication device vendor that supports the RADIUS protocol to
authenticate Oracle users. 

RADIUS support must be installed in Custom Install. If you are using RADIUS 
on Solaris, see "Known Bugs/Problems" in this README for important RADIUS 
information. 

This release contains an interface for authentication providers to
customize for use with RADIUS-compliant devices. For more information
on the interface see Appendix C -- Integrating Authentication Devices
Using RADIUS -- in the Oracle Advanced Security Administrator's Guide.

To use the Java-based client interface for RADIUS, you must set the 
LD_LIBRARY_PATH to $ORACLE_HOME/JRE/lib/sparc/native_threads.

In this release the Security Dynamics ACE/Server and tokens can
authenticate Oracle users through the RADIUS adapter as well as the SecurID
adapter. Using the RADIUS plug-in to the ACE/Server, the ACE/Server acts 
as the RADIUS server and authentication server, storing user information and 
authenticating Oracle users.

In this release, Oracle Advanced Security option supports Kerberos V5
Release 1.0 authentication in its default configuration mode
(currently, only "des-cbc-crc" encryption mode is supported). Kerberos
V5 Release 1.0 can be obtained from Massachusetts Institute of
Technology (MIT) web site http://web.mit.edu/kerberos/www.
In this release, Oracle Advanced Security supports MIT's new Kerberos 
configuration file format. To enable this feature, set the SQLNET.ORA 
parameter SQLNET.KERBEROS5_CONF = krb5.conf
Please note that the file name must be krb5.conf.

In this release, Oracle Advanced Security supports Transarc's DCE/DFS 2.0 on
Solaris 2.6. In order to use DCE, you must install DCE integration in Custom
Install.

This release of Oracle Advanced Security supports CyberSafe TrustBroker Client 
Suite v1.2. In order to use CyberSafe with the Oracle Advanced Security option, 
you must install CyberSafe support in Custom Install. To use the products 
together, you must install CyberSafe GSS Runtime Library v1.1 during the 
CyberSafe install. 


Public Key Infrastructure Support 
---------------------------------

This release contains support for the SSL (Secure Sockets Layer)
protocol which secures Net8 and networks with public key
infrastructure (PKI). Use of the SSL protocol allows Oracle processes
to authenticate one another with X.509 Version 3 certificates. SSL
provides encryption and data integrity with cipher suites --- sets of
authentication, encryption and data integrity. Besides using X.509v3 
certificates for RSA asymmetric key authentication, SSL also provides 
Diffie-Hellman Anonymous cipher suites, for non-certificate based negotiation.
For details of the implementation and instructions for use, refer to the 
chapter "Configuring SSL Authentication" in the Oracle Advanced Security
Administrator's Guide, Release 8.1.5.

To launch the Oracle Wallet Manager, you must run $ORACLE_HOME/bin/wmtgui. 

You must set the LD_LIBRARY_PATH to $ORACLE_HOME/lib to use the OWM command 
line tool (owmcmd), which is used to create a clear wallet from an encrypted 
one.

To open your wallet, type the following command at the Unix prompt: 
> owmcmd [-f]

You will be prompted for your wallet password. Upon entering the correct 
password, you will get your DN and a message that you are logged in 
successfully. 


Installation: Backup Files Created  
----------------------------------

During Oracle Advanced Security installation, three .bak
files are created: naeet.o.bak, naect.o.bak, and naedhs.o.bak. They
are located in $ORACLE_HOME/lib. These files should not be deleted
because they are required when executables are relinked during
the de-installation of the Oracle Advanced Security.


Installation: Client Only Machines  
----------------------------------

If using the Oracle Advanced Security option on a "client Only" machine
(that is, with no database present), it is mandatory to set the TWO_TASK
environment variable before starting the installation. The TWO_TASK
variable points to an alias representing the database on a server
machine. Setting the TWO_TASK environment variable enables the Oracle
Advanced Security option to be installed in "Client Only" mode. See
the Oracle8i Administrator's Guide for more details on the TWO_TASK
environment variable.


Known Bugs/Problems
-------------------

There is a known problem in which RADIUS fails on Solaris servers. Contact 
Customer Support for the patch to this release which contains the fix. (818346)

There is a known problem on Solaris RADIUS clients in which clients making 
JDBC/OCI calls using IPC as the Net8 protocol do not work. To resolve the 
problem, the variable THREADS_FLAG must be set to "native" within the Java 
Runtime Environment. (835331)

There is a known problem when using SecurID or RADIUS challenge-response mode,
in which you must exit -- not just disconnect -- prior to logging in as 
another user from the application, such as SQL*Plus. This allows a second user
to login properly with appropriate roles and privileges. (777706)

There is a known problem in which connecting a RADIUS or SecurID user to a 
database using the same session as the database's internal user will fail. 
This occurs only when using Server Manager. Instead you must exit Server 
Manager rather than simply disconnecting. (810619)

When using RADIUS in synchronous mode, there is a known problem in which 
RADIUS users are denied a connection when using a password longer than 8 
characters. (813373)

There is a known problem in which Multi-Threaded Server fails when encryption 
is required. Setting SQLNET.ENCRYPTION_CLIENT = REQUESTED results in a less 
secure setup but resolves the problem. Disabling the Multi-Threaded Server 
also resolves the problem, but reduces the options available. (506055)

There is a known problem in which the Net8 client fails when SSL server-side 
only authentication is turned on. This does not effect other clients such as 
EJB. To resolve the problem, you must have a valid X.509v3 certificate in the 
Net8 client-side wallet in order to use SSL for server-side authentication. 
(824264) 

Both the client and server must set cipher suites with RSA authentication and 
null encryption to use SSL RSA authentication without SSL encryption. 

The database cannot register MTS Dispatchers with a Listener over SSL. 
This occurs because the registration API turns on the NS multiplexing feature 
for registering Dispatchers with the Listener, and SSL transport does not work
over multiplexed sessions in release 8.1.5.
This is scheduled to be fixed in the future releases. The workaround to this 
problem is to have the database register MTS Dispatchers with the Listener 
over TCP. Once the Listener knows about the Dispatchers, it can properly 
redirect clients to them. 
 
In this release, the NS features of Multiplexing and Connection Pooling will 
not work if SSL transport is being used. This is scheduled to be fixed in 
future releases.

For EJB users of SSL using SSL in Diffie-Hellman Anonymous mode, the 
connection fails if the server sets a DH-Anon cipher suite and the client 
does not set anything. Setting DH-Anon on the client or both the client and 
server resolves the problem.  


Enhancements to Problems in Previous Releases  
---------------------------------------------

The bug in which replay cache file gets corrupted and Kerberos fails has been 
fixed. (487695)

The bug in which you cannot connect as SYSDBA when using DCE groups has been 
fixed. (519766)

The bug in which you cannot connect as SYSOPER when using DCE groups has been 
fixed. (670181)

The bug has been fixed in which certain platforms receive an error 
message "JNI panic: JNI received a null string" when using 
challenge-response mode in RADIUS. (745215) 



