I know, how many acronyms can you use in a title?
This is a quick note about another tracing facility within Oracle. If you’re using Centrally Manager Users with Active Directory you can enable a trace for the LDAP searches Oracle performs.
Enable tracing:
alter system set events='trace[gdsi] disk low';
Disable tracing:
alter system set events='trace[gdsi] off';
Here are a few examples.
Failed Kerberos authentication
kzlg found dn in wallet kzlg found pwd in wallet kzlg found usr in wallet kzlg found domain SPOTONORACLE; dc=spotonoracle,dc=com; 1 dirsrv kzlg ldap_open win2012dc1.spotonoracle.com:636 kzlg DB-LDAP init SSL succeeded. kzlg bind success kzlg AD user name: user1@SPOTONORACLE.COM kzlg default naming ctx: dc=spotonoracle,dc=com kzlg search -s base -b dc=spotonoracle,dc=com kzlg search filter: objectclass=* kzlg AD lockout_duration: 18000000000 kzlg AD max_pwd_age: 36288000000000 kzlg search_ext -s sub -b dc=spotonoracle,dc=com kzlg search filter: (&(objectclass=user)(userPrincipalName=user1@SPOTONORACLE.COM)) KZLG_ERR: failed the search err=28304. kzlg number of entries: 0 KZLG_ERR: LDAPERR=28304, OER=28304 KZLG_ERR: error=28304 kzlg doing LDAP unbind
Successful Kerberos authentication
kzlg found dn in wallet kzlg found pwd in wallet kzlg found usr in wallet kzlg found domain SPOTONORACLE; dc=spotonoracle,dc=com; 1 dirsrv kzlg ldap_open win2012dc1.spotonoracle.com:636 kzlg DB-LDAP init SSL succeeded. kzlg bind success kzlg AD user name: user1@SPOTONORACLE.COM kzlg default naming ctx: dc=spotonoracle,dc=com kzlg search -s base -b dc=spotonoracle,dc=com kzlg search filter: objectclass=* kzlg AD lockout_duration: 18000000000 kzlg AD max_pwd_age: 36288000000000 kzlg search_ext -s sub -b dc=spotonoracle,dc=com kzlg search filter: (&(objectclass=user)(userPrincipalName=user1@SPOTONORACLE.COM)) kzlg number of entries: 1 kzlg found user entry: CN=user1,OU=users,OU=oracle,DC=spotonoracle,DC=com kzlg search -s base -b kzlg search filter: objectclass=* kzlg get AD current time: 20181019155231.0Z kzlg found user entry normalized: cn=user1,ou=users,ou=oracle,dc=spotonoracle,dc=com kzlg search_ext -s sub -b dc=spotonoracle,dc=com kzlg search filter: (&(objectclass=group)(member:1.2.840.113556.1.4.1941:=cn=user1,ou=users,ou=oracle,dc=spotonoracle,dc=com)) kzlg number of entries: 1 kzlg search_ext -s sub -b dc=spotonoracle,dc=com kzlg search filter: (&(objectclass=group)(objectSid=S-1-5-21-4282430696-1338935355-568305779-513)) kzlg number of entries: 1 kzlg doing LDAP unbind
Failed TLS authentication
kzlg found dn in wallet kzlg found pwd in wallet kzlg found usr in wallet kzlg found domain SPOTONORACLE; dc=spotonoracle,dc=com; 1 dirsrv kzlg ldap_open win2012dc1.spotonoracle.com:636 kzlg DB-LDAP init SSL succeeded. kzlg bind success kzlg AD user name: cn=user1,ou=users,ou=oracle,dc=spotonoracle,dc=com kzlg default naming ctx: dc=spotonoracle,dc=com kzlg search -s base -b dc=spotonoracle,dc=com kzlg search filter: objectclass=* kzlg AD lockout_duration: 18000000000 kzlg AD max_pwd_age: 36288000000000 kzlg search_ext -s sub -b dc=spotonoracle,dc=com kzlg search filter: (&(objectclass=user)(distinguishedName=cn=user1,ou=users,ou=oracle,dc=spotonoracle,dc=com)) KZLG_ERR: failed the search err=28304. kzlg number of entries: 0 KZLG_ERR: LDAPERR=28304, OER=28304 KZLG_ERR: error=28304 kzlg doing LDAP unbind kzlg found dn in wallet kzlg found pwd in wallet kzlg found usr in wallet
Successful TLS authentication
kzlg found dn in wallet kzlg found pwd in wallet kzlg found usr in wallet kzlg found domain SPOTONORACLE; dc=spotonoracle,dc=com; 1 dirsrv kzlg ldap_open win2012dc1.spotonoracle.com:636 kzlg DB-LDAP init SSL succeeded. kzlg bind success kzlg AD user name: cn=user1,ou=users,ou=oracle,dc=spotonoracle,dc=com kzlg default naming ctx: dc=spotonoracle,dc=com kzlg search -s base -b dc=spotonoracle,dc=com kzlg search filter: objectclass=* kzlg AD lockout_duration: 18000000000 kzlg AD max_pwd_age: 36288000000000 kzlg search_ext -s sub -b dc=spotonoracle,dc=com kzlg search filter: (&(objectclass=user)(distinguishedName=cn=user1,ou=users,ou=oracle,dc=spotonoracle,dc=com)) kzlg number of entries: 1 kzlg found user entry: CN=user1,OU=users,OU=oracle,DC=spotonoracle,DC=com kzlg search -s base -b kzlg search filter: objectclass=* kzlg get AD current time: 20181019155506.0Z kzlg found user entry normalized: cn=user1,ou=users,ou=oracle,dc=spotonoracle,dc=com kzlg search_ext -s sub -b dc=spotonoracle,dc=com kzlg search filter: (&(objectclass=group)(member:1.2.840.113556.1.4.1941:=cn=user1,ou=users,ou=oracle,dc=spotonoracle,dc=com)) kzlg number of entries: 1 kzlg search_ext -s sub -b dc=spotonoracle,dc=com kzlg search filter: (&(objectclass=group)(objectSid=S-1-5-21-4282430696-1338935355-568305779-513)) kzlg number of entries: 1 kzlg doing LDAP unbind
Thanks to this I could resolve the last road block. CMU with TLS/Kerberos is fully functioning.