We have a legacy application and we have full access to source code and platform running it, so virtually any change can be implemented if required.
The application is a Java Swing heavy-weight GUI (desktop) accessing directly the database through JDBC in a 2-tier fashion. At application start-up, the user enters his/her credentials consisting on user&password. The current security schema is:
- Oracle Database 10g Enterprise (migrating to 11g) with Oracle Internet Directory 10g (OID).
- Oracle uses Enterprise Users so when connecting to DB, user provided in connection comes from GUI and Oracle validates against OID.
- DB permissions are managed through Enterprise Roles. Each ER defined in DB maps a Group defined in OID, so user DB access to objects (tables, procedures...) are controlled by the Groups he/she belongs in OID.
- Several GUI users can create others users, so create they in OID, assigning to the corresponding OID Groups in order to grant DB permissions. This is done using special Oracle permissions in OID to this "super-user". This is done from GUI using standard LDAP API, not OID API. The GUI user connects to OID with its credentials and performs LDAP operations.
The idea is to replace OID with Microsoft Active Directory, so the database would validate user against AD. DB permissions defined in ER would be retrieved also from AD, based on the Groups the users belongs to.
Assuming Oracle DB 11g and MS Windows Server 2008 (or upper versions if necessary), is that possible?
- Oracle is installed on Linux, RH typically.
- Oracle Virtual Directory can not be used nor any Identity Management Oracle product, just Oracle DB Enterprise.
- GUI application executes on Windows workstations that are already in the Windows domain with the AD, son can use their OS credentials instead custom users used by GUI, but this must be done in Java (any version supported).
- SSL, Certificates are not the preferred way, as they required to be provisioned.
- Kerberos with MS KDC is also not the preferred way.
- The new security schema with AD could lead to a less secure environment, but this is acceptable.
- Prefer not to add third-party products to the security schema.
- Oracle DB - MS AD integration should be supported by Oracle and Microsoft.
We need some advice from people with previous experience in similar installations about if it is possible the Oracle - AD solution. Some guidance and steps are welcome!