Oracle Database 11g : Connecting to Oracle - Learn Naming Methods

A naming method defines the type of repository used to configure Oracle network information. This repository is accessed to define where the Oracle database server is located.

Oracle supports various types of naming methods, such as:

• Directory naming (centralized configuration)

• Local naming (client configuration)

• External naming (external configuration)

• Easy naming (manual configuration)

Directory Naming Method

For centralized network management, Oracle Net Services uses a Lightweight Directory Access Protocol (LDAP) directory server as the repository. LDAP uses hierarchical structures (directories) that contain different components of a communication path. The LDAP directory stores all database network information, policies, security, and authentication information in this centralized repository. Remote applications will go to the centralized repository to find network configuration information. The results are then returned containing the communication path to the Oracle database server.

Different vendors provide their own LDAP directory server. The Oracle LDAP directory, for instance, is named the Oracle Internet Directory (OID). (The Microsoft version of this is named Microsoft Active Directory.)

You should note that there are some restrictions when using the Microsoft Active Directory. The Oracle Net Configuration Assistant may be used with the Microsoft Active Directory; however, the Oracle Internet Directory Configuration tool cannot be used with the Microsoft Active Directory.

Security has been a focus of Oracle 11g, and with directories such as the LDAP directory, there are areas that need to be more secure than others. The method of authentication of lookups through parameters in the directory users can be validated and authorized first, which would protect sensitive Net Services information. A simple authenticated user is defined by just a login and a password; in comparison, strong authentication includes encryption. Modification of the directory via Oracle Net Manager or lookups in the directory can be configured securely through simple or strong authentication.

Storing network information in a centralized location is much more efficient from an administration perspective. Make a change in one place, and it is reflected everywhere. It’s also better from a security perspective because the database location is stored in a centralized repository instead of a file on a local machine.

Directory Information Trees

LDAP directory servers store information in a hierarchical tree structure called a Directory Information Tree (DIT). DITs are typically organized in a Domain Name Space (DNS) structure (usually along corporate or geographical lines), and are defined by the Oracle Internet Directory Configuration Assistant. Every node in the tree is referred to as an entry, each of which can be modified with the Oracle Enterprise Manager or the Oracle Net Manager. The following example shows how a connect descriptor maps to a DIT:

(DESCRIPTION =
 (ADDRESS=(PROTOCOL=tcp)(HOST=eclipse)(PORT=1521))
(CONNECT_DATA=
     (SERVICE_NAME=customer.us.beginner.com)))

Figure 1 illustrates how the directories are organized and may be navigated when using the Oracle Internet Directory Configuration Assistant. It is important to know your directory trees to ensure that you correctly move through your hierarchy.

Distinguished Names

A distinguished name (DN) defines where an entry resides in the directory path, and begins at the lowest entry. The DN for the customer distinguished name is dn:cn=customer, cn=OracleContext, dc=us, dc=beginner, and dc=com. Relative distinguished names (RDNs), on the other hand, define the sequences within the path. An RDN contains an attribute that defines the RDN. An important RDN is the Oracle Context, which defines the default location for connect identifiers. An identity management realm, meanwhile, defines a set of identities that share the same administration policies.

How to Find the Directory Naming Information

With this naming method, a client needs to find the centralized information that is stored in the LDAP repository to be able to connect to the database server. There are two ways to find the centralized directory naming information stored on a separate system:

• The static method, which works via a local ldap.ora file.

• The dynamic method, which works via a domain name server (DNS).

An ldap.ora file is a statically configured file containing the location of the LDAP server. DNS uses name servers to map names and IP addresses for systems. If the latter changes, the next time the name is looked for on the domain name server, it will map to the new IP address.

Net Service Alias Entries

A net service alias entry is another name for a net service name. A net service alias references the directory location and the name cust in the directory information tree is a net service alias. Aliases simplify management by using a short alias instead of having to specify the full path.

The Local Naming Method

The local naming method uses a local configuration file called tnsnames.ora. The tnsnames.ora file stores net service names and connect descriptors and it resides on the platform running the database application. It also contains the information required to find and connect to the Oracle database server. The following definition defines the address (protocol, host, port number) along with the dedicated server environment and which service to connect to:

CUST =
  (DESCRIPTION =
    (ADDRESS_LIST =
      (ADDRESS = (PROTOCOL = TCP)(HOST = eclipse)(PORT = 1521))
    )
    (CONNECT_DATA =
      (SERVER = DEDICATED)
      (SERVICE_NAME = CUST)
    )
  )

This is a simple file to configure. The problem is that if you have 1000 users, you need to make sure the tnsnames.ora file has been updated for all of the client machines. From a security perspective, it is not ideal to allow clients access to a server location and the connection information.

The Easy Naming Method

The easy naming method explicitly defines the connect information. The connect information contains the host, port, service name, and instance name. This allows someone to connect in a specific way without going through the configuration effort. The format is

CONNECT username/password@eclipse:1521/customer.us.beginner.com/cust

An advantage of the easy naming method is that it is easy to configure. The user need only provide minimal information to get a connection. As a result, no other naming methods need to be configured. This method cannot be used if more advanced features are required.

The External Naming Method

The external naming method uses net service names that are defined in a non-Oracle environment. This naming method works well for administrators that want to use their native naming service and allows them to use native tools and utilities with which they have experience. The disadvantage of this approach is that Oracle Net tools cannot be used for these native naming methods. Supported non-Oracle services include the Network Information Service (NIS) or Cell Directory Services (CDS). CDS is part of a Distributed Computing Environment (DCE). DCE is an integrated distributed environment designed to resolve interoperability issues with heterogeneous environments. DCE is maintained by the Open Systems Foundation (OSF).

Which Naming Method to Use

The local naming method (tnsnames.ora) has traditionally been the most popular method. However, there are a number of administration and security issues in stored local configuration with a tnsnames.ora file. The directory (centralized) naming method is more scalable and has less administration than the local naming method. For large systems, the directory method is becoming more popular.