|
Oracle® Application Server Administrator's Guide
10g Release 2 (10.1.2) B13995-06 |
|
 Previous |
 Next |
|
Oracle® Application Server Administrator's Guide
10g Release 2 (10.1.2) B13995-06 |
|
|
Previous |
Next |
access control
The ability of a system to grant or limit access to specific data for specific clients or groups of clients.
Access Control Lists (ACLs)
The group of access directives that you define. The directives grant levels of access to specific data for specific clients, or groups of clients, or both.
Advanced Encryption Standard
Advanced Encryption Standard (AES) is a cryptographic algorithm that has been approved by the National Institute of Standards and Technology as a replacement for DES. The AES standard is available in Federal Information Processing Standards Publication 197. The AES algorithm is a symmetric block cipher that can process data blocks of 128 bits, using cipher keys with lengths of 128, 192, and 256 bits.
attribute
An item of information that describes some aspect of an entry in an LDAP directory. An entry comprises a set of attributes, each of which belongs to an object class. Moreover, each attribute has both a type, which describes the kind of information in the attribute, and a value, which contains the actual data.
authentication
The process of verifying the identity of a user, device, or other entity in a computer system, often as a prerequisite to granting access to resources in a system. A recipient of an authenticated message can be certain of the message's origin (its sender). Authentication is presumed to preclude the possibility that another party has impersonated the sender.
authentication method
A security method that verifies the identity of a user, client, or server in distributed environments. Network authentication methods can also provide the benefit of single sign-on (SSO) for users. The following authentication methods are supported in Oracle Application Server:
authorization
Authorization is the evaluation of security constraints to send a message or make a request. Authorization uses specific criteria to determine whether the request should be permitted. The criteria are authentication and restriction.
auto login wallet
An Oracle Wallet Manager feature that enables PKI- or password-based access to services without providing credentials at the time of access. This auto login access stays in effect until the auto login feature is disabled for that wallet. File system permissions provide the necessary security for auto login wallets. When auto login is enabled for a wallet, it is only available to the operating system user who created that wallet. Sometimes these are called "SSO wallets" because they provide single sign-on capability.
certificate
An ITU X.509 Version 3 standard data structure that securely binds an identity to a public key.
A certificate is created when an entity's public key is signed by a trusted identity, a certificate authority. The certificate ensures that the entity's information is correct and that the public key actually belongs to that entity.
A certificate contains the entity's name, identifying information, and public key. It is also likely to contain a serial number, expiration date, and information about the rights, uses, and privileges associated with the certificate. Finally, it contains information about the certificate authority that issued it.
certificate authority
A trusted third party that certifies that other entities—users, databases, administrators, clients, servers—are who they say they are. When it certifies a user, the certificate authority first seeks verification that the user is not on the certificate revocation list (CRL), then verifies the user's identity and grants a certificate, signing it with the certificate authority's private key. The certificate authority has its own certificate and public key which it publishes. Servers and clients use these to verify signatures the certificate authority has made. A certificate authority might be an external company that offers certificate services, or an internal organization such as a corporate MIS department.
certificate chain
An ordered list of certificates containing an end-user or subscriber certificate and its certificate authority certificates.
certificate request
A request, which consists of three parts: certification request information, a signature algorithm identifier, and a digital signature on the certification request information. The certification request information consists of the subject's distinguished name, public key, and an optional set of attributes. The attributes may provide additional information about the subject identity, such as postal address, or a challenge password by which the subject entity may later request certificate revocation. See PKCS #10
certificate revocation lists
(CRLs) Signed data structures that contain a list of revoked certificates. The authenticity and integrity of the CRL is provided by a digital signature appended to it. Usually, the CRL signer is the same entity that signed the issued certificate.
Cipher Block Chaining (CBC)
An encryption method that protects against block replay attacks by making the encryption of a cipher block dependent on all blocks that precede it; it is designed to make unauthorized decryption incrementally more difficult. Oracle Advanced Security employs outer cipher block chaining because it is more secure than inner cipher block chaining, with no material performance penalty.
cipher suite
A set of authentication, encryption, and data integrity algorithms used for exchanging messages between network nodes. During an SSL handshake, for example, the two nodes negotiate to see which cipher suite they will use when transmitting messages back and forth.
cipher suite name
Cipher suites describe the kind of cryptographics protection that is used by connections in a particular session.
client
A user, software application (such as a browser), or computer that requests the services, data, or processing of another application or computer (the server). A client relies on a service.
cluster
A collection of application server instances with identical configuration and application deployment. Clusters enforce homogeneity between member instances so that a cluster of application server instances can appear and function as a single instance. With appropriate front-end load balancing, any instance in an application server cluster can serve client requests. This simplifies configuration and deployment across multiple instances and enables fault tolerance among clustered instances.
confidentiality
A function of cryptography. Confidentiality guarantees that only the intended recipient of a message can view the message (decrypt the ciphertext).
connect descriptor
A specially formatted description of the destination for a network connection. A connect descriptor contains destination service and network route information. The destination service is indicated by using its service name for Oracle databases. The network route provides, at a minimum, the location of the listener through use of a network address. See connect identifier.
connect identifier
A connect descriptor or a name that maps to a connect descriptor. A connect identifier can be a net service name, database service name, or net service alias. Users initiate a connect request by passing a username and password along with a connect identifier in a connect string for the service to which they wish to connect:
CONNECT username/password@connect_identifier
connect string
Information the user passes to a service to connect, such as username, password and net service name. For example:
CONNECTusername/password@net_service_name
credentials
A username, password, or certificate used to gain access to Oracle Database, Oracle Application Server 10g, or the Oracle Identity Management infrastructure.
CRL Distribution Point
(CRL DP) An optional extension specified by the X.509 version 3 certificate standard, which indicates the location of the Partitioned CRL where revocation information for a certificate is stored. Typically, the value in this extension is in the form of a URL. CRL DPs allow revocation information within a single certificate authority domain to be posted in multiple CRLs. CRL DPs subdivide revocation information into more manageable pieces to avoid proliferating voluminous CRLs, thereby providing performance benefits. For example, a CRL DP is specified in the certificate and can point to a file on a Web server from which that certificate's revocation information can be downloaded.
decryption
The process of converting the contents of an encrypted message (ciphertext) back into its original readable format (plaintext).
Diffie-Hellman key negotiation algorithm
A method that lets two parties communicating over an insecure channel to agree upon a random number known only to them. Though the parties exchange information over the insecure channel during execution of the Diffie-Hellman key negotiation algorithm, it is computationally infeasible for an attacker to deduce the random number they agree upon by analyzing their network communications. Oracle Advanced Security uses the Diffie-Hellman key negotiation algorithm to generate session keys.
digital signature
A digital signature is created when a public key algorithm is used to sign the sender's message with the sender's private key. The digital signature assures that the document is authentic, has not been forged by another entity, has not been altered, and cannot be repudiated by the sender.
directory naming
A naming method that resolves a database service, net service name, or net service alias to a connect descriptor stored in a central directory server.
directory naming context
A subtree which is of significance within a directory server. It is usually the top of some organizational subtree. Some directories only permit one such context which is fixed; others permit none to many to be configured by the directory administrator.
distinguished name (DN)
The unique name of an LDAP-based directory entry. A distinguished name comprises all of the individual names of the parent entries back to the root.
domain
Any tree or subtree within the Domain Name System (DNS) namespace. Domain most commonly refers to a group of computers whose host names share a common suffix, the domain name.
Domain Name System (DNS)
A system for naming computers and network services that is organized into a hierarchy of domains. DNS is used in TCP/IP networks to locate computers through user-friendly names. DNS resolves a friendly name into an IP address, which is understood by computers.
encrypted text
Text that has been encrypted, using an encryption algorithm; the output stream of an encryption process. On its face, it is not readable or decipherable, without first being subject to decryption. Also called ciphertext. Encrypted text ultimately originates as plaintext.
encryption
The process of disguising a message rendering it unreadable to any but the intended recipient.
entry
In the context of a directory service, an entry is the building block of a directory. An entry is a collection of information about an object in the directory. Each entry is composed of a set of attributes that describe one particular trait of the object. For example, if a directory entry describes a person, that entry can have attributes such as first name, last name, telephone number, or e-mail address.
external authentication
Verification of a user identity by a third party authentication service, such as Kerberos.
farm
A collection of clusters and instances that share the same Oracle Application Server Infrastructure. A farm can be file-based or database based. The repository for a file-based farm exists within the middle-tier instance Oracle home. The repository for a database-based farm exists within OracleAS Metadata Repository.
Federal Information Processing Standard (FIPS)
A U.S. government standard that defines security requirements for cryptographic modules—employed within a security system protecting unclassified information within computer and telecommunication systems. Published by the National Institute of Standards and Technology (NIST).
grid computing
A computing architecture that coordinates large numbers of servers and storage to act as a single large computer. Oracle Grid Computing creates a flexible, on-demand computing resource for all enterprise computing needs. Applications running on the Oracle 10g grid computing infrastructure can take advantage of common infrastructure services for failover, software provisioning, and management. Oracle Grid Computing analyzes demand for resources and adjusts supply accordingly.
HTTP
Hypertext Transfer Protocol. The underlying format used by the Web to format and transmit messages and determine what actions Web servers and browsers should take in response to various commands. HTTP is the protocol used between Oracle Application Server and clients.
HTTP server
A server that receives HTTP requests from remote browsers, converts the requested URL to a filename, and returns the file to the requester.
HTTPS
Secure Hypertext Transfer Protocol. A protocol that uses the Secure Sockets Layer (SSL) as a sublayer under the regularHTTP application layer to encrypt and decrypt user page requests as well as the pages that are returned by the origin server.
identity
The combination of the public key and any other public information for an entity. The public information may include user identification data such as an e-mail address. A user certified as being the entity it claims to be.
identity management
The creation, management, and use of online, or digital, entities. Identity management involves securely managing the full life cycle of a digital identity from creation (provisioning of digital identities) to maintenance (enforcing organizational policies regarding access to electronic resources), and, finally, to termination.
identity management realm
A subtree in Oracle Internet Directory, including not only an Oracle Context, but also additional subtrees for users and groups, each of which are protected with access control lists.
IIOP
Internet inter-ORB protocol. An Internet transport protocol used by CORBA objects to communicate with each other. In the context of Oracle Application Server, IIOP is used by ECO/Java and EJB objects. IIOP is also used between Oracle Application Server components.
instance
The set of processes required to run the configured components within an application server installation. There can be only one application server instance for each application server installation. The terms installation and instance are sometimes used interchangeably; however, it is important to remember that an installation is the set of files installed into an Oracle home and an instance is a set of processes associated with those files.
integrity
The guarantee that the contents of the message received were not altered from the contents of the original message sent.
Java Database Connectivity (JDBC)
An industry-standard Java interface for connecting to a relational database from a Java program, defined by Sun Microsystems.
Kerberos
A network authentication service developed under Massachusetts Institute of Technology's Project Athena that strengthens security in distributed environments. Kerberos is a trusted third-party authentication system that relies on shared secrets and assumes that the third party is secure. It provides single sign-on (SSO) capabilities and database link authentication (MIT Kerberos only) for users, provides centralized password storage, and enhances PC security.
key
When encrypting data, a key is a value which determines the ciphertext that a given algorithm will produce from given plaintext. When decrypting data, a key is a value required to correctly decrypt a ciphertext. A ciphertext is decrypted correctly only if the correct key is supplied.
With a symmetric encryption algorithm, the same key is used for both encryption and decryption of the same data. With an asymmetric encryption algorithm (also called a public-key encryption algorithm or public-key cryptosystem), different keys are used for encryption and decryption of the same data.
ldap.ora file
A file created by Oracle Net Configuration Assistant that contains the following directory server access information:
Type of directory server
Location of the directory server
Default identity management realm or Oracle Context (including ports) that the client or server will use
Lightweight Directory Access Protocol (LDAP)
A standard, extensible directory access protocol. It is a common language that LDAP clients and servers use to communicate. The framework of design conventions supporting industry-standard directory products, such as the Oracle Internet Directory.
listener
A process that resides on the server whose responsibility is to listen for incoming client connection requests and manage the traffic to the server. A listener can be an HTTP server that handles incoming requests and routes them to the dispatcher.
Every time a client requests a network session with a server, a listener receives the actual request. If the client information matches the listener information, then the listener grants a connection to the server.
listener.ora file
A configuration file for the Oracle Database listener that identifies the listener name, protocol addresses on which it is accepting connection requests, and services for which the listener is listening.
The listener.ora file typically resides in ORACLE_HOME/network/admin on UNIX platforms and ORACLE_HOME\network\admin on Windows.
man-in-the-middle
A security attack characterized by the third-party, surreptitious interception of a message, wherein the third party, the man-in-the-middle, decrypts the message, re-encrypts it (with or without alteration of the original message), and re-transmits it to the originally-intended recipient—all without the knowledge of the legitimate sender and receiver. This type of security attack works only in the absence of authentication.
message digest
Representation of text as a string of single digits. It is created using a formula called a one-way hash function, which is an algorithm that turns a message into a single string of digits. One-way means that it is almost impossible to derive the original message from the string of digits. The calculated message digest can be compared with the message digest that is decrypted with a public key to verify that the message has not been tampered with.
naming method
The resolution method used by a client application to resolve a connect identifier to a connect descriptor when attempting to connect to a service.
National Institute of Standards and Technology (NIST)
An agency within the U.S. Department of Commerce responsible for the development of security standards related to the design, acquisition, and implementation of cryptographic-based security systems within computer and telecommunication systems, operated by a Federal agency or by a contractor of a Federal agency or other organization that processes information on behalf of the Federal Government to accomplish a Federal function.
net service alias
An alternative name for a directory naming object in a directory server. A directory server stores net service aliases for any defined net service name or database service. A net service alias entry does not have connect descriptor information. Instead, it only references the location of the object for which it is an alias. When a client requests a directory lookup of a net service alias, the directory determines that the entry is a net service alias and completes the lookup as if it was actually the entry it is referencing.
net service name
The name used by clients to identify a database server. A net service name is mapped to a port number and protocol. Also known as a connect string, or database alias.
network authentication service
A means for authenticating clients to servers, servers to servers, and users to both clients and servers in distributed environments. A network authentication service is a repository for storing information about users and the services on different servers to which they have access, as well as information about clients and servers on the network. An authentication server can be a physically separate machine, or it can be a facility co-located on another server within the system. To ensure availability, some authentication services may be replicated to avoid a single point of failure.
network listener
A listener on a server that listens for connection requests for one or more databases on one or more protocols. See listener.
non-repudiation
Incontestable proof of the origin, delivery, submission, or transmission of a message.
obfuscation
A process by which information is scrambled into a non-readable form, such that it is extremely difficult to de-scramble if the algorithm used for scrambling is not known.
object class
A named group of attributes. When you want to assign attributes to an entry, you do so by assigning to that entry the object classes that hold those attributes. All objects associated with the same object class share the same attributes.
Oracle Context
An entry in an LDAP-compliant internet directory called cn=OracleContext, under which all Oracle software relevant information is kept, including entries for checksumming security.
There can be one or more Oracle Contexts in a directory. An Oracle Context is usually located in an identity management realm.
Oracle Net Services
An Oracle product that enables two or more computers that run the Oracle server or Oracle tools to exchange data through a third-party network. Oracle Net Services support distributed processing and distributed database capability. Oracle Net Services is an open system because it is independent of the communication protocol, and users can interface Oracle Net to many network environments.
Oracle PKI certificate usages
Defines the purpose of the key contained in an certificate. Oracle PKI certificate usages are based on the key usages defined in the X.509 Version 3 standard.
PCMCIA cards
Small credit card-sized computing devices that comply with the Personal Computer Memory Card International Association (PCMCIA) standard. These devices, also called PC cards, are used for adding memory, modems, or as hardware security modules. PCMCIA cards that are used as hardware security modules securely store the private key component of a public and private key pair and some also perform the cryptographic operations as well.
peer identity
SSL connect sessions are between a particular client and a particular server. The identity of the peer may have been established as part of session setup. Peers are identified by X.509 certificate chains.
PEM
The Internet Privacy-Enhanced Mail protocols standard, adopted by the Internet Architecture Board to provide secure electronic mail over the Internet. The PEM protocols provide for encryption, authentication, message integrity, and key management. PEM is an inclusive standard, intended to be compatible with a wide range of key-management approaches, including both symmetric and public-key methods to encrypt data-encrypting keys. The specifications for PEM come from four Internet Engineering Task Force (IETF) documents: RFCs 1421, 1422, 1423, and 1424.
PKCS #10
An RSA Security, Inc., Public-Key Cryptography Standards (PKCS) specification that describes a syntax for certification requests. A certification request, also referred to as a certificate request, consists of a distinguished name, a public key, and optionally a set of attributes, collectively signed by the entity requesting certification.
PKCS #11
An RSA Security, Inc., Public-Key Cryptography Standards (PKCS) specification that defines an application programming interface (API), called Cryptoki, to hardware devices which hold cryptographic information and perform cryptographic operations. See also PCMCIA cards.
PKCS #12
An RSA Security, Inc., Public-Key Cryptography Standards (PKCS) specification that describes a transfer syntax for storing and transferring personal authentication credentials—typically in a format called a wallet.
private key
In public-key cryptography, this key is the secret key. It is primarily used for decryption but is also used for encryption with digital signatures. See public and private key pair.
proxy authentication
A process typically employed in an environment with a middle tier such as a firewall, wherein the end user authenticates to the middle tier, which then authenticates to the directory on the user's behalf—as its proxy. The middle tier logs into the directory as a proxy user. A proxy user can switch identities and, once logged into the directory, switch to the end user's identity. It can perform operations on the end user's behalf, using the authorization appropriate to that particular end user.
public and private key pair
A set of two numbers used for encryption and decryption, where one is called the private key and the other is called the public key. Public keys are typically made widely available, while private keys are held by their respective owners. Though mathematically related, it is generally viewed as computationally infeasible to derive the private key from the public key. Public and private keys are used only with asymmetric encryption algorithms, also called public-key encryption algorithms, or public-key cryptosystems. Data encrypted with either a public key or a private key from a key pair can be decrypted with its associated key from the key pair. However, data encrypted with a public key cannot be decrypted with the same public key, and data enwrapped with a private key cannot be decrypted with the same private key.
public key
In public-key cryptography, this key is made public to all. It is primarily used for encryption but can be used for verifying signatures. See public and private key pair.
public key encryption
The process where the sender of a message encrypts the message with the public key of the recipient. Upon delivery, the message is decrypted by the recipient using its private key.
public key infrastructure (PKI)
Information security technology utilizing the principles of public key cryptography. Public key cryptography involves encrypting and decrypting information using a shared public and private key pair. It provides for secure, private communications within a public network.
realm
1. Short for identity management realm. 2. A Kerberos object. A set of clients and servers operating under a single key distribution center/ticket-granting service (KDC/TGS). Services in different realms that share the same name are unique.
realm Oracle Context
An Oracle Context that is part of an identity management realm in Oracle Internet Directory.
restriction
A security scheme that restricts access to files provided by the server to client machines within certain groups of IP addresses or DNS domains.
schema
1. Database schema: A named collection of objects, such as tables, views, clusters, procedures, packages, attributes, object classes, and their corresponding matching rules, which are associated with a particular user. 2. LDAP directory schema: The collection of attributes, object classes, and their corresponding matching rules.
Secure Sockets Layer (SSL)
An industry standard protocol designed by Netscape Communications Corporation for securing network connections. SSL provides authentication, encryption, and data integrity using public key infrastructure (PKI).
server
There are two types of servers relevant to this product. One is Oracle Application Server, which is a collection of middleware services and tools that provide a scalable, robust, secure, and extensible platform for distributed, object-oriented applications. Oracle Application Server supports access to applications from both Web clients (browsers) using HTTP and Common Object Request Broker Architecture (CORBA) clients, which use the CORBA and the Internet Inter-ORB (IIOP) protocols. The other is Oracle Database Server, which is a relational database server dedicated to performing data management duties on behalf of clients using any number of possible interfaces.
service
1. A network resource used by clients; for example, Oracle Application Server or Oracle database server.
2. An executable process installed in the Windows registry and administered by Windows. Once a service is created and started, it can run even when no user is logged on to the computer.
service name
A logical representation of a database, which is the way a database is presented to clients. A database can be presented as multiple services and a service can be implemented as multiple database instances. The service name is a string that is the global database name, that is, a name comprising the database name and domain name, entered during installation or database creation.
session key
A key shared by at least two parties (usually a client and a server) that is used for data encryption for the duration of a single communication session. Session keys are typically used to encrypt network traffic; a client and a server can negotiate a session key at the beginning of a session, and that key is used to encrypt all network traffic between the parties for that session. If the client and server communicate again in a new session, they negotiate a new session key.
single key-pair wallet
A PKCS #12-format wallet that contains a single user certificate and its associated private key. The public key is imbedded in the certificate.
single sign-on (SSO)
The ability of a user to authenticate once, combined with strong authentication occurring transparently in subsequent connections to other databases or applications. Single sign-on lets a user access multiple accounts and applications with a single password, entered during a single connection. Single password, single authentication.
smart card
A plastic card (like a credit card) with an embedded integrated circuit for storing information, including such information as user names and passwords, and also for performing computations associated with authentication exchanges. A smart card is read by a hardware device at any client or server.
A smartcard can generate random numbers which can be used as one-time use passwords. In this case, smartcards are synchronized with a service on the server so that the server expects the same password generated by the smart card.
system identifier (SID)
A unique name for an Oracle instance. To switch between Oracle databases, users must specify the desired SID. The SID is included in the CONNECT DATA part of the connect descriptor in a tnsnames.ora file, and in the definition of the network listener in a listener.ora file.
tnsnames.ora
A file that contains connect descriptors; each connect descriptor is mapped to a net service name. The file may be maintained centrally or locally, for use by all or individual clients. This file typically resides in the following locations depending on your platform:
(UNIX) ORACLE_HOME/network/admin
(Windows) ORACLE_HOME\network\admin
token card
A device for providing improved ease-of-use for users through several different mechanisms. Some token cards offer one-time passwords that are synchronized with an authentication service. The server can verify the password provided by the token card at any given time by contacting the authentication service. Other token cards operate on a challenge-response basis. In this case, the server offers a challenge (a number) which the user types into the token card. The token card then provides another number (cryptographically-derived from the challenge), which the user then offers to the server.
trusted certificate
A trusted certificate, sometimes called a root key certificate, is a third party identity that is qualified with a level of trust. The trusted certificate is used when an identity is being validated as the entity it claims to be. Typically, the certificate authorities you trust are called trusted certificates. If there are several levels of trusted certificates, a trusted certificate at a lower level in the certificate chain does not need to have all its higher level certificates reverified.
wallet
A wallet is a data structure used to store and manage security credentials for an individual entity. A Wallet Resource Locator (WRL) provides all the necessary information to locate the wallet.
wallet obfuscation
An obfuscation used to store and access an Oracle wallet without querying the user for a password prior to access (supports single sign-on (SSO)).
Wallet Resource Locator
(WRL) A locator that provides all necessary information to locate a wallet. It is a path to an operating system directory that contains a wallet.
Windows native authentication
An authentication method that enables a client single login access to a Windows server and a database running on that server.
