18c Database : Integration with Microsoft Active Directory

Starting 18c, you can integrate the oracle database with Microsoft active directory services which will be a great feature and long awaiting one, Until now many of us using open ldap or third party ldap services to configure the same which is a overhead to the sys admins to manage two different directory services for user management and authentication for oracle databases.

This will be same like as configuring LDAP services with proper domain and user name and using ldap.ora file only, but if you have already a ldap in use, you can create a file called dsi.ora appending DSI_ prefix to the parameters. That means you can have ldap and ad both working as authentication mechanisms for database.

The high level steps involved in this are:-

Sysadmin:

1. Create a Active directory user account and configure read privileges on the domain we need.
2. Extend the Active directory schema for Oracle specific attribute

DBA:

On the database host. and edit ldap.ora or dsi.ora file

DSI_DIRECTORY_SERVERS = (ad-server.test.com:389:636)
DSI_DEFAULT_ADMIN_CONTEXT = "o=test,c=US"
DSI_DIRECTORY_SERVER_TYPE = ad

The parameter in ldap.ora/dsi.ora  "DIRECTORY_SERVER_TYPE = ad" need to set to ad (active directory)

Create certificates for secure connections

For Oracle Database, use the orapki utility to get the Oracle Database server certificate.

orapki wallet add -wallet ./ -pwd pwd -dn "CN=`hostname`, OU=Department, O=Company, L=City, ST=Street, C=Country"  -keysize 1024 -self_signed -validity 365

For Active directory , use active directory certificate generate process to obtain certificate.

Configure the database with AD authentication

./dbca -silent -configureDatabase -sourceDB ad -registerWithDirService true -dirServiceUserName cn=example,cn=users,dc=adintg,dc=examplecorp,dc=com -dirServiceUser oracle -dirServicePassword password -ldapDirectoryAccessType PASSWORD -walletPassword password

ALTER SYSTEM SET LDAP_DIRECTORY_ACCESS = 'PASSWORD';

ALTER SYSTEM SET LDAP_DIRECTORY_SYSAUTH = 'yes';

-Thanks

Suresh