{"id":3444,"date":"2019-11-28T22:44:46","date_gmt":"2019-11-28T21:44:46","guid":{"rendered":"http:\/\/www.oradba.ch\/?p=3444"},"modified":"2019-11-28T22:44:52","modified_gmt":"2019-11-28T21:44:52","slug":"oracle-enterprise-user-security-with-multiple-ldap-ora","status":"publish","type":"post","link":"https:\/\/www.oradba.ch\/wordpress\/2019\/11\/oracle-enterprise-user-security-with-multiple-ldap-ora\/","title":{"rendered":"Oracle Enterprise User Security with multiple ldap.ora"},"content":{"rendered":"\n<p>Recently I came across the situation where I have to configure Enterpriser User Security for a database server with multiple databases for different directories. This is quite tricky when using a shared Oracle Home and a central TNS_ADMIN directory for SQLNet configuration. A common TNS_ADMIN also implies the use of only one <em>ldap.ora<\/em> file. Several ldap servers can be registered in one <em>ldap.ora<\/em>, but this is primarily used for failover configuration in a high-availability LDAP server architecture. The use of multiple EUS contexts in different LDAP servers is not supported. At least not in one single file. But there are some workarounds.<\/p>\n\n\n\n<p>Oracle does look for the ldap.ora file in a few different places. The following sequence is maintained:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><em>$LDAP_ADMIN<\/em> environment variable setting<\/li><li><em>$ORACLE_HOME\/ldap\/admin<\/em> directory<\/li><li><em>$TNS_ADMIN<\/em> environment variable setting<\/li><li><em>$ORACLE_HOME\/network\/admin<\/em> directory<\/li><\/ol>\n\n\n\n<p>Notes on this order can be found at different places in the Oracle documentation e.g Oracle Database Database Net Services Reference 19c <a href=\"https:\/\/docs.oracle.com\/en\/database\/oracle\/oracle-database\/19\/netrf\/directory-usage-parameters-in-ldap-ora-file.html#GUID-8CF6B143-F61C-40A1-967F-BE89C9D48D38\">Overview of Directory Server Usage File<\/a>, Oracle Database Security Guide 19c <a href=\"https:\/\/docs.oracle.com\/en\/database\/oracle\/oracle-database\/19\/dbseg\/integrating_mads_with_oracle_database.html#GUID-FA766B57-AF32-44B0-9419-A8164EC4E38C\">About Using a dsi.ora File<\/a> or in the Oracle Support Note <a href=\"https:\/\/support.oracle.com\/epmos\/faces\/DocumentDisplay?id=363283.1\">363283.1<\/a> What Is The Search Order For The LDAP.ORA File?<\/p>\n\n\n\n<p>If you don&#8217;t trust the documentation, you can also verify the search order with <em>strace<\/em>.  First define a few values for <em>TNS_ADMIN<\/em> and <em>LDAP_ADMIN<\/em> to be sure we do not use the default values.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">export LDAP_ADMIN=\"\/u01\/config\"\nexport TNS_ADMIN=\"\/u00\/app\/oracle\/network\/admin\"<\/pre>\n\n\n\n<p>If we make sure, that LDAP is the first names resolution in <em>sqlnet.ora<\/em> we could use <em>strace<\/em> with <em>tsnping<\/em>.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">oracle@eusdb:~\/ [TEUS01] grep -i NAMES.DIRECTORY_PATH $TNS_ADMIN\/sqlnet.ora\nNAMES.DIRECTORY_PATH=(LDAP, TNSNAMES, EZCONNECT )\n\noracle@eusdb:~\/ [TEUS01] strace -o \/u01\/config\/tnsping.txt tnsping TEUS01\n\nTNS Ping Utility for Linux: Version 19.0.0.0.0 - Production on 28-NOV-2019 20:47:33\n\nCopyright (c) 1997, 2019, Oracle.  All rights reserved.\n\nUsed parameter files:\n\/u00\/app\/oracle\/network\/admin\/sqlnet.ora\n\nUsed TNSNAMES adapter to resolve the alias\nAttempting to contact (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = eusdb)(PORT = 1521)) (CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = TEUS01)))\nOK (30 msec)<\/pre>\n\n\n\n<p>Checking the output does show the different directories<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">oracle@eusdb:~\/ [TEUS01] grep -i ldap.ora \/u01\/config\/tnsping.txt\nstat(\"\/u01\/config\/ldap.ora\", 0x7ffd149f6af0) = -1 ENOENT (No such file or directory)\nstat(\"\/u00\/app\/oracle\/product\/19.0.0.0\/ldap\/admin\/ldap.ora\", 0x7ffd149f6af0) = -1 ENOENT (No such file or directory)\nstat(\"\/u00\/app\/oracle\/network\/admin\/ldap.ora\", 0x7ffd149f6af0) = -1 ENOENT (No such file or directory)\nstat(\"\/u00\/app\/oracle\/product\/19.0.0.0\/network\/admin\/ldap.ora\", 0x7ffd149f6af0) = -1 ENOENT (No such file or directory)\nstat(\"\/u00\/app\/oracle\/product\/19.0.0.0\/network\/admin\/ldap.ora\", 0x7ffd149f6be0) = -1 ENOENT (No such file or directory)<\/pre>\n\n\n\n<p>As you can see the search order does match the documented search order. But how does that help us? It&#8217;s actually relatively simple. To use different LDAP server configuration per database, we do have to make sure, that each database has an individual ldap.ora file. This can be ensured by one the following points:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Have a dedicated Oracle Home for each database with an individual <em>ldap.ora<\/em> file in each Oracle Home<\/li><li>Define an environment variable for LDAP_ADMIN for each database.<\/li><\/ul>\n\n\n\n<p>Both methods have their advantages and disadvantages, but aren&#8217;t optimal. As often, several paths lead to the goal. The third option uses a static listener configuration for the database with an ENVS parameter. Unfortunately, the information about ENVS has disappeared in the latest version of the Oracle documentation. At least in the Oracle Database Database Net Services Reference 19c. But you can search for <a href=\"https:\/\/docs.oracle.com\/apps\/search\/search.jsp?q=ENVS&amp;category=database\">ENVS<\/a> in the Oracle Database Bookshelf. The parameter ENVS can be used to specify environment variables for the listener to set prior to executing (as a child process) a dedicated server program or an executable specified with the PROGRAM parameter. This allows a static listener entry to be defined for each database, where LDAP_ADMIN or TNS_ADMIN is explicitly set. Below you see an excerpt of <em>listener.ora<\/em> for ORACLE_SID <em>TEUS01<\/em>.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">SID_LIST_LISTENER =\n   (SID_LIST =\n     (SID_DESC =\n       (GLOBAL_DBNAME = TEUS01 )\n       (ORACLE_HOME = \/u00\/app\/oracle\/product\/19.0.0.0)\n       (SID_NAME = TEUS01)\n       (ENVS=\"LDAP_ADMIN=\/u00\/app\/oracle\/network\/TEUS01\")\n   )))<\/pre>\n\n\n\n<p>The database TEUS01 does use a dedicated ldap.ora. If you add the listener entry just for this DB, you can keep the default <em>ldap.ora<\/em> in the regular <em>TNS_ADMIN<\/em> directory. Thus one can apply the following principle:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Use a generic <em>ldap.ora<\/em> configuration in the TNS_ADMIN directory. e.g which is valid for most of the database on this server<\/li><li>Add a static listener configuration for each database which does have to use a dedicate Oracle Enterprise User Security configuration and therefor a dedicated <em>ldap.ora<\/em>.<\/li><\/ul>\n\n\n\n<p>This method is not only helpful when configuring LDAP server or Oracle Enterprise User Security, but also in other SQLNet use cases. In particular the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Define TNS_ADMIN and use a dedicate <em>sqlnet.ora <\/em>configuration for Kerberos authentication. e.g. when you want to use or engineer Kerberos authentication for just one database in an shared environment.<\/li><li>Define TNS_ADMIN and use dedicate <em>sqlnet.ora <\/em>configuration for network encryption.<\/li><li>Define LDAP_ADMIN for dedicated <em>ldap.ora<\/em> or <em>dsi.ora<\/em> files for engineering centrally managed users.<\/li><li>And a couple more&#8230;<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">References <\/h2>\n\n\n\n<p>A few links and references related to this blog post<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Oracle Support Document <a href=\"https:\/\/support.oracle.com\/epmos\/faces\/DocumentDisplay?id=728043.1\">728043.1<\/a> <em>Use of DIRECTORY_SERVERS in LDAP.ORA &amp; Known issues<\/em><\/li><li>Oracle Support Document <a href=\"https:\/\/support.oracle.com\/epmos\/faces\/DocumentDisplay?id=363283.1\">363283.1<\/a> <em>What Is The Search Order For The LDAP.ORA File?<\/em><\/li><li>Search for <a href=\"https:\/\/docs.oracle.com\/apps\/search\/search.jsp?q=ENVS&amp;category=database\">ENVS<\/a> in the Oracle Database Bookshelf<\/li><li>Oracle\u00ae Database Net Services Reference 11g Release 1 (11.1)  <a href=\"https:\/\/docs.oracle.com\/cd\/B28359_01\/network.111\/b28317\/listener.htm#i501193\">ENVS<\/a><\/li><\/ul>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Recently I came across the situation where I have to configure Enterpriser User Security for a database server with multiple databases for different directories. This is quite tricky when using a shared Oracle Home and a central TNS_ADMIN directory for SQLNet configuration. A common TNS_ADMIN also implies the use of only one ldap.ora file. Several [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[179,180,181,154,142],"tags":[144,18,111,168],"class_list":["post-3444","post","type-post","status-publish","format-standard","hentry","category-12r2","category-18c","category-19c","category-enterprise-user-security","category-oud","tag-eus","tag-trivadiscontent","tag-tvdsecexpert","tag-trivadis_smarp"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p1aErb-Ty","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":9217,"url":"https:\/\/www.oradba.ch\/wordpress\/2022\/03\/easy-replacement-of-tnsnames-ora-with-ldap-directory-server\/","url_meta":{"origin":3444,"position":0},"title":"Easy replacement of tnsnames.ora with LDAP Directory Server","author":"Stefan","date":"1. March 2022","format":false,"excerpt":"The tnsnames.ora is a configuration file for Oracle database respectively Oracle Net Service Names resolution. It contains network service names that are mapped to connection descriptors for the local naming method. With the help of tnsnames.ora Oracle clients respectively the users can easily access Oracle databases. The connection descriptors provides\u2026","rel":"","context":"In &quot;19c&quot;","block_context":{"text":"19c","link":"https:\/\/www.oradba.ch\/wordpress\/category\/oracle-database\/19c\/"},"img":{"alt_text":"Oracle Net Service Names","src":"https:\/\/i0.wp.com\/www.oradba.ch\/wordpress\/wp-content\/uploads\/OracleNamesLDAP_basic.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.oradba.ch\/wordpress\/wp-content\/uploads\/OracleNamesLDAP_basic.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.oradba.ch\/wordpress\/wp-content\/uploads\/OracleNamesLDAP_basic.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.oradba.ch\/wordpress\/wp-content\/uploads\/OracleNamesLDAP_basic.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/www.oradba.ch\/wordpress\/wp-content\/uploads\/OracleNamesLDAP_basic.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/www.oradba.ch\/wordpress\/wp-content\/uploads\/OracleNamesLDAP_basic.png?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":2786,"url":"https:\/\/www.oradba.ch\/wordpress\/2018\/09\/oracle-unified-directory-access-log-parsing-system-alps\/","url_meta":{"origin":3444,"position":1},"title":"Oracle Unified Directory Access Log Parsing System ALPS","author":"Stefan","date":"25. September 2018","format":false,"excerpt":"For one of my customers I had to analyse the log files of Oracle Unified Directory from time to time. In particular the access log file. During my research I came across the MOS note 2042620.1 and the Access Log Parsing System or short ALPS. ALPS is a small and\u2026","rel":"","context":"In &quot;Oracle Unified Directory&quot;","block_context":{"text":"Oracle Unified Directory","link":"https:\/\/www.oradba.ch\/wordpress\/category\/oud\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.oradba.ch\/wordpress\/wp-content\/uploads\/ALPS_Dashboard-300x221.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.oradba.ch\/wordpress\/wp-content\/uploads\/ALPS_Dashboard-300x221.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.oradba.ch\/wordpress\/wp-content\/uploads\/ALPS_Dashboard-300x221.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":2799,"url":"https:\/\/www.oradba.ch\/wordpress\/2018\/09\/oracle-security-at-trivadis-techevent-fall-2018\/","url_meta":{"origin":3444,"position":2},"title":"Oracle Security at Trivadis TechEvent Fall 2018","author":"Stefan","date":"26. September 2018","format":false,"excerpt":"A few days ago the semi-annual Trivadis TechEvent took place. As always, it was a great IT event where Trivadis employees and customers had the opportunity to exchange and discuss a variety of topics. I had the pleasure to give one lecture about Oracle 18c New Security Features as well\u2026","rel":"","context":"In &quot;12cR2&quot;","block_context":{"text":"12cR2","link":"https:\/\/www.oradba.ch\/wordpress\/category\/oracle-database\/12cr2\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2185,"url":"https:\/\/www.oradba.ch\/wordpress\/2016\/09\/losing-the-oracle-wallet-for-enterprise-user-security\/","url_meta":{"origin":3444,"position":3},"title":"Losing the Oracle Wallet for Enterprise User Security","author":"Stefan","date":"14. September 2016","format":false,"excerpt":"Having a reliable backup solution for your Transparent Data Encryption (TDE) or Enterprise User Security (EUS) Wallets, is beyond discussion. Nevertheless it can happen that you lose or corrupt the Oracle Wallet. With Transparent Data Encryption (TDE), this is really bad luck, because you can not access your encrypted data.\u2026","rel":"","context":"In &quot;11gR2&quot;","block_context":{"text":"11gR2","link":"https:\/\/www.oradba.ch\/wordpress\/category\/oracle-database\/11gr2\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2344,"url":"https:\/\/www.oradba.ch\/wordpress\/2017\/08\/oracle-unified-directory-12-released\/","url_meta":{"origin":3444,"position":4},"title":"Oracle Unified Directory 12 Released","author":"Stefan","date":"31. August 2017","format":false,"excerpt":"Finally end of working day. But while reading some newsletter and mails on my way home, I realised that there will be some work at home. After a long wait, Oracle has finally released Oracle Unified Directory 12c :-) A overview of the new features: Improved performance and scalability Support\u2026","rel":"","context":"In &quot;Oracle Unified Directory&quot;","block_context":{"text":"Oracle Unified Directory","link":"https:\/\/www.oradba.ch\/wordpress\/category\/oud\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2943,"url":"https:\/\/www.oradba.ch\/wordpress\/2019\/03\/configure-oracle-eusm-to-use-ldaps\/","url_meta":{"origin":3444,"position":5},"title":"Configure Oracle EUSM to use LDAPS","author":"Stefan","date":"1. March 2019","format":false,"excerpt":"With the introduction of Oracle 18c, [cci]eusm[\/cci] is officially designated as an Enterprise User Security Utility. It is now officially documented of the Enterprise User Security Administrator's Guide. Before we had to be content with the somewhat sparse MOS note 1085065.1 EUSM, Command Line Tool For EUS Administration and Some\u2026","rel":"","context":"In &quot;18c&quot;","block_context":{"text":"18c","link":"https:\/\/www.oradba.ch\/wordpress\/category\/oracle-database\/18c\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/posts\/3444","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/comments?post=3444"}],"version-history":[{"count":8,"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/posts\/3444\/revisions"}],"predecessor-version":[{"id":3452,"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/posts\/3444\/revisions\/3452"}],"wp:attachment":[{"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/media?parent=3444"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/categories?post=3444"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/tags?post=3444"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}