Configuring Microsoft Active

Directory for Oracle Net Naming

An Oracle White Paper

April 2014

Configuring Microsoft Active Directory for Oracle Net Naming Page 2

Configuring Microsoft Active Directory for Oracle Net

Conclusion .......................................................................................................... 7

Configuring Microsoft Active Directory for Oracle Net Naming Page 3

Configuring Microsoft Active Directory for Oracle Net

INTRODUCTION

The Oracle Net naming method resolves names to a database connect

descriptor. One of the naming methods is directory-naming method. Directory

naming resolves a database service name, net service name, or net service alias

stored in a centralized LDAP-compliant directory server, including Oracle

Internet Directory and Microsoft Active Directory. Centralized administration

of database services and net service names makes them easier to add or

Directory schema objects and creating OracleContext container. Oracle

Schema objects are sets of rules for Oracle Net Services and Oracle Database

entries and their attributes stored in Active Directory. Active Directory name

resolution provides central administration of database services and net service

names, making it easier to add or relocate services leveraging existing windows

environment in an enterprise.

Oracle Net naming with Active Directory is supported for clients on Windows

hosts. Services (database) can be running on any machine, and do not

necessarily have to be Windows hosts.

This paper outlines detailed steps to configure Active Directory for supporting

Configuring Microsoft Active Directory for Oracle Net Naming Page 4

After promoting a Windows Server to become an Active Directory domain

controller, Active Directory must be configured to allow an Oracle Context to

be created.

Windows Server Active Directory allows only authenticated users to initiate an

LDAP request against Windows Server based domain controllers. An LDAP

browser/modifier is required to enable anonymous browsing. An easy way to

modify required attribute values is to use the Windows ADSI Edit utility.

Configuration [acme.com]

CN=Configuration, DC=ACME, DC=COM

CN=Services

CN=Windows NT

CN=Directory Service

Right- click the CN=Directory Service container, select Properties, and then

scroll down to select the dSHeuristics attribute.

Edit the dSHeuristics attribute and set its value to 0000002. Setting this value

allows anonymous clients to perform any operation that is permitted by the

access control list (ACL)

create your Oracle Context. Oracle NetCA is a graphical, wizard-based tool

used to configure and manage Oracle Network configurations. You can create

the Oracle Context during or after Oracle Database custom installation.

You can create only one Oracle Context for each Windows domain

(administrative context). You must have the right to create domain and

Configuring Microsoft Active Directory for Oracle Net Naming Page 5

enterprise objects in order to create the Oracle Context in Active Directory

with Oracle Net Configuration Assistant.

1. Run the Network Configuration Assistant (NetCA):

a) Click Start, and then click All Programs.

b) Click Oracle, Configuration and Migration Tools, then Net

4. Select the option to configure the directory for Oracle usage and create

the Oracle Schema and Context, then click next.

5. Enter the Active Directory hostname, and then click next. If you are

configuring the forest for the first time, you must enter the hostname

of the Schema Master Controller and you must be logged in as a user

from that domain with privilege to create schema objects.

6. Select the option to upgrade the Oracle Schema, and then click next.

7. The next page should denote successful directory configuration:

Directory usage configuration complete!

Example: The distinguished name of your default Oracle Context is:

The root domain controller must be the operations master that allows schema

updates. See your operating system documentation for instructions.

If the Active Directory display is not configured to accept all 24-default

languages, then Oracle schema object creation can fail while Oracle Net

Configuration Assistant is configuring Active Directory as the directory server.

Before running Oracle Net Configuration Assistant to complete directory

access configuration, verify that the display specifiers for all 24 languages are

populated by entering the following at the command prompt:

cn=Configuration, domain context -f temp file

Configuring Microsoft Active Directory for Oracle Net Naming Page 6

where:

example, dc=example, dc=com

temp file is a file where you want to put the output.

If the command reports that fewer than 24 entries were found, then you can

you cannot view Oracle database entries in Active Directory interfaces.

You can manually add these entries into Active Directory after the Oracle

schema object has been created by doing the following, using the same

Windows user identification you used when creating the Oracle schema object

with Net Configuration Assistant:

1. Open a command shell.

2. Change directory to ORACLE_HOME\ldap\schema\ad.

3. Copy adDisplaySpecifiers_us.sbs to adDisplaySpecifiers_us.ldif.

4. Copy adDisplaySpecifiers_other.sbs to adDisplaySpecifiers_other.ldif.

5. Edit each of these. ldif files, replacing all occurrences of

where <ad hostname> is the hostname of the Active Directory domain

controller to which you want to load the display specifiers.

Successful completion of OracleContext enables Active Directory to store

NetServices and DatabaseServces. Net Manager or Oracle Enterprise Manager

can be used to create service names in Active Directory.

Default access control lists (ACLs) on Net Service names do not allow

anonymous reading of their attributes. If the Oracle client binds anonymously

for name resolution, then ACLs on OracleContext and Net Service names

should be changed to allow anonymous reading. Beginning with Oracle

Database 11g, database administrators can restrict access to a service by

Configuring Microsoft Active Directory for Oracle Net Naming Page 7

configuring Oracle clients to authenticate and control the services available to

them by ACLs on services. Use the