Password Management with Oracle Internet Directory

Password Management with Oracle Internet Directory

User password resets - the bane of every sysadmin. Automating this tedium is a major benefit of integrating your E-Business Suite environment with Oracle Application Server 10g. By delegating user authentication to Single Sign-On 10g and Oracle Internet Directory 10g, you can take advantage of the latter's automatic password reset capabilities.

But First, Some Basics About Account Management

In a standard E-Business Suite environment, user passwords are stored and encrypted in the user's records in the E-Business Suite's FND_USER directory.

When an E-Business Suite environment is integrated with Single Sign-On and Oracle Internet Directory, Apps user accounts are linked to Oracle Internet Directory user accounts like this:

Where Does The User Log In?

When a user's E-Business Suite account is linked to an account in Oracle Internet Directory, sysadmins have the option of specifying how the user can log into the E-Business Suite. This can be specified for each individual user.

Available options are:

• Users can log in externally via Single Sign-On
  
• Users can bypass Single Sign-On and log in locally to the E-Business Suite
• Users can log in via both of the methods above

E-Business Suite Doesn't Need To Store A Password

In the external scenario, all user authentication is handled by Single Sign-On and Oracle Internet Directory. For so-called external users, passwords are stored exclusively in Oracle Internet Directory. Single Sign-On displays a login screen and collects the user's userid and password, and Oracle Internet Directory checks that those credentials match the user's entry within the Oracle Internet Directory LDAP user directory.

After users successfully log into Single Sign-On, they receive security tokens that the E-Business Suite recognizes and uses to establish their E-Business Suite session, based on a chain of trust that looks like this:

The E-Business Suite uses those Single Sign-On security tokens in place of checking for a password. So, it doesn't need to store user passwords for external users at all.

No More Manual Password Changes

So, in a refreshing switch for veteran Apps sysadmins, all external users can reset their own passwords using Oracle Internet Directory's Delegated Administration Service. This represents the end of the era of manual password resets for Apps users.

Logging Into The E-Business Suite Directly

There are specific users that must always be able to log into the E-Business Suite directly. These users include Apps DBAs or system administrators, who still need to be able to get into Apps even if the external Single Sign-On and Oracle Internet Directory instances are unavailable due to maintenance windows.

These are considered to be local users, so their passwords are always stored in the E-Business Suite's FND_USER directory, not Oracle Internet Directory. Passwords for these users still need to be maintained manually using the regular E-Business Suite security forms that you know and love.

A Tricky Case: "Both"

There might be a subset of users who need to be able to access the E-Business Suite via Single Sign-On as well as locally. These users would be given access to both login methods, which means that passwords must be stored in both locations: Oracle Internet Directory and the E-Business Suite's FND_USER directory.

The password management overhead is higher for these users, so you'll want to use this option very sparingly:

• Password changes made in the E-Business Suite are automatically sent to Oracle Internet Directory
  
• Password changes made in Oracle Internet Directory must be manually repeated in the E-Business Suite using the E-Business Suite security forms

The asymmetry in the tasks above is because of this: we can decrypt passwords stored in the E-Business Suite, which allows us to send them to Oracle Internet Directory. Passwords in Oracle Internet Directory, however, are hashed, which prevents us from transmitting a copy to the E-Business Suite.