CRAM-MD5 and SASL Binding

6-4 Oracle Fusion Middleware Administrators Guide for Oracle Virtual Directory

6.2.4 Client Certificate Authentication

Oracle Virtual Directory supports the ability for clients to authenticate to the virtual directory using X.509 digital certificates. The LDAP clients must support SSL and SASL to authenticate to the virtual directory using X.509 digital certificates. The following are the two modes in which SSL authentication works: ■ Using client certificates as a way to secure the connection but not to authenticate to the actual directory ■ Using SASL to bind to the Oracle Virtual Directory using the certificate The following is a list of guidelines for using client certificates for authentication: ■ If using certificates to bind to Oracle Virtual Directory, it is only used to authenticate to Oracle Virtual Directory, not to any back-end data-store. Public Key Infrastructure PKI prevents authentication to any back-end data-store because only the LDAP client has access to its private key, which is required to do client certificate authentication. Therefore, all Oracle Virtual Directory operations to the back-end data-store are performed as the Proxy DN account when using the LDAP Adapter. ■ Certificates contain their own distinguished names DNs, which sometimes do not match the DN of the user they are actually binding as. In these cases, you may have to map the DN of the certificate to the DN of an user in Oracle Virtual Directory for your Access Control Lists to work properly. You can use a plug-in to accomplish this mapping. ■ Oracle Virtual Directory accepts any certificate issued by the root CAs stored in its keys.jks file.

6.3 Understanding Oracle Virtual Directory Access Control

Oracle Virtual Directory provides granular access controls that can be applied uniformly across all connected data stores and which are compliant with the Internet Engineering Task Forces RFC 2820, Access Control Requirements for LDAP. The access control rules are modeled on the IETFs internet draft titles LDAP Access Control Model for LDAPv3, March 2, 2001 draft. This topic describes Oracle Virtual Directory access control and contains the following sections: ■ Source Directory Access Control ■ Oracle Virtual Directory Access Control ■ Access Control and Groups ■ Oracle Virtual Directory Access Control Components ■ Oracle Virtual Directory Access Control List Enforcement Note: Oracle Virtual Directory provides virtualized abstraction of one or more enterprise data sources into a single directory view. Accordingly, Access Control Lists ACLs and adapter namespaces are independent of each other. If you remove an entry, the ACLs associated with the entry are also removed. However, the ACLs associated with an entry are not affected if you change the root value of an adapter. ACLs and adapter namespaces must be configured independently of each other.