IPlanet authentication over SSL

Question

I've written a when_compare_replace plugin for out 9.0.2.0 OID server to perform user authentication against our iPlanet LDAP server for portal users. Authentication works great as is shown in the plugin souce below but it is being done in the clear, with no encryption on any of the data.
I've been looking and looking for ways to do the DBMS_LDAP.simple_bind_s over a secure connection and have come up with nothing. Our LDAP server has a SSL port running and performes authentication for other C and Java applications over an encrypted connection.
I've been trying to get the DBMS_LDAP.open_ssl command to work but I'm lost when it comes to the wallets. Why does the client need a wallet with a certificate to establish a secure connection? If we have to use a wallet with a certificate, what certificate do we use? Do we need to get a cert for the OID server so we can perform encrypted authentication?
Below is the full PL/SQL source of my OID plugin. It works as is for clear text authentication but this is not acceptable for a production system.
PACKAGE BODY PLUGIN_WHEN_COMPARE_REPLACE AS
    --Writen by Eric Dalquist, [email protected] - 07/01/2003 for use by Michigan
    --Technological University. This code may be freely used and modified as
    --long as the original author's name, email address and creation date are
    --included.
    PROCEDURE WHEN_COMPARE_REPLACE
        ldapplugincontext IN ODS.plugincontext,
        result OUT INTEGER,
        dn IN VARCHAR2,
        attrname IN VARCHAR2,
        attrval IN VARCHAR2,
        rc OUT INTEGER,
        errormsg OUT VARCHAR2
    IS
        local_session       DBMS_LDAP.session;
        local_bind_return   PLS_INTEGER;
        local_ldap_host     VARCHAR(256);
        local_ldap_port     PLS_INTEGER;
        remote_session      DBMS_LDAP.session;
        remote_bind_return  PLS_INTEGER;
        remote_ldap_host    VARCHAR(256);
        remote_ldap_port    PLS_INTEGER;
        remote_ssl_results  PLS_INTEGER;
        search_attributes   DBMS_LDAP.STRING_COLLECTION;
        search_return       PLS_INTEGER;
        search_result       DBMS_LDAP.MESSAGE;
        search_entry        DBMS_LDAP.MESSAGE;
        search_entries      PLS_INTEGER;
        MTU_userid  VARCHAR(16);
        MTU_dn      VARCHAR(256);
        retval      PLS_INTEGER;
        --DEBUGING VARIABLES
        auth_location   VARCHAR(16);
        auth_server     VARCHAR(256);
        auth_port       PLS_INTEGER;
        context_data    VARCHAR(2048);
    BEGIN
        remote_ldap_host := 'test1.mtu.edu';
        remote_ldap_port := 389;
        --Exceptions make fall-through authentication much more difficult
        --Turn them off.
        DBMS_LDAP.USE_EXCEPTION := FALSE;
        --Move this into the local auth section later
        --Cut down on proccessing time to save CPU
        FOR l_counter IN 1..ldapplugincontext.COUNT LOOP
            IF l_counter = 1 THEN
                local_ldap_host := ldapplugincontext(l_counter);
            ELSIF l_counter = 2 THEN
                local_ldap_port := ldapplugincontext(l_counter);
            END IF;
            --Debuging purposes only
            IF l_counter = ldapplugincontext.COUNT THEN
                context_data := context_data || ldapplugincontext(l_counter);
            ELSE
                context_data := context_data || ldapplugincontext(l_counter) || ', ';
            END IF;
        END LOOP;
        IF attrname = 'userpassword' THEN
            remote_session := DBMS_LDAP.init(remote_ldap_host, remote_ldap_port);
            --Instead of putting it in a STRING_COLLECTION first just extract
            --the first element (MTU userid) right away
            MTU_userid := DBMS_LDAP.explode_dn(dn, 1)(0);
            --Find the users MTU dn based on their user id
            search_attributes(1) := 'michigantechuniqueidentifier';
            search_return := DBMS_LDAP.search_s
                remote_session,
                'ou=people,dc=mtu,dc=edu',
                DBMS_LDAP.SCOPE_SUBTREE,
                '(&(uid=' || MTU_userid || ')(objectclass=posixaccount))',
                search_attributes,
                0,
                search_result
            rc := search_return;
                        --Get the number of entries found for the user id
            search_entries := DBMS_LDAP.count_entries(remote_session, search_result);
            IF search_return = DBMS_LDAP.SUCCESS AND search_entries = 1 THEN
                --for debuging
                auth_location := 'remote';
                auth_server := remote_ldap_host;
                auth_port := remote_ldap_port;
                --Retrieve the MTU dn from the search results
                search_entry := DBMS_LDAP.first_entry(remote_session, search_result);
                MTU_dn := DBMS_LDAP.get_dn(remote_session, search_entry);
                --Perform a simple bind against the remote LDAP server with the MTU dn and
                --password passed to us.
                remote_bind_return := DBMS_LDAP.simple_bind_s(remote_session, MTU_dn, attrval);
                rc := remote_bind_return;
                --If the bind was successful unbind from the server.
                IF remote_bind_return = DBMS_LDAP.SUCCESS THEN
                    retval := DBMS_LDAP.unbind_s(remote_session);
                END IF;
            ELSIF search_entries < 1 THEN
                --for debuging
                auth_location := 'local';
                auth_server := local_ldap_host;
                auth_port := local_ldap_port;
                --If the user does not exist on the remote LDAP server
                --attempt to authenticate it with the local LDAP server
                local_session := DBMS_LDAP.init(local_ldap_host, local_ldap_port);
                local_bind_return := DBMS_LDAP.simple_bind_s(local_session, dn, attrval);
                rc := local_bind_return;
                IF local_bind_return = DBMS_LDAP.success THEN
                    retval := DBMS_LDAP.unbind_s(local_session);
                END IF;
            ELSE
                --for debuging
                auth_location := 'none';
                --Too many results returned
                rc := DBMS_LDAP.RESULTS_TOO_LARGE;
            END IF;
            --the value of 'result' determines if the user is authenticated or not
            IF rc = DBMS_LDAP.SUCCESS THEN
                result := DBMS_LDAP.COMPARE_TRUE;
            ELSE
                result := DBMS_LDAP.COMPARE_FALSE;
            END IF;
            errormsg := DBMS_LDAP.err2string(rc);
        ELSE
            -- Do what WHEN_COMPARE_REPLACE would have done????
            rc := DBMS_LDAP.SUCCESS;
            -- Return false if unsure that the user should be authenticated
            result := DBMS_LDAP.COMPARE_FALSE;
            errormsg := 'Not sure what I should have done here :-)';
            --Correct behavior is probably to do a search based on the DN for
            --the specified attribute and then compare the passed value to the
            --found value but until logs show this procedure is used for
            --anything other than password authentication the functionality is
            --going to be left out.
        END IF;
        INSERT INTO WHEN_COMPARE_REPLACE_LOG VALUES
            to_char(sysdate, 'Month DD, YYYY HH24:MI:SS'),
            dn,
            attrname,
            attrval,
            MTU_userid,
            MTU_dn,
            result,
            rc,
            errormsg,
            'No Exception - Auth From: ' || auth_location,
            auth_server,
            auth_port,
            context_data
        COMMIT;
    EXCEPTION
        WHEN OTHERS THEN
            --An exception was raised
            rc := SQLCODE;
            errormsg := SUBSTR(SQLERRM, 1, 255);
            --Return false so authentication can't happen
            result := DBMS_LDAP.COMPARE_FALSE;
            INSERT INTO WHEN_COMPARE_REPLACE_LOG VALUES
                to_char(sysdate, 'Month DD, YYYY HH24:MI:SS'),
                dn,
                attrname,
                attrval,
                MTU_userid,
                MTU_dn,
                result,
                rc,
                errormsg,
                'Exception - Auth From: ' || auth_location,
                auth_server,
                auth_port,
                context_data
            COMMIT;
    END;
END PLUGIN_WHEN_COMPARE_REPLACE;

Answer 1

I've written a when_compare_replace plugin for out 9.0.2.0 OID server to perform user authentication against our iPlanet LDAP server for portal users. Authentication works great as is shown in the plugin souce below but it is being done in the clear, with no encryption on any of the data.
I've been looking and looking for ways to do the DBMS_LDAP.simple_bind_s over a secure connection and have come up with nothing. Our LDAP server has a SSL port running and performes authentication for other C and Java applications over an encrypted connection.
I've been trying to get the DBMS_LDAP.open_ssl command to work but I'm lost when it comes to the wallets. Why does the client need a wallet with a certificate to establish a secure connection? If we have to use a wallet with a certificate, what certificate do we use? Do we need to get a cert for the OID server so we can perform encrypted authentication?
Below is the full PL/SQL source of my OID plugin. It works as is for clear text authentication but this is not acceptable for a production system.
PACKAGE BODY PLUGIN_WHEN_COMPARE_REPLACE AS
    --Writen by Eric Dalquist, [email protected] - 07/01/2003 for use by Michigan
    --Technological University. This code may be freely used and modified as
    --long as the original author's name, email address and creation date are
    --included.
    PROCEDURE WHEN_COMPARE_REPLACE
        ldapplugincontext IN ODS.plugincontext,
        result OUT INTEGER,
        dn IN VARCHAR2,
        attrname IN VARCHAR2,
        attrval IN VARCHAR2,
        rc OUT INTEGER,
        errormsg OUT VARCHAR2
    IS
        local_session       DBMS_LDAP.session;
        local_bind_return   PLS_INTEGER;
        local_ldap_host     VARCHAR(256);
        local_ldap_port     PLS_INTEGER;
        remote_session      DBMS_LDAP.session;
        remote_bind_return  PLS_INTEGER;
        remote_ldap_host    VARCHAR(256);
        remote_ldap_port    PLS_INTEGER;
        remote_ssl_results  PLS_INTEGER;
        search_attributes   DBMS_LDAP.STRING_COLLECTION;
        search_return       PLS_INTEGER;
        search_result       DBMS_LDAP.MESSAGE;
        search_entry        DBMS_LDAP.MESSAGE;
        search_entries      PLS_INTEGER;
        MTU_userid  VARCHAR(16);
        MTU_dn      VARCHAR(256);
        retval      PLS_INTEGER;
        --DEBUGING VARIABLES
        auth_location   VARCHAR(16);
        auth_server     VARCHAR(256);
        auth_port       PLS_INTEGER;
        context_data    VARCHAR(2048);
    BEGIN
        remote_ldap_host := 'test1.mtu.edu';
        remote_ldap_port := 389;
        --Exceptions make fall-through authentication much more difficult
        --Turn them off.
        DBMS_LDAP.USE_EXCEPTION := FALSE;
        --Move this into the local auth section later
        --Cut down on proccessing time to save CPU
        FOR l_counter IN 1..ldapplugincontext.COUNT LOOP
            IF l_counter = 1 THEN
                local_ldap_host := ldapplugincontext(l_counter);
            ELSIF l_counter = 2 THEN
                local_ldap_port := ldapplugincontext(l_counter);
            END IF;
            --Debuging purposes only
            IF l_counter = ldapplugincontext.COUNT THEN
                context_data := context_data || ldapplugincontext(l_counter);
            ELSE
                context_data := context_data || ldapplugincontext(l_counter) || ', ';
            END IF;
        END LOOP;
        IF attrname = 'userpassword' THEN
            remote_session := DBMS_LDAP.init(remote_ldap_host, remote_ldap_port);
            --Instead of putting it in a STRING_COLLECTION first just extract
            --the first element (MTU userid) right away
            MTU_userid := DBMS_LDAP.explode_dn(dn, 1)(0);
            --Find the users MTU dn based on their user id
            search_attributes(1) := 'michigantechuniqueidentifier';
            search_return := DBMS_LDAP.search_s
                remote_session,
                'ou=people,dc=mtu,dc=edu',
                DBMS_LDAP.SCOPE_SUBTREE,
                '(&(uid=' || MTU_userid || ')(objectclass=posixaccount))',
                search_attributes,
                0,
                search_result
            rc := search_return;
                        --Get the number of entries found for the user id
            search_entries := DBMS_LDAP.count_entries(remote_session, search_result);
            IF search_return = DBMS_LDAP.SUCCESS AND search_entries = 1 THEN
                --for debuging
                auth_location := 'remote';
                auth_server := remote_ldap_host;
                auth_port := remote_ldap_port;
                --Retrieve the MTU dn from the search results
                search_entry := DBMS_LDAP.first_entry(remote_session, search_result);
                MTU_dn := DBMS_LDAP.get_dn(remote_session, search_entry);
                --Perform a simple bind against the remote LDAP server with the MTU dn and
                --password passed to us.
                remote_bind_return := DBMS_LDAP.simple_bind_s(remote_session, MTU_dn, attrval);
                rc := remote_bind_return;
                --If the bind was successful unbind from the server.
                IF remote_bind_return = DBMS_LDAP.SUCCESS THEN
                    retval := DBMS_LDAP.unbind_s(remote_session);
                END IF;
            ELSIF search_entries < 1 THEN
                --for debuging
                auth_location := 'local';
                auth_server := local_ldap_host;
                auth_port := local_ldap_port;
                --If the user does not exist on the remote LDAP server
                --attempt to authenticate it with the local LDAP server
                local_session := DBMS_LDAP.init(local_ldap_host, local_ldap_port);
                local_bind_return := DBMS_LDAP.simple_bind_s(local_session, dn, attrval);
                rc := local_bind_return;
                IF local_bind_return = DBMS_LDAP.success THEN
                    retval := DBMS_LDAP.unbind_s(local_session);
                END IF;
            ELSE
                --for debuging
                auth_location := 'none';
                --Too many results returned
                rc := DBMS_LDAP.RESULTS_TOO_LARGE;
            END IF;
            --the value of 'result' determines if the user is authenticated or not
            IF rc = DBMS_LDAP.SUCCESS THEN
                result := DBMS_LDAP.COMPARE_TRUE;
            ELSE
                result := DBMS_LDAP.COMPARE_FALSE;
            END IF;
            errormsg := DBMS_LDAP.err2string(rc);
        ELSE
            -- Do what WHEN_COMPARE_REPLACE would have done????
            rc := DBMS_LDAP.SUCCESS;
            -- Return false if unsure that the user should be authenticated
            result := DBMS_LDAP.COMPARE_FALSE;
            errormsg := 'Not sure what I should have done here :-)';
            --Correct behavior is probably to do a search based on the DN for
            --the specified attribute and then compare the passed value to the
            --found value but until logs show this procedure is used for
            --anything other than password authentication the functionality is
            --going to be left out.
        END IF;
        INSERT INTO WHEN_COMPARE_REPLACE_LOG VALUES
            to_char(sysdate, 'Month DD, YYYY HH24:MI:SS'),
            dn,
            attrname,
            attrval,
            MTU_userid,
            MTU_dn,
            result,
            rc,
            errormsg,
            'No Exception - Auth From: ' || auth_location,
            auth_server,
            auth_port,
            context_data
        COMMIT;
    EXCEPTION
        WHEN OTHERS THEN
            --An exception was raised
            rc := SQLCODE;
            errormsg := SUBSTR(SQLERRM, 1, 255);
            --Return false so authentication can't happen
            result := DBMS_LDAP.COMPARE_FALSE;
            INSERT INTO WHEN_COMPARE_REPLACE_LOG VALUES
                to_char(sysdate, 'Month DD, YYYY HH24:MI:SS'),
                dn,
                attrname,
                attrval,
                MTU_userid,
                MTU_dn,
                result,
                rc,
                errormsg,
                'Exception - Auth From: ' || auth_location,
                auth_server,
                auth_port,
                context_data
            COMMIT;
    END;
END PLUGIN_WHEN_COMPARE_REPLACE;