text:
|Oracle Advanced Security Administrator's Guide
Release 9.0.1
Part Number A90150-01
Enterprise User Security lets you create and administer large numbers of users in a secure, LDAP-compliant directory service. This chapter describes the configuration and setup of Enterprise User Security.
This chapter contains the following topics:
This part introduces Oracle Enterprise User Security, and describes its fundamental concepts.
Part I contains the following sections:
This section describes fundamental concepts related to Enterprise User Security:
Administrators must manage complex user information for the entire enterprise, keeping it both current and secure. This task becomes increasingly difficult as the use of technology expands and the user turnover rate increases throughout an enterprise. In a typical enterprise, every user can have multiple accounts on different databases, requiring users to remember passwords for each of these accounts. This can produce too many passwords for users to remember, and too many accounts for administrators to effectively manage.
With perhaps thousands of users accessing thousands of database accounts, administrators must devote substantial resources to user administration. Common information used by multiple applications--such as usernames, user office locations and telephone numbers, and system roles and privileges--is typically fragmented across the enterprise, contributing to data that is redundant, inconsistent, and difficult to manage.
There are security problems as well. For example, any time a user leaves a company or changes jobs, that user's privileges should be changed the same day in order to guard against their misuse. However, in a large enterprise, with user accounts and passwords distributed over multiple databases, an administrator may be unable to make such timely changes. In addition, users may elect to write down their passwords (making them easy for others to copy), or make them easy to remember (making them easy for others to guess), or simply choose the same password for multiple applications--all of which compromise the security of the enterprise.
Enterprise User Security addresses these user, administrative, and security challenges by centralizing storage and management of user-related information in an LDAP-compliant directory service. When an employee changes jobs in such an environment, the administrator need only modify information in one location--the directory--to make effective changes in multiple databases and systems. This centralization can substantially lower administrative costs while materially improving enterprise security.
Enterprise users benefit from Enterprise User Security as well, through single sign-on or single password authentication, depending on the configuration chosen by the administrator.
Single sign-on lets users authenticate once, with subsequent authentications taking place transparently. It address the multiple password problem, and provides stronger, PKI-based authentication, combined with an improved user experience.
Single password authentication lets enterprise users authenticate to multiple databases with a single, global password--although each database requires a separate authentication. The password is securely stored in the centrally located, LDAP-compliant directory, and protected with security mechanisms including encryption and an Access Control List (ACL). This approach reduces the number of passwords to remember, and eliminates the overhead of setting up SSL--both of which improve usability.
Enterprise User Security supports the following LDAP-compliant directory services:
Oracle Advanced Security also provides a tool, Oracle Enterprise Security Manager, to create user entries in the directory and manage authorizations for those users.
Enterprise User Security lets administrators manage two types of users in a single LDAP-compliant directory:
Password-authenticated enterprise users use single password authentication.
SSL-authenticated users enjoy single sign-on and strong authentication, using industry-standard, interoperable X.509 v3 certificates--over Secure Sockets Layer (SSL) v3.
Each authentication method has its own set of selection criteria, as summarized by Table 15-1:
|Selection Criteria, Applicable to:
|Password Authentication
Supports password-based logins.
Provides stronger, systemwide security.
Does not support PKI, or PKI certificate-based client authentication.
Supports PKI, certificate-based authentication.
Does not employ SSL, wallets, or X.509 certificates.
Supports PKI, SSL, and industry-standard X.509 certificates.
Supports single, global user passwords, with separate authentications required for each database and application (single password authentication).
Supports single sign-on using SSL.
Provides faster processing, because there is no SSL processing required between clients and servers (supports Oracle Advanced Security native encryption). Note: if your organization requires SSL, you cannot use password authentication across the enterprise.
Somewhat slower connection processing, but with higher network security. Note: if your organization requires SSL across the enterprise, you must use SSL-authentication.
From the user/client point of view, password authentication may be viewed as easier-to-use, particularly for notebooks and home workstations.
SSL is more difficult to configure initially, but it provides stronger security.
Password authentication is compatible with either a two-tier or three-tier environment.
SSL-authentication is compatible with either a two-tier or three-tier environment.
Password authentication supports Oracle Release 7.3 or 8.0 clients, with an Oracle9i database.
SSL-authentication supports Oracle8i or Oracle9i clients with an Oracle9i database.
Prior releases of Oracle Advanced Security use SSL processing to establish secure channels between (i) the client and the server, and (ii) the database server and the LDAP-compliant directory. The client authentication mechanism uses SSL and X.509 v3 certificates, requiring installed Oracle wallets on both the client and the server.
This release complements certificate-based authentication with password-based authentication for enterprise users, including the following principal features:
The following directory entries relate to Enterprise User Security:
An enterprise user is one that is defined and managed in a directory. Each enterprise user has a unique identity across an enterprise. Enterprise user entries can reside at any location within the directory.
The entries described below can only reside within an Oracle Context.
Enterprise users can be assigned enterprise roles, which determine their access privileges on databases. These enterprise roles are also stored and managed in a directory.
An enterprise role consists of one or more global roles, each one of which is defined in a specific database. A global role includes privileges contained in a database, but the global role is managed in a directory. An enterprise role is thus a container of global roles. For example, the enterprise role
USER could contain the global role
HRCLERK with its privileges on the Human Resources database, and the
ANALYST role with its privileges on the Payroll database.
An enterprise role can be assigned to one or more enterprise users. For example, you could assign the enterprise role
USER to a number of enterprise users who hold the same job. This information is protected in the directory, and only the administrator can manage users and assign their roles. A user can be granted local roles and privileges in a database in addition to enterprise roles.
An enterprise domain subtree includes enterprise role entries, each of which contains information about associated global roles on each server and authorized enterprise users. These are created and managed by the Domain Administrator by using Oracle Enterprise Security Manager.
|See Also:
An enterprise domain is a group of databases and enterprise roles. An example of a domain could be the engineering division in an enterprise or a small enterprise itself. It is here, at the enterprise domain level, that the Domain Administrator, using Oracle Enterprise Security Manager, assigns enterprise roles to users and manages enterprise security. An enterprise domain subtree in a directory is composed of three types of entries: enterprise role entries (discussed by Enterprise Roles), User-Schema Mappings, and the Domain Administrator's group for that domain.
A user-schema mapping entry contains mapping information between a full or partial DN and an Oracle database user name. The users referenced in the mapping are connected to the specified schema when they connect to the database. User schema mapping entries can appear under database server entries, where they apply only to that database. They can also appear under domain entries, where they apply to all databases in that domain.
Mapping entries are created by the Domain Administrator for a particular domain, and are created by the Database Administrator for a particular database.
A database server entry (represented as
cn=sales in Figure 15-1) contains information about a database server. It is created by the Oracle Database Configuration Assistant during the database registration. A database server entry is the parent of database level mapping entries that contain mapping information between full or partial DNs and Oracle shared schema names. Database-level mapping entries are created by the Database Administrator by using Oracle Enterprise Security Manager. A Database Administrator's group, containing administrators for that database, is located under the server entry.
The Oracle Context contains Enterprise User Security-related administrative groups, each with its associated Access Control List (ACL). The user who creates the Oracle Context with NetCA automatically becomes the first member of each of these groups. The relevant administrative groups in an Oracle Context are described in Table 15-2:
|Administrative Group
Members of the OracleDBCreators group (
NetCA establishes these access rights during Oracle Context creation.
In addition to the Oracle Context creator, other users can be added to this group by members of the OracleDBSecurityAdmins group by using Oracle Enterprise Security Manager.
Members of OracleDBSecurityAdmins (
NetCA sets up these access rights during Oracle Context creation.
In addition to the Oracle Context creator, members of this group can add other users to this group by using Oracle Enterprise Security Manager.
Members of OracleUserSecAdmins (cn=OracleUserSecurityAdmins,cn=Groups,cn=OracleContext...) are responsible for Oracle user security. For example, by default they can read wallet password hints and modify user passwords. The relevant ACL is set at the root of the directory by default.
Password Accessible Domains
Members of <cn=password accessible domains> are enterprise domains that contain databases enabled for password-authorized enterprise users.
You can also have a Domain Administrator responsible for managing a single domain. This administrator has lesser privileges than the Database Security Administrator. Similarly, you can have a Database Administrator responsible for a single database directory entry. These admin groups reside directly under the relevant database or domain entry.
In all secure password-based authentication methods, a server authenticates a client with a password verifier, typically a hashed version of the password--that must be rigorously protected. Password-based authentication to an Oracle database is no different; there is an Oracle proprietary password verifier, and it must be protected as well. This is true if the verifier is stored locally in the database or centrally in the directory.
In the current release an enterprise user's centrally-stored database password can be stored in a central directory service for access by multiple databases, and is viewable and shared by all trusted databases to which the user has access. Although the password verifier stored in the directory is not the cleartext password, it is still necessary to protect it from casual or unauthorized access. It is therefore extremely important to define password-related ACLs in the directory that are as restrictive as possible, while still enabling necessary access and usability.
Oracle tools help set up ACLs in the directory to protect these password verifiers. The Oracle recommended approach is intended to balance both security and usability considerations. If you require maximum security and can set up wallets for all users, you should require SSL connections (only) from users to databases. This SSL-only approach circumvents the entire directory password protection issue.
In the current release, there is a new Password-accessible Domains group in each Oracle Context. This group is created automatically when the context is created, and can be managed using Oracle Enterprise Security Manager. Enterprise domains with member databases that must view users' database password verifiers in the directory are placed into this group. Enterprise Security Manager can be used to place an appropriate ACL on user subtrees, so that databases in this group can read the password verifier for users in that subtree.
There are two steps involved in this (Oracle-supported) approach:
This step places a restrictive ACL on the selected user search base entry in the directory. That ACL specifies permitted access to the attribute that holds the Oracle database password verifier as follows:
usersecurityadmins groups from both contexts appear in the ACL.
These ACLs restrict access to the Oracle database password verifier value only (the orcldbpassword attribute). No other attributes in the user entries are affected.
See Also:
Oracle Directory Service Integration and Deployment Guide for more information about the LDAP schema for Enterprise User Security
Figure 15-2 displays the Enterprise User Security elements--with SSL-authentication employed:
Figure 15-3 displays the Enterprise User Security elements--with password-authentication employed:
Figure 15-4 shows the operation of the Enterprise User Security process. For an SSL processing environment, the following assumptions apply:
In a three-tier environment, enterprise users can authenticate to the database through any middle tier using proxy authentication.
In a three-tier environment, enterprise users can authenticate to the database through any middle tier using proxy authentication.
This section describes the operation of the Enterprise User Security process, with password-based authentication (See: Figure 15-4):
In a three-tier environment, enterprise users can authenticate to the database through any middle tier using proxy authentication.
In a three-tier environment, enterprise users can authenticate to the database through any middle tier using proxy authentication.
The following sections describe shared schemas, and how to set them up:
Users do not necessarily require individual accounts or schemas set up in each database. Alternatively, they can be granted access to common, shared schemas associated with target applications. For example, suppose that users Tom, Dick, and Harriet require access to the Payroll application on the Finance database. They do not need to create unique objects in the database, and therefore do not need their own schemas--they do need access to the Payroll schema.
Oracle9i Release 9.0.1 supports mapping multiple users stored in an enterprise directory to shared schema on an individual database. This separation of users from schemas reduces administration costs by reducing the number of user accounts on databases. It means that you do not need to create an account for each user--a user schema--in multiple databases, in addition to creating the user in the directory. Instead, you can create a user in one location, the enterprise directory, and map the user to a shared schema that other enterprise users can also be mapped to. For example, if Tom, Dick and Harriet all access both the Sales and the Finance databases, you do not need to create an account for each user on each of these databases. Instead, you can create a single shared schema on each database, such as
SALES_APPLICATION and
FINANCE_APPLICATION, respectively, that all three users can access. A typical environment might have some 5,000 enterprise users mapped to just one of three or four shared schemas. Alternatively, you can map multiple users to a single shared schema (a guest schema), and assign enterprise roles to each user.
To configure shared schemas, the local Database Administrator must create at least one database schema in a database. Enterprise users can be mapped to this schema.
In the following example, the administrator creates a shared schema and maps users to it:
EMPLOYEE and the global role
HRMANAGER on the HR database.
MANAGER. The administrator then assigns the global role
HRMANAGER to the enterprise role
MANAGER to Harriet.
When Harriet connects to the database, she is automatically connected to the
EMPLOYEE schema and is given the global role
HRMANAGER. Multiple enterprise users can be mapped to the same shared schema. For example, the enterprise security administrator can create another enterprise user Scott and map Scott to the
EMPLOYEE schema. From that point on, both Harriet and Scott automatically use the
EMPLOYEE schema when connecting to the HR database, but each can have different roles--and can be individually audited.
Shared schema functionality relies on SSL or user passwords for authentication to the database. For a discussion of password-based authentication, See: Enterprise Users and Password Authentication.
A discussion of the SSL authentication process follows:
This method associates the DN of a single directory user with a particular schema on a database. It results in one mapping entry for each user.
When using full DN mapping, each enterprise user can be mapped either to a unique schema, or to a shared schema.
This method lets multiple enterprise users share part of their DN to access the same shared schema. This method is useful if multiple enterprise users are already grouped under some common root in the directory tree. The subtree that these users share can be mapped to a shared schema on a database. For example, you can map all enterprise users in the subtree for the engineering division to one shared schema,
BUG_APPLICATION, on the bug database. Note that the root of the subtree is not mapped to the specified schema.
If the database does find either the DN locally or the appropriate DN mapping object in the directory, the database lets the user log on.
For example, suppose that Harriet is trying to connect to the HR database, but the database does not find Harriet's DN (in the database). In this case, the HR database looks up the Harriet's DN in the directory. The directory has a mapping of Harriet to the shared schema
EMPLOYEE and returns this schema. The database logs Harriet in and connects her to the
EMPLOYEE schema.
The database also retrieves from its own tables any local roles and privileges associated with the database schema to which the user is mapped.
The database uses both the global and the local roles to determine the information that the user can access.
You can configure the database so that it uses local roles only and does not look up global roles in the directory. To do this, do not register the database in the directory with the Oracle Database Configuration Assistant.
Alternatively, to temporarily disable directory lookup, you can comment-out the parameter
If this configuration is set, the database uses only local roles to determine what the user can access. This lets customers use SSL for client authentication, without having to manage user privileges centrally. This configuration does not work with mapped users and shared schemas--because the mapping information must be stored in the directory.
See Also:
Continuing this example, assume that the enterprise role
MANAGER contains the global roles
ANALYST on the HR database, and
USER on the Payroll database. When Harriet, who has the enterprise role
MANAGER, connects to the HR database, she uses the schema EMPLOYEE on that database.
The syntax for creating a shared schema is:
CREATE USER [shared schema name] IDENTIFIED GLOBALLY AS ''
For example, the administrator for the HR database creates a shared schema for the user
SALES_APPLICATION as follows:
CREATE USER sales_application IDENTIFIED GLOBALLY AS ''
You can use Oracle Enterprise Security Manager to create enterprise user entries one at a time. To load large numbers of entries, use other LDAP processes such as the Oracle Internet Directory bulk load tool.
The mapping between enterprise users and a schema can be done in either the database or the directory.
The mapping is done in the directory by means of one or more mapping objects. A mapping object is used to map the distinguished name (DN) of a user to a database schema that the user will access. You create a mapping object by using Oracle Enterprise Security Manager. This mapping can be one of the following:
When determining the appropriate schema to which it is to connect the user, the database uses the following precedence rules:
You can grant privileges to a specified group of users by granting roles and privileges to a database schema. Every user sharing such a schema gets these local roles and privileges in addition to personal enterprise roles. However, you should exercise caution when doing this, because every user who is mapped to this shared schema can exercise the privileges assigned to it. Accordingly, Oracle does not recommend assigning roles and privileges to a shared schema.
Oracle9i supports current user database links for both SSL-authenticated and password-authenticated enterprise users, which let you make a procedural connection to a second database as another user and with that user's privileges--though it does not require that the second user's credentials be stored in the database link definition. Such access is limited to the scope of the database link procedure.
For example, a current user database link lets Harriet, a user of the Finance database, procedurally access the Accounts Payable database by connecting as Scott, and using Scott's credentials.
For Harriet to access a current user database link to connect to the schema Scott, Scott must be a schema created as
IDENTIFIED GLOBALLY in both databases. Harriet, however, can be a user identified in one of three ways:
To create Scott as a global user in both the Accounts Payable and Finance databases, you must enter the following command in each database:
CREATE USER Scott IDENTIFIED GLOBALLY as 'CN=Scott,O=nmt'
Note that the syntax for creating this kind of schema is slightly different from the syntax for creating a shared schema described in Creating a Shared Schema. In this case, the schema is Scott's alone. In order for the current user database link to work, the schema created for Scott cannot be shared with other users.
Current user database links operate only between trusted databases within a single enterprise domain--databases within the domain trust each other to authenticate users. You specify a domain as trusted by using Oracle Enterprise Security Manager. By default, if current user database links are enabled for a domain by using Enterprise Security Manager, they will work for all databases within that domain. To specify a database as untrusted that is part of a trusted enterprise domain, use the PL/SQL package
DBMS_DISTRIBUTED_TRUST_ADMIN. To obtain a list of trusted servers, use the
TRUSTED_SERVERS view.
See Also:
Enterprise User Security functionality uses the following administration tools:
Oracle Enterprise Security Manager is an administration tool that provides a graphical user interface to help you manage enterprise users, enterprise domains, databases, and enterprise roles that are stored in a directory service. Use Oracle Enterprise Security Manager to:
Use Oracle Enterprise Login Assistant to enable and disable Autologin, to upload wallets to, or download wallets from a directory, and to change a user wallet password. This tool lets enterprise users use SSL to connect to multiple services with a single sign-on. Oracle Enterprise Login Assistant masks the complexity of SSL, wallets, enterprise users, and the process of authenticating to multiple databases.
Oracle Enterprise Login Assistant also supports password authentication, letting users securely access multiple databases and applications using a single password, entered once for each session.
You can use ELA to change any of the following passwords:
The directory password is the password used to bind to Oracle Internet Directory. The database password, on the other hand, is the single, global password that enterprise users enter into an application (such as SQL*Plus), in order to authenticate to multiple databases.
The user wallet password is used to access user wallets, stored locally (on the client) or in the directory. User wallets are required for SSL-based authentication, but they are not required for password-based authentication.
Oracle Wallet Manager is a standalone Java application that wallet owners and security administrators use to manage and edit the security credentials in their Oracle wallets. Wallet Manager tasks include:
Chapter 16, Using Oracle Wallet Manager, for detailed information about using this application
See Also:
Chapter 16, Using Oracle Wallet Manager, for detailed information about using this application
Consider the following before deploying Oracle Enterprise Security Manager:
Beyond the general benefits that flow from the centralization of enterprise users and their associated credentials, there are a number of security-related benefits and risks that should be reviewed.
One security benefit is that centralizing management makes it easier and faster to administer users, credentials, and roles, and to quickly revoke a user's privileges on all applications and databases across the enterprise. With centralized management, the administrator can delete a user in one place to revoke all global privileges, minimizing the risk of retaining unintended privileges.
Another security benefit is that it can be more secure to centrally control security information, because you can centralize the organization's security expertise. Specialized, security-aware administrators can manage all aspects of enterprise user security, including directory security, user roles and privileges, and database access. This is a substantial improvement over the traditional model, where Database Administrators are typically responsible for everything on the databases they manage, including security.
The downside is that, while Oracle Internet Directory is a secure repository, there is a security challenge--and inherent risk--in centralizing credentials in any publicly accessible repository. Although centralized credentials can be protected at least as securely as distributed credentials, the very nature of centralization increases the consequences of inadvertent credential exposure to unauthorized parties. It is therefore imperative to limit the privileges of administrators, to set restrictive Access Control Lists (ACLs) in the directory, and to implement good security practices in the protection of security credentials when they are temporarily outside of the directory.
Consider the following criteria when defining the database membership of a domain:
This part describes the initial Enterprise User Security configuration tasks--for both SSL and password authentication.
This part contains the following tasks:
Oracle Wallet Manager requires you to have a certificate authority (CA) in your environment. You can use a CA vendor's certificates, or you can use your own CA that can process PKCS#10 certificate requests in Base 64 format and return X509v3 certificates--also in Base 64 format.
See Also:
Chapter 16, Using Oracle Wallet Manager, for a description of certificate authorities and Oracle Wallet Manager
Conceptually, there are four major prerequisites for an Oracle RDBMS to communicate with the directory:
ldap.ora) that tells the database how to connect to the directory, including host, port, and directory type-- and the location in the directory of the Oracle Context.
NetCA performs the first three steps (called directory service access configuration), and the Oracle Database Configuration Assistant (DBCA) performs the fourth. Note that you must create the Oracle Context at least once for each directory, but you must create an
ldap.ora file for each
ORACLE_HOME used to access the directory. If there is no context, NetCA prompts you to create one; if one already exists, it prompts you to choose one to use. If there is no Oracle schema installed in the directory (which is done automatically for Oracle Internet Directory), or it is not current, NetCA prompts you to install or update it.
If you run the recommended custom database install, NetCA and DBCA automatically complete the directory-related configuration.
If you install the Oracle9i database using a typical install, NetCA and DBCA do not complete the directory-related configuration. In this case, you must run both NetCA and DBCA in standalone mode.
To install and configure a directory service:
Oracle9i Release 9.0.1 supports the following internet directories:
Setting up the directory for two-way SSL authentication requires the creation of an Oracle wallet for the directory. If you are using Oracle Internet Directory, use Oracle Wallet Manager and Oracle Internet Directory to create a wallet for the directory and to configure SSL. If you are using Microsoft Active Directory, see that product's documentation for instructions about enabling two-way SSL authentication.
Ensure that the directory has an Oracle9i schema and an appropriate Oracle Context installed.
The Oracle Schema is pre-installed in Oracle Internet Directory. If you are using an older version of Oracle Internet Directory, you can upgrade the schema using NetCA. The Oracle9i version is backward compatible.
|See Also:
Oracle Internet Directory is shipped with a pre-installed Oracle Context at the directory root. You can use NetCA to create an Oracle Context.
You must upgrade an Oracle8i Oracle Context before registering an Oracle9i database with that context in the directory. You can use this upgraded Oracle Context to register any Oracle8i databases that are created in the future. If you have a combination of Oracle8i and Oracle9i databases deployed, set the
VERSIONCOMPATIBILITY parameter to 8i and 9i, using Oracle Enterprise Security Manager. Oracle recommends that you set this to 9i if you deploy only Oracle9i databases. This parameter determines if some of the database security attributes must be represented in the directory in two places to support both Oracle8i and Oracle9i databases. If you are deploying only Oracle8i databases, there is no requirement to upgrade the Oracle Context--and no requirement to set this parameter.
If they do not already exist, create enterprise users in the directory who are authorized to perform the following functions:
It is possible to perform all Enterprise User Security administrative functions as a single administrator. If you choose this approach, you must only create one administrative user entry.
Note, however, that this creates a condition where there is no separation of security functions--not considered good security practice.
Oracle Enterprise User Security provides the capability to create many different kinds of administrators, to achieve separation of security functions, and a more secure enterprise environment.
It is possible to perform all Enterprise User Security administrative functions as a single administrator. If you choose this approach, you must only create one administrative user entry.
Note, however, that this creates a condition where there is no separation of security functions--not considered good security practice.
Oracle Enterprise User Security provides the capability to create many different kinds of administrators, to achieve separation of security functions, and a more secure enterprise environment.
To install and configure one or more databases:
Use the Oracle Universal Installer to install Oracle9i databases. Before installation, obtain the following from the directory administrator:
cn=OracleDBCreators). The user who created the Oracle Context is automatically a member of this group.
During installation, select Oracle9i Enterprise Edition and the Custom installation type with Oracle Advanced Security.
NetCA runs automatically at the end of the Oracle9i installation process; see Step 2 for related instructions (if you did not choose the custom install, NetCA must be started manually).
To configure directory service access configuration, use NetCA:
Directory Usage Configuration; choose
Select an already configured directory server to use; choose
Finish to exit NetCA.
ldap.ora file is located in the following directory path:
UNIX and Windows NT:
To register your database in the directory (using DBCA), you must provide directory credentials for (i) a user in the Database Installation Administrator's group, or (ii) a user in the Context Administrator's group, or (iii) the directory superuser. If you choose the first or second approach, you may need to add appropriate users to that group before running DBCA. Use Oracle Enterprise Security Manager to put the appropriate directory users into the Database Installation Admin group--so they can register the database in the directory.
To authorize users for administrative functions:
Configure database options in a database and choose
Next (this process typically takes about a minute to complete); the final Oracle Database Configuration Assistant window appears (Figure 15-6):
Yes, Register the Database, and enter the directory credentials for a user in the Database Installation Administrators group.
Finish; the Locate Initialization File window appears. DBCA Locate Initialization File Window
RDBMS_SERVER_DN initialization parameter to the
init.ora file for the database. This parameter represents the distinguished name (DN) of the database as registered in the directory.
RDBMS_SERVER_DN parameter manually by editing the
init.ora file; this can make the locally stored DN for the database inconsistent with the actual DN in the directory. If this happens, change the
init.ora parameter to match the DN for the database in the directory.
To configure the database for SSL:
Oracle Net must be configured for SSL on both the listener and the database. The listener must have a listening endpoint that is configured for the TCP/IP with SSL protocol, and the location of the database wallet must be specified. Use Oracle Net Manager to do this (See: Enabling SSL):
ORACLE_HOME set to the databases' home directory, run Oracle Net Manager:
To configure the SSL service name:
TCP/IP with SSL; choose
File-->Save the network configuration; your
TNSNAMES.ORA file is updated, and can be reviewed later.
To configure the listener:
Listeners and select the appropriate
Listener (in the expandable tree menu on the left side of the window).
Listening Locations from the drop-down menu at the top right side of the window.
Add Address button at the bottom right side of the window.
File-->Save Network Configuration; your
listener.ora file is updated. Exit Oracle Net Manager.
tnsnames.ora for the client; edit
$ORACLE_HOME/network/admin/tnsnames.ora by adding the following to your SSL service name:
To facilitate review of your .ora files, some Windows NT examples follow:
(DIRECTORY = C:\WINNT\Profiles\DATABASES\oe)
SQLNET.CRYPTO_SEED = 4fhfquweotcadsfdsafjkdsfqp5f201p45mxskdlfdasf
(ADDRESS = (PROTOCOL = TCPS) (HOST = host1) (PORT = 5000)
(SERVICE_NAME = finance)
(ADDRESS = (PROTOCOL = TCP) (HOST = host1) (PORT = 1521)
(SERVICE_NAME = oe.world)
(DIRECTORY = C:\WINNT\Profiles\DATABASES\oe)
(ADDRESS = (PROTOCOL = TCP) (host = HOST1) (port = 1521)
(ADDRESS = (PROTOCOL = TCPS) (HOST = host1) (PORT = 5000))
(GLOBAL_DBNAME = oe.world)
(ORACLE_HOME = D:\Oracle\Ora81)
(SID_NAME = oe)
To create and configure the database wallet:
To create a database wallet:
New from the wallet menu. Do not create a new default directory when asked--this is for user wallets. During certificate request creation, type the distinguished name (DN) of the database exactly:
,cn=OracleContext,<location of Oraclecontext>
It is found in the
initialization parameter file, in the parameter
For example:
If the global database name chosen during installation is
sales.us.nmt.com, and the location selected within NetCA for the Oracle Context is
o=nmt, the complete DN of the database that you enter into Oracle Wallet Manager is:
For users to access the database using SSL two-way mutual authentication with an LDAP compliant directory server, Autologin must be enabled for the database wallet, and the listener must be running. To enable database Autologin and run the listener:
To stop the listener, enter the following at the command line:
lsnrctl stop
lsnrctl stop
You can alternatively stop Oracle Listener Services in the Services Control Panel. See: Notes.
Note for NT:
You can alternatively stop Oracle Listener Services in the Services Control Panel. See: Notes.
To change the Oracle Services login:
OracleService <database name>; choose the
Stop button; choose
Yes to confirm.
Startup button.
Log On As region of the Service Window (Figure 15-7):
This Account and enter
<domain>\< NT user login> for the user who enabled Autologin for the database wallet; alternatively, you can choose the browse button (...) to select from a list; enter your password in the
Password and
Confirm Password fields; choose OK.
To start the listener, enter the following at the command line:
lsnrctl start
lsnrctl start
The database wallet is now open, and the database is able to participate in authenticated communications using SSL; on Windows NT, the
OracleTNSListener service is also started.
See Also:
Chapter 16, Using Oracle Wallet Manager, for detailed instructions about creating a wallet
To logout from the database:
To verify that the database has been successfully configured:
cwallet.sso file located in the database wallet directory. If not, Autologin was not successfully enabled. If this happens, go back to the Oracle Wallet Manager, open the wallet, select the Autologin check box, and save the wallet.
ldap.ora file located in
If there is no
ldap.ora file, NetCA failed to configure directory access. Verify that the
ORACLE_HOME is set and rerun NetCA.
ldap.ora file exists and is correct. Then register the database again, using DBCA.
Although this task can be completed using Oracle Enterprise Manager, the following examples use SQL*Plus directly.
To create global schemas and roles:
Using SQL*Plus, create a shared schema (called Guest, for example) for enterprise users by entering:
CREATE USER guest IDENTIFIED GLOBALLY AS ''
Note the two single quotation marks with no space between them at the end of the line. If you enter a specific distinguished name (DN) between the quotation marks, only that user is able to connect to that schema, and it is not shared.
Users connecting to this schema require a
CREATE SESSION privilege. You can grant the
CREATE SESSION privilege either to the global schema, or to a global role which you grant to specific users though an enterprise role.
Create global roles for the database to hold relevant privileges. These roles are associated with enterprise roles to be created later. Enterprise roles are allocated to users.
For example:
CREATE ROLE emprole IDENTIFIED GLOBALLY;
CREATE ROLE custrole IDENTIFIED GLOBALLY;
Associate privileges with the new global roles.
For example:
GRANT select ON products TO custrole, emprole;
Oracle Advanced Security can be configured to authenticate enterprise users using either SSL or password authentication.
This section describes the final steps to complete the installation and configuration of Enterprise User Security for SSL authentication. The required tasks (numbered in sequence from Part II) follow:
The configuration tasks for Enterprise User Security are numbered consecutively, and continue in sequence from Part II. This part includes Task 8 through Task 11.
Once you have installed Oracle9i clients, configure Oracle Net on the clients by using Oracle Net Manager. You may complete this step during or after installation of Oracle9i Release 9.0.1.
Because you will be using an LDAP directory service for enterprise security, you may also want to use Oracle Net directory naming. Oracle Net directory naming lets the client connect to the database using the database entry registered with the directory by Oracle Database Configuration Assistant. Alternatively, you can use one of the other Oracle Net naming methods, such as local naming (
tnsnames.ora file), to configure a net service name for the database.
To configure database clients:
sqlnet.ora file can be shared by enterprise users, providing easier administration and deployment. Each user whose wallet is in a non-default wallet location must have a separate
sqlnet.ora file that contains that user's wallet location.
If you do not install clients, and
ORACLE_HOME is set to a database server
ORACLE_HOME, and that
ORACLE_HOME has a
sqlnet.ora file with a wallet location, you must create at least one new
TNS_ADMIN directory with a
sqlnet.ora file--with no wallet location. This ensures that SSL uses the default location of the wallet for the operating system user.
If you do not install clients, and
Default Wallet Directories for the User Wallets:
/etc/ORACLE/WALLETS/<OS username>
Wallets for specific users are set up when you create enterprise users. See Chapter 18, Using Oracle Enterprise Security Manager, for instructions about creating enterprise users.
See Also:
Oracle Enterprise Security Manager is installed automatically as part of the Oracle9i installation, and is used to configure an enterprise domain. Note that the Oracle default domain is created by default when the Oracle Context is created in the directory, and databases are automatically added as members of that domain when they are registered by DBCA. Table 15-3 lists the steps required to set up an enterprise domain, and cross-references related instructions. If you are using the Oracle default domain, you can skip steps 1 and 6.
|Related Instructions
1. Create an enterprise domain.
2. (Optional) Add domain administrators for the domain.
3. Enable or disable enterprise user current user database links between member databases.
4. Select authentication type for the domain. Must be (i) SSL only, or (ii) both password and SSL.
5. Configure user-schema mappings for the domain; alternatively, you can configure database-specific user-schema mappings.
6. Create enterprise roles in the domain.
7. Enroll the database as a member of the desired enterprise domain.
Defining Database Membership of an Enterprise Domain
8. Create global roles on the databases. The SQL*Plus command is:
9. Assign global roles to each enterprise role.
To create a new enterprise user:
Any directory user can be an enterprise user. You can add users to the directory by using one of the following tools:
If you elect to populate the directory with users before using Oracle Enterprise Security Manager, note that user entries in the directory must have the
If Oracle Enterprise Security Manager is used to prepare existing user entries for Oracle use (provision), the
objectclass is added to the existing entry.
See Also:
To create a user wallet, See: Chapter 16, Using Oracle Wallet Manager.
You can do either or both of the following:
Use Oracle Enterprise Manager or SQL*Plus to grant local roles and privileges to the database user or schema; this step is optional.
If the schemas are shared schemas, all roles granted to the shared schema are enabled for all users connecting to that schema. Accordingly, you should avoid granting any local roles or privileges to a shared schema.
Use Oracle Enterprise Security Manager to grant enterprise roles to the enterprise user in the directory.
If you are using a shared schema, use Oracle Enterprise Security Manager to map the user to a schema. You can choose either of the following mapping options:
For example:
If you are creating a domain mapping from three users to a shared schema called guest, and you have more than one database in the domain, each database must have a shared schema (called guest) that all three users can access. These three users cannot connect to any database in the domain that does not have a shared schema called guest.
Alternatively, you can create a mapping under a particular database. If you do it this way, the mapping applies only to that database, and not to all databases in the domain. If you have mappings in both places, the database mapping takes precedence.
See Also:
To log in as an Enterprise User:
To download a user wallet:
The enterprise user must enable Autologin for the user wallet (created in Task 10) in order to log in to the database. Enabling Autologin generates a single sign-on file and enables authentication to the SSL adapter.
To enable Autologin, use Oracle Enterprise Login Assistant to select the Autologin box.
See Also:
Chapter 17, Using Oracle Enterprise Login Assistant, for the following:
If the
ORACLE_HOME is set to a server
ORACLE_HOME, you must set the
TNS_ADMIN environment variable to address the directory where you placed the
sqlnet.ora file--that you created in Task 8: Configure Database Clients.
If you have a separate client
ORACLE_HOME, you do not need to set the
TNS_ADMIN environment variable.
connect_identifier is the net service name you set up in Task 8: Configure Database Clients.
If you are successful, the system responds
Connected to:...; this is the principal confirmation of a successful connection and setup. If an error message is displayed, see: Part IV: Final Configuration for Password Authentication.
If you do connect successfully, check that the appropriate global roles were retrieved from the directory by entering:
select * from session_roles
In the Oracle Enterprise Login Assistant, select
Autologin > Logout to disable authentication with the SSL adapter.
See Also:
Chapter 17, Using Oracle Enterprise Login Assistant, for instructions about using Oracle Enterprise Login Assistant
This section describes how to set up password authentication for enterprise users. The required tasks (numbered in sequence from Part III) follow:
The configuration tasks for Enterprise User Security are numbered consecutively, and continue in sequence from Part III. This part includes Task 12 through Task 16.
In this task you complete the initial Enterprise User Security setup steps, including the following:
Configure the enterprise domain for password authentication.
Oracle Enterprise Security Manager launches from the Oracle Enterprise Manager console. Oracle Advanced Security uses it for managing enterprise domains, users, roles, and databases. It can be used to configure an enterprise domain. Note that the Oracle default domain is created by default when the Oracle Context is created in the directory, and databases are automatically added as members of that domain when they are registered by DBCA (Figure 15-8).
Table 15-4 lists the steps required to set up an enterprise domain, and cross-references related instructions. If you are using the Oracle default domain, you can skip step 1 and step 4.
|Related Instructions
1. Create an enterprise domain.
2. (Optional) Add domain administrators for the domain.
3. Enable or disable current user database links between member databases.
4. Configure user schema mappings for the domain or database.
5. Create enterprise roles in the domain.
6. Use Oracle Enterprise Security Manager to make the database a member of the desired enterprise domain.
7. Create global roles on the databases. The SQL*Plus command is:
8. Assign global role(s) to each enterprise role.
9. Choose the Enterprise Domain Administration tab; select Oracle Wallet (SSL) And Password, or Password Only from the Enterprise User Authentication drop-down menu.
See: Figure 15-8.
The reference to Default Oracle Context in Figure 15-9 should read Root Oracle Context; all references to Default Oracle Context will be changed to Root Oracle Context in the production release of Oracle Advanced Security.
Choose the General tab of the Oracle Context Properties Window (Figure 15-9). In the Common User Search Bases region, enter the user search bases under which the databases are to search for user entries. A user search base is the root of a subtree under which you have stored your enterprise user entries in the directory.
Choose the General tab (Figure 15-9). In the Context Attribute Settings region, enter the name of the user entry attribute that holds the
UserID--that uniquely identifies each enterprise user. The default
UserID attribute is the
common name (
cn)attribute defined in the LDAP directory, but can be changed by the Security Administrator.
Choose the Administrators tab (Figure 15-9). Set up all necessary administrators for this Oracle Context, if you haven't already done so.
In order to accept password-authenticated connections, a database must belong to a domain in the Password Accessible Domains group--and the database access permissions on the user search base must be enabled. This enables the database to read the user's login credentials in the directory.
In a selected Oracle9i Oracle Context, add the domain to the Password-Accessible Domains group. Choose Add and select one of the current enterprise domains from the resulting dialog. To remove an enterprise domain from the group, select it in the Accessible Domains window and choose Remove.
Any directory user can be an enterprise user. You can add users to the directory by using one of the following tools:
If you elect to populate the directory with users before using Oracle Enterprise Security Manager, note that user entries must have the
See Also:
You can do any of the following:
Use Oracle Enterprise Manager or SQL*Plus to grant local roles and privileges to the database user or schema; this step is optional.
Use Oracle Enterprise Security Manager to grant enterprise roles to the enterprise user in the directory. User authorizations are the aggregate of both local database roles and enterprise roles.
If you are using a shared schema, use Oracle Enterprise Security Manager to map the user to a schema. You can choose either of the following mapping options:
If you are creating a domain mapping from three users to a shared schema called guest, and you have more than one database in the domain, each database must have a shared schema (called guest) that all three users can access. These three users cannot connect to any database in the domain that does not have a shared schema called guest.
Alternatively, you can create a mapping under a particular database. If you do it this way, the mapping applies only to that database, and not to all databases in the domain. If you have mappings in both places, the database mapping takes precedence.
See Also:
For each user, define a
UserID that is unique across the enterprise (Figure 15-10). The default
UserID is the value in the
common name (cn) attribute defined in the LDAP directory.
Choose a
UserID that conforms to the following:
cn to be the UserID attribute, and Scott's
cn attribute value is
Scott.us, there can be no other
cn=Scott.us defined in any of the users specified in the user search base field.
For example, in Figure 15-10 the
UserID is
Choose the Password tab of the Create User Window (Figure 15-10) to create a password for each enterprise user. Oracle Enterprise Security Manager automatically creates the associated password verifiers and stores them in the
orclPassword attribute of the user entry (Figure 15-11).
|See Also:
The user entry must reside in a directory subtree of users that has been enabled for Oracle database access. You can set Oracle Database Access permissions for a selected subtree--to let databases within a domain in the Password-Accessible Domains group read the user's login credentials.
To enable database access:
On a selected subtree of directory users, set Oracle Database Access permissions to permit databases in the Password-Accessible Domains group to access the user's database login credentials:
For an enterprise user whose
UserID is
hscortea (Figure 15-11) and whose password is
welcome, enter the following to connect using
SQL>connect hscortea/welcome@<TNS Service Name>
The database authenticates the enterprise user (
hscortea) by verifying the username/password combination against the directory entry associated with this user. If successful, the connection to the database is established.
This section describes potential problems and associated corrective actions.
The following tips help you verify that the user has been allocated the correct global roles upon database login and, if necessary, help determine the cause of failure:
SELECT * FROM session_roles;
Do an LDAP search to display the appropriate roles by entering the following:
ldapsearch -h <directory hostname> P <SSL directory port number> -U 3
-W "file:<walletpath>" -P <database wallet password>
-b "cn=oracleDBSecurity, cn=Products, cn=OracleContext, <admin context>"
If you do not see the roles, the database is not in the correct domain--or there is an incorrect distinguished name (DN) in the database wallet certificate. If the database appears to be receiving information from the wrong domain, try restarting the database to update its internal domain membership information.
This error may indicate that you attempted to configure a domestic cipher suite. Run Oracle Net Manager again, and be sure that you choose the Show Domestic Cipher Suites button.
This error indicates that the connection was not over SSL. Look at the
tnsnames.ora file to verify the protocol value of the net service name that you are using. The value must be
TCPS and not
The distinguished name that the wallet uses to connect does not match the DN in the
CREATE USER statement for any schema in the database, and it does not match the DN in any relevant mapping.
ldapbind -h <directory hostname> -p <directory SSL port number> -U 3 -W
"file:[database wallet path]" -P [database wallet password]
Bind successful should be displayed. If the bind fails, try restarting the SSL instance of your directory.
Then try the bind again.
If it still doesn't work, carefully check the wallet location in the configuration set via Oracle Directory Manager. Make sure that it is set to the proper path name.
guest (for example) to be a non-shared schema.
sqlplus as
system/manager@database_name, enter:
alter user guest identified globally as <user DN>;
and then try the
connect /@connect_identifier again. If this succeeds, the problem is associated with the mapping of the user to the schema; use Oracle Enterprise Security Manager to check that mapping in the directory.
If this still fails, the user wallet DN does not match the DN you specified in the
alter user statement. Check the user wallet.
Alter this user back to a shared schema by entering:
alter user guest identified globally as '';
This error usually means that something is wrong with the wallet. Look in the
sqlnet.log file in the current operating system directory for more information. Also, on Windows NT, this can mean that the Oracle service has stopped; check the Services control panel.
Applies to Window NT only.
This error occurs when you attempt to open a wallet that you are not permitted to open.
For Example:
user-x, but you do not have a local
sqlnet.ora file that identifies
c:\winnt\profiles\user-x\oracle\wallets as your wallet location.
sqlnet.ora file in the default location to find the wallet location, and then tries to open the database wallet to get your login credentials.
user-x does not have permission to open the database wallet.
This is a catch-all Oracle9i error that indicates something unanticipated went wrong with the RDBMS to directory LDAP query. It is possible that SSL has failed on the directory--the database and directory wallets may not share a trusted certificate. Try to bind to the directory over SSL using the database wallet.
|See Also:
You can use tracing to help debug. This is appropriate if the
ldapbind (See: ORA-1017: Invalid username/password) fails, indicating that the directory's SSL instance is not working properly.
If you are using Oracle Internet Directory as your ldap directory, use the following tracing procedure:
See Also: Oracle Internet Directory Administrator's Guide
See Also: Oracle Internet Directory Administrator's Guide
$ORACLE_HOME\ldap\log. Look at the file with your SSL directory instance number and an
s in its filename. The log files without the
s are for the monitor process (
oidmon) and the dispatcher. Look at the end of the log file immediately after you have tried your
connect /@connect_identifier. One thing to look for is the string
Distinguished Name to ensure that it matches the DN of your user.
Copyright © 1996-2001, Oracle Corporation.
All Rights Reserved.


text:
Mass Effect 4 Release Date is expected for next year as game developer Bioware reported to have all their attention and focus for a different game this year.
Former BioWare community manager Chris Priestly recently wrote on their official forum that they have been focusing for Dragon Age: Inquisition this year as they prepare for its release date on October before starting a new project namely Mass Effect 4, which is expected next year.
"I would guess that BioWare wants the focus of 2014 to be on Dragon Age: Inquisition," he wrote.
"DA2 was not loved by all fans *cough*, but it was an important step going from DA:O to what DA:I looks to be.
"As such, and to ensure that DA:I will allow for much more DA content to come in the future (DLC for DAI, DA4/5/6 or whatever they get called, ancillary products, etc), I think this year's E3 will heavily push Inquisition to the press and gamers.
To announce whatever the next ME game is called at E3 would dilute BioWare focus.
"I do hope Aaryn or Casey drop a few hints, but I really doubt there will be any teasers, trailers or even substantial news interviews about MENext.
Given that for some fans the last memory of the trilogy was a negative one, I think BioWare will want to really wow prospective ME fans to pay attention to a new title right out of the gate, rather than announcing a few details or teaser trailer, then going dark while DA:I takes center stage." It has been reported, meanwhile, earlier this year that ME might not have the same name when it will be released to stay away from the Commander Shepard storyline seen in the first few installations of the game.
"To call the next game Mass Effect 4 or ME4 is doing it a disservice and seems to cause a lot of confusion here," Priestly wrote on the company's forums .
"We have already said that the Commander Shepard trilogy is over and that the next game will not feature him/her.
That is the only detail you have on the game.
I see people saying 'well, they'll have to pick a canon ending'.
No, because the game does not have to come after.
Or before.
Or off to the side.
Or with characters you know.
Or yaddayaddayadda." For more news and updates regarding Mass Effect 4 Release Date, keep tuning here on Kpopstarz.com.
Also, if you have any comments and insights about Mass Effect 4 Release Date don't forget to leave a comment on the box provided below.

subset: commoncrawl


text:
Studying Event and Festival Management at Bucks New Uni, High Wycombe UK
Always had an interest in photography but never the skills or knowledge to be any good at it really. Then I decided to just start having a go!
I have a Fujica ST605, Chinon Ce-4, Lomo Smena Symbol, Konica Big Mini and Agfamatic 2000 Pocket., I do prefer to shoot in film, but being a student it's not really a possibility all of the time!
However making friends with the guys in the local Jessops has its reduced price perks....
I really like pictures which show some kind of emotion, and especially moving images, and out of focus. Especially skate photography, which I hope to get up on here soon......
I also have a thing for moody pictures, very dark silhouettes contrasting against sunset/clouds. That gives a fairly accurate description of what I like...
I also have a Canon EOS 1000D which comes everywhere with me for backup but I just find digital photography a bit soul-less. And it totally lacks the excitement of film.
I do not photoshop.
Because it's cheating.x
female · 30 · Southwold/United Kingdom
My Photos My Albums My Likes
My Albums
Album: Lomography Slide X-Pro 100 ISO Film - Smena Cosmic Symbolshared by emily_eaton on 2010-09-02 · 8 Photos 8
Album: Konica Big Minishared by emily_eaton on 2010-09-02 · 10 Photos 35
Album: Lomo Smena Symbolshared by emily_eaton on 2010-07-23 · 38 Photos 35
My Metas
- Tags:
- 100iso
- big
- chinon
- cosmic
- dark
- doubleexposure
- exposure
- flash
- gig
- guitar
- konica
- life
- live
- lomo
- long
- lowerthanatlantis
- mini
- music
- night
- nighttime
- redscale
- smena
- still
- stilllife
- symbol


text:
Clairette Blanche
is a white wine grape variety most widely grown in Languedoc Provence and the Rhône.
It was often used to make vermouth to which it is suited as it produces wine high in alcohol and low in acidity.
It is also grown in South Africa for sparkling wines and Australia.
Main features : extremely vigorous, this variety ripens between September 25 and October 25. Sensitive to wind, it prefers poor, dry, stony and warm soils.
œnological potential : Oxidation sensitive, Clairette white produces robust and full-bodied wines with a complex and delicate floral aroma.
Use : Châteauneuf-du-Pape (blended with Roussanne, Bourboulenc and Grenache white ), Lirac, Tavel, Vacqueyras, Côtes du Rhône Villages whites (blended with Bourboulenc, Roussanne, Grenache and Marsanne to make up a minimum of 80% of local grape varieties), Côtes du Rhône whites (in assembly), Languedoc and Provence.


text:
Engine Mechanical problem
1999 Audi Quattro 4 cyl All Wheel Drive Manual 130000 miles
Strange problem. My car starts without a problem when the car is cold, but if it's been running for a little while (usually more than 30 minutes) and the engine is warmed up, it has a hard time restarting after I turn off the engine (stopping at a gas station is always a hassle).
The engine eventually catches (very slow, gradual catch), but it just cranks and cranks and cranks sometimes for 15-20 seconds before that happens.
Any ideas?
Audi A4 Quattro 1.8T
have the same problem?
Wednesday, February 20th, 2008 AT 7:40 PM


text:
More than 4000+ deals across 17 cities and more...
click here for
Online Coupons
All Online Deals Arts, Crafts & Antiques Automobiles & Accessories Books & Magazines Clothing & Accessories Computers & Accessories Deals-For-NRIs Diagnostic Labs Education Electronics End-Of-Season-Sales Eye Care Food & Groceries Footwear & Shoes Furniture & Interiors Gifts & Flowers Health & Beauty Health-Dental
Xtreme Sports Bar Coupons in Bengaluru
Restaurants: Xtreme Sports Bar in Bengaluru Discount Offers
Date: 31st Dec 2014
Venue: Xtreme Sports Bar, Cunningham Road, Bangalore
Ticket Prices:
Couple: Original Price: Rs.3499, Discounted Price: Rs.3150
Stag: Original Price: Rs.2999, Discounted Price: Rs.2700
Girls: Original Price: Rs.999, Discounted Price: Rs.900
Offer Includes: Unlimited Liquor & Buffet
Note: Discount offered on UPto75.com is only applicable on purchase of tickets directly from organizers mentioned over here. Discount not applicable on ticket purchase from other third-party sites.
Call for Bookings & Other Details: +91 9916480927, +91 9886122458
Xtreme Sports Bar Address:
37/1, 3rd/4th Floor, Above Domino's Pizza, Cunningham Road, Bangalore, Karnataka - 560052
How to download Xtreme Sports Bar coupons on UPto75.com
1. To get the Coupons, Click on View / Email / SMS Coupon Buttons next to the banner. The coupon code will be sent to your email address or mobile.
2. Before you visit the merchant, please check with merchant regarding any queries you may have regarding the offer.
3. In case of coupon not being honored, contact UPto75.com Support.
4. Once you are at the Merchant place, present the coupon before the order is placed.
5. This Offer is exclusive to UPto75.com Users.
Xtreme Sports Bar DetailsXtreme Sports Bar, one of the largest chains of Sports Bars in the country, offers you an ambience and experience much more exciting than even the VIP Lounge at the stadium. It has large plasma screens with Hi Definition Digital Images that grip your attention and give you a feeling of watching your matches live. Your glasses are kept full by the efficient attenders while you are engrossed in the game. They have a wonderful variety of beverages and short-eats. You can also vouch on them for some filling meals to end the day. Xtreme Sports Bar has a number of fantastic and highly popular outlets in Hyderabad, Bangalore and Vizag. Go check out the Happy Hours & Offers at Xtreme Sports Bar.
Xtreme Sports Bar Corporate Address
16, Off Sarjapur Main Road & Hosa
Inside Play Arena, Kaikondrahalli,
Bengaluru, India 560035
Check Latest Discount Coupons in these Related Categories
Active Offers you may be interested on 17 March 2018:
» Aarogyam 1.7 - Thyrocare Health Check Up Package (88 tests) at Rs.2000.
Share offer Before April 30, 2018» Avail Rs.500 OFF on a Bill of Rs.2000 for Salon Services at Vibes (25 Locations).
Share offer Before June 30, 2018» Phoolwala Coupon - Flat 15% OFF on Entire Store.
Share offer Before March 31, 2018» Up to 38% Discount on Health Checkups at NM Medical Center, Indira Nagar, Bengaluru.
Share offer Before June 30, 2018
Frequent Searches Leading to this Page: Xtreme Sports Bar Coupons
Share Your Comments
Please share with fellow UPto75.com users, items you had purchased from , how much money you have saved, what services you have used OR any other information that might help in their buying decision. Please do not self-promote nor complain against the merchant here. For any such issues, please contact customer support.


text:
Monday, August 06, 2012
Wheeler Makes First Start For The Bisons
By Jason Frank
Maybe nerves got the best of him, but clearly Wheeler didn't have his best stuff. Although he struggled, Zack still showed he has the potential to be an overpowering pitcher. When he eventually pitches in the big leagues, there is no doubt that Wheeler will have many strikeout victims. I expect Wheeler will improve in his next start, and look for him to do a better job of mixing up his pitches.
Regardless of his performance tonight, Zack Wheeler is still one of the best prospects in the game. It will just take time.
Published at Monday, August 06, 2012
Labels: 2012 Debut, Buffalo Bisons, Jason Frank, Zach Wheeler
Subscribe to: Post Comments (Atom)


text:
Group Details
Group Forum
October 30, 2009 9:39 AMshemara WilmingtonOn October 7th my little Kayla gave birth to her babies. She had five, 2 girls and 3 boys. She is a very good mom. All ... more
October 11, 2009 3:43 PMshemara WilmingtonAfter so much heartache and feeling of loss from my little Mico's death, I bought another little silky and named her Kayla. She ... more
August 4, 2008 1:05 PMshemara WilmingtonThis poem brought me a lot of comfort when I read it and I wanted to share it with all of you. Enough. please, I'm ready to go. ... more
Group Bulletin Board
Hurting a bit right now. Last night I had to put down my dog, Bonzo. I know I did the right thing, she was in near constant pain from liver cancer, but that doesn't make her loss any easier to bear. I keep reminding myself that all creatures that experience love have a soul, because that's what souls are made of. In the end, the soul returns to the love from where it was created, and I pray that she will be there to greet me the day that I too, become love.Stu
Hi Krazzewoman, I have been away for awhile but I am back and am glad to welcome you here for the support that you need. I believe that Dusty will always be in your heart and their spirit always around you. I have been where you are and I know that with time, things will get better. It doesn't happen right away, but it does happen. Just keep the memories of the two of you in the forefront of you mind and you will get through. I will be praying for you and your family. May you be blessed always. Shemarashemara
Dear Friends, I joined this group looking for support and understanding as I grieve the loss of my favorite siamese cat, "DUSTY", who was also my very best friend in this world. She taught me the meaning of unconditional love. I shared all my thoughts with her in the many conversations I had with her while she just purred and snuggled my cheeks. She was with me for thirteen beautiful years and Friday, the 13th, I had to have her put to sleep as she had 3 kittens in the early morning hours while I slept and the birth of the last one prolapsed her uterus. Now I have three beautiful orphaned kittens that I am trying desperately to help survive as well as a very heavy heart over my loss. Please pray for me and Dusty's kittens. Thank you and God Bless you.Krazeewoman1956


text: Quick Bites Comment of the Day: Souper Duper Adam Kuban Profile Twitter Facebook 0 Printer-Friendly Version "I hated Juno and love soup, too. Can't wait to try this out! Autumn is meant to be slurped through." —gastronomeg Get the Recipe The Crisper Whisperer: Escarole and Bean Soup with Pistachio Pesto View Recipe »


text:
1 year full-time; 2 years part-time
For current fees visit our website
31 July 2017
Visit our website for more information on fees, scholarships, postgraduate loans and other funding options to study Abnormal and Clinical Psychology at Swansea University - 'Welsh University of the Year 2017' (Times and Sunday Times Good University Guide 2017).
Clinical psychology focuses on the challenges faced by people with clinical, mental or physical (neuropsychological) health conditions. The role of the clinical psychologist is to work with these individuals and attempt to improve their quality of life. The Master's degree in Abnormal and Clinical Psychology at Swansea is designed to equip students with an advanced understanding of the theory and practice of clinical psychology in healthcare settings. The primary purpose of the Abnormal and Clinical Psychology course is to allow students to gain knowledge and experience to enhance their suitability for professional clinical training (i.e. a three year DCl in Clinical Psychology programme at a BPS accredited training centre; see http://careers.bps.org.uk/area/clinical).
Entry onto a clinical psychology doctorate training programme is extremely competitive, with candidates usually expected to have acquired training and experience beyond degree level. We have a proven track record of helping our students progress towards clinical psychology training, as well as roles in a range of other clinical mental health-related occupations. Our MSc Abnormal and Clinical Psychology alumni have also secured NHS clinical based placements, providing valuable experience for those seeking to attain Assistant Clinical Psychologist positions.
The majority of our teaching is carried out by practicing and/or qualified Clinical Psychologists and related professionals, ensuring that students are learning from those with direct experience of professional challenges.
Course modules are assessed using a range of different approaches, including written examinations, essays, presentations and clinical case studies.
Study on the course can be undertaken either full time (1 year) or part time (2 years) basis, with teaching condensed into two weekdays to more easily accommodate part-time students and for relevant experience to be gained alongside the degree. Taught modules are provided in the first two semesters, with the research project typically undertaken over the summer.
Students on the MSc Abnormal and Clinical Psychology typically include:
* UK and international psychology graduates seeking positions as Assistant Psychologists (both in the UK and abroad) as part of their journey towards becoming a BPS Chartered Clinical Psychologist.
* Psychology graduates aiming to work in related fields of applied psychology and other areas of clinical mental health.
* Healthcare and other clinical professionals looking to expand their understanding of particular areas of abnormal and clinical psychology.
* Psychology graduates who have relevant work experience to apply for further clinical training, but who need to enhance their academic and research skills.
* Psychology graduates aiming to secure a PhD by Research in a clinically applied area.
The MSc Abnormal and Clinical Psychology is unique in the range of modules the programme offers:
• Eating Disorders
• Psychosis
• Personality and Sexual Disorder
• Clinical Neuropsychology
• Psychotherapy
• Statistical and Research Methods
• Affective and Somatoform Disorders
• Applied Behaviour Analysis
• Coping with Chronic Disease
• Psychopharmacology for Clinical Psychologists
Students will also complete a substantial research project in their chosen field of study.
Here's what students had to say about the Abnormal and Clinical Psychology MSc:
"Completing the MSc has been very beneficial, as in addition to improving my academic knowledge and skills, as well as confidence, it has enabled me to quickly secure employment in this field". Sam (MSc Abnormal and Clinical Psychology, 2013-14)
"The level of expertise of the lecturers is second to none" Katie (MSc Abnormal and Clinical Psychology, 2011-12)
"An outstanding and highly interesting MSc program" Vasilis, international student from Greece (MSc Abnormal and Clinical Psychology, 2009-10)
"Thanks to my masters, I am in such a good placement in an Intensive Care Unit (ICU) of a multi-speciality hospital's Cardiology Unit" Phoram, international student from India (MSc Abnormal and Clinical Psychology, 2009-10)
"The MSc in Abnormal and Clinical Psychology provided me with an excellent theoretical knowledge of a wide variety of psychological approaches" – Ruth (MSc Abnormal and Clinical Psychology, 2008-09)
"I'm now an Assistant Psychologist in Cardiff, and I do not think I would have had a chance of getting such a post if I didn't have the MSc. I'm really glad I did it!" - Bryn (MSc Abnormal and Clinical Psychology, 2008-09)
"The MSc helped me to get my first assistant post and provided me with a good academic basis to pursue a career in clinical psychology. I am now undertaking the DClin Psych course in Oxford!" - Nicola (MSc Abnormal and Clinical Psychology, 2007-08)
The Department of Psychology at Swansea University is a thriving research led department that provides a friendly, supporting learning environment with instruction from world-class researchers. Our consistent ambition is to provide outstanding excellence of teaching and learning for all our students – as demonstrated by a recent Teaching Quality Assessment national audit that judged our teaching as 'Excellent'. Moreover, the research caliber of our group has also been demonstrated. For example, in The Research Excellence Framework (REF) 2014, we were one of only four psychology departments to achieve a 100% 4* rating (maximum score possible) for the reach and significance of its work.
Visit the Abnormal and Clinical Psychology MSc page on the Swansea University website for more details!
Swansea University
Copyright 2005-2018
All rights reserved.
Unknown (change)


text:
Austin, TX (PRWEB) November 14, 2013
Dr. David A. Baker is increasing awareness this November that gum disease can cause diabetes, and that diabetes can also contribute to the development of gum disease. These two diseases are both very prevalent in the United States, with nearly half of the population suffering from some form of gum disease, and 8.3 percent of Americans affected by diabetes. At his practice in Austin, TX, Dr. Baker performs state-of-the-art gum disease treatment to help reduce patients' risk of developing illnesses like diabetes.
Recent research has suggested that the link between these two diseases goes both ways. Diabetes can lead to gum disease by weakening the immune system and making the body more prone to infection. In turn, gum disease can also lead to diabetes. This is because a chronic infection like periodontitis can result in fluctuating glucose levels. Timely and effective treatment of gum disease may reduce risk of developing diabetes in many cases. With this goal in mind, Dr. Baker offers the Laser Assisted New Attachment Procedure (LANAP) to eligible patients.
LANAP uses a highly selective laser instead of a scalpel, making it less invasive than more traditional methods of treatment. The Periolase MVP – 7 laser targets and removes diseased tissue while leaving healthy tissue alone. This allows healthy tissue to re-connect to the roots of teeth and optimize healing. LANAP is also one of the only forms of periodontal treatment that helps to reverse dental bone loss related to gum disease. In many cases, Dr. Baker's Austin, TX, patients experience fast healing times and very little discomfort with this alternative form of gum disease treatment.
Dr. Baker wants to remind patients that reducing risk of diabetes is important because it can be a difficult-to-manage disease with very serious complications. Potential complications include neuropathy, problems with vision, digestive problems, and even emotional issues related to living with diabetes. Diabetes sufferers should be mindful of their illness being a potential gum disease cause and should practice good oral health care to prevent gum disease. For more information about the link between these two illnesses and treatment options for periodontal disease, visit http://www.davidabaker.net.
About The Doctor
Westlake Family Dental Care is a general practice offering personalized dental care for patients in Austin, TX since 1997. Dr. Baker received his dental degree from the University Of Texas Health Science Center San Antonio Dental School and scored in the top two percent of the nation in Endodontics and Periodontics. He is part of one percent of dental professionals providing the LANAP FDA cleared laser procedure for gum disease and periodontal treatment. Dr. Baker stays abreast of the dental techniques and technology by attending at least 30 hours of continuing education each year. In addition to LANAP, Dr. Baker provides services such as fixed lower dentures, mini-implants, and TMJ. To learn more about Westlake Dental Care and their dental services, visit their website at http://www.davidabaker.net and call (512) 782-8422.


text:
Dear Dragon, I am at a complete loss for words when it comes to my relationship. My boyfriend is a "thug" and I am a college student that is smart, kind, caring, loving, and nurturing. We have been together for well over a year and he has a child that I love and adore like my own. My problem is that he is obsessed with making dirty money that he thinks he can turn into clean money. I feel as though there are too many risks involved, especially since he has a kid in the picture. Though he lives at home with his mother and is not open to my suggestions of getting government assistance, i really want to help him change his life. He had a rough childhood that has even bordered on suicide but he is a great guy who genuinely cares for me.
At first i thought i could help him, but now i'm beginning to feel hopeless because he still thinks he can go out in to the streets and make money selling drugs. He tells me that it's not gonna be forever, but I wonder. Please help me figure out what i'm doing wrong. – Jayma
Hi Jayma, thanks for writing in for my advice. I see your boyfriend's plight and it is one that isn't exclusive to our brothers in the illegal life. The issue is that he has always known a certain way to make money, he trusts that it works and he imagines that with the right amount of push, he will be able to transcend into bigger things. Nas's famous words of "a drug dealer's destiny is reaching a key" comes to mind here. Many small time drug dealers imagine that with the right connections, the right moves, and a whole lot of luck, they can be the kingpin in a mansion doing lower risk deals for 100 times the money. It's the Breaking Bad fantasy, we watch shows like The Wire and dream of having enough money to get out of the game.
When a man knows how to earn,
you cannot easily convince him to change his hustle.
The only way I know for you to redirect a man from his proven path of earning money, is to introduce him to another man that has had the same bumps and bruises in life, but found a way out that was faster, more legal, and a no-brainer. There are many ways to hustle, and a guy living at home with mom can make enough money to get out and start something else just by choosing the right thing to get into. The issue with this however is that your guy may not have the patience to start over when he can get the drugs easily and sell it for small, but fast money. There is no way to change someone like this unless they themselves want to change.
Men that are caught up in that life seem to sign an unwritten contract that binds them to it well into old age. I wonder how many men your boyfriend knows that have started out as small time dealers and are now out of the game, taking care of their family, and free? It's the stuff of video game and movie writing, not necessarily real life. Getting out also means knowing how to manage and flip money on a personal level… even Stringer Bell had to go to school to learn that part.
The guys who actually manage to reach the Drug Dealer's Destiny were either have legendary luck, or they are so far ahead of the game that they are damn near geniuses. How many Jay-Z's do you know? The thugs that become family men are the ones who change overnight when they see their child and want to be more than a daddy in jail to them. Unfortunately this isn't every guy, so it goes right back to what I wrote before in it being up to your man to change himself.
There are also a bigger question to answer here: Is your man mature enough mentally to become a crumb in society? Working, grinding, slaving in a regular job to support you and yours?
The only way to play it as the person who loves the thug is to make sure that you and yours are provided for — this is within your power — but continue to talk to him about getting out of the life. For your own good, and I'm being honest here, you need to prepare yourself for the worst. Should he come around, then boom – life did you a solid but if he continues to play with fire and he will get burnt, then you will be the one left to pick up the pieces.
You need to not be a lovesick person who lets her life fall apart for a man who doesn't have his act together. Work on your life and don't allow a thug to hold you back, especially one who will not change. When a man sees that his woman is carrying the load he either steps it up to maintain his manhood and take the load from her, or he sulks away in self-pity. We can only motivate our loved ones who are grown by providing them role models and mentors, or stepping ourselves up to show them that they can do it too.
I wish you all the luck in the world but I cannot pretend that what you are facing is going to be easy. Thanks for your letter.See some words or phrases that you don't understand? Check out The Dragon's Lexicon.


text:
DENVER — Timberwolves coach Rick Adelman was informed before the team's game against Denver on Thursday night, Jan. 3, that backup center Greg Stiemsma went straight to the locker room when he fouled out with 3:15 left in the fourth quarter of the Wolves' loss at Utah on Wednesday night.
Five seconds before Stiemsma picked up his sixth foul, he and Utah reserve center Alec Burks were assessed double fouls for pushing each other.
An angry Stiemsma walked right past the Wolves bench to the locker room when he fouled out, ending a frustrating night in which he played only eight minutes and finished with two points and one rebound.
Adelman said he didn't see Stiemsma's exit but said he didn't "have an issue with it."
"He was upset," Adelman said of Stiemsma. "If I could have, I would have walked off too. If I had noticed it, I might have followed him. I wasn't real happy with those officials anyway."
Follow Ray Richardson at twitter.com/twolvesnow.


text:
- Home
- News
- Sports
- Opinion
- Obituaries
- Features
- Special Sections
- Classifieds
- Public Notices
OCEAN ISLE BEACH—Ocean Isle Beach residents want to know more about future plans for town-owned property.
They brought up concerns about the property and other issues during an open forum Monday evening at town hall.
The meeting was one of four open forums town commissioners host each year so residents can voice concerns about town issues.
The meetings are in the evening to allow residents who can't make the monthly 9 a.m. Tuesday board meetings an opportunity to attend.
If you currently subscribe or have subscribed in the past to the Brunswick Beacon, then simply find your account number on your mailing label and enter it below.
Click the question mark below to see where your account ID appears on your mailing label.
|ZIP Code:


text:
Just When Swiss Say Chocolate Is Safe Cyprus Hits Franc
Swiss companies from toilet manufacturer Geberit AG (GEBN) to chocolate maker Lindt & Spruengli AG (LISN) are anticipating the franc will weaken and boost earnings this year. Europe's latest debt crisis flare-up may spoil the bet.
While the Swiss currency reached a 20 month-low of 1.2569 per euro in January, it has since strengthened to 1.2154 as Cyprus sought a bailout and political deadlock in Italy prevented a government from being formed. Options indicate the franc will trade closer to the central bank-imposed 1.20 per euro cap by year-end than 1.25.
A weaker franc would help Swiss companies sell more products abroad and compete with cheaper offerings from neighboring countries such as Germany. Geberit, Bucher Industries AG (BUCN), Belimo Holiding AG (BEAN) and Daetwyler Holding AG (DAE) are budgeting for 2013 exchange rates as weak as 1.25 francs per euro. Recent economic and geopolitical events in Europe are a threat to those assumptions, according to Credit Suisse AG.
"It's definitely a risk if we have significant contagion spreading due to the Cyprus crisis," said Bernd Berg, a currency strategist at Switzerland's second-biggest bank.
Defending Cap
Economic crises increase short-term demand for currencies seen as a refuge, pushing up the value of the franc, Berg said. He added that there is a concern savers in Italy and Spain may withdraw money from local lenders, leading to a "bank run in the euro zone" after capital controls were instituted limiting depositors' access to their funds in Cyprus.
It's critical for Switzerland to keep the franc from rising and damaging the economy. The Swiss National Bank said last month that growth is expected to be 1 percent to 1.5 percent this year. That compares with 2.35 percent for the global economy, according to surveys of economist by Bloomberg.
The franc rose to as high as 1.008 per euro in August 2011, from as low as 1.6828 in 2007, before the SNB imposed the 1.20 per euro ceiling in September 2011 to help exporters and fend off deflation.
The central bank's campaign to defend the cap has led to foreign currency holdings ballooning to more than 400 billion francs ($425 billion), or almost three-quarters of annual output. It spent 188 billion francs intervening last year, 10 times the 2011 amount.
Options Contracts
Options contracts betting the franc will weaken are about to the cheapest since January. There is also a greater chance of the franc appreciating to 1.20 per euro than weakening to 1.25 by year-end, data compiled by Bloomberg shows.
At the same time, the current median estimate by strategists and economists surveyed by Bloomberg is for franc to trade at 1.25 to the euro by year-end and 1.30 in 2014. Credit Suisse's Berg predicts the franc will depreciate once the euro- zone economy recovers.
The assumptions of Swiss companies and economists for a weakening franc also stem from successful efforts by the SNB to discourage speculators by defending the cap. The franc ranged from 1.2007 to 1.2189 per euro in 2012. The central bank reiterated March 14 its willingness to spend unlimited amounts to keep the ceiling from being breached.
The central bank did a "great job" defending the franc cap and there is "no reason to believe" it will change policy, Thomas Aebischer, the chief financial officer of Jona, Switzerland-based Holcim Ltd. (HOLN), the world's largest cement maker, said in an interview in February.
'Clear Line'
Lindt, the world's largest maker of premium chocolate, said March 15 there are signs of a weaker Swiss currency, which may boost exports. Syngenta, the world's biggest producer of crop chemicals, isn't expecting losses from the franc this year after losing about $220 million in operating profit in 2012, mostly because of Swiss currency movements, CFO John Ramsay said Feb 6.
The 1.20 per euro level is "a clear line which should not be crossed, and gives us security that things stay as they are," said Roland Iff, the CFO of Geberit, which gets more than 90 percent of its sales from Europe. "If nothing happens we could see levels at 1.25 again," Iff said in an interview on March 12, adding that the company benefited from the strengthening euro in the first quarter.
Iff's comments show why predictions for the franc may prove difficult. Within a week of his comments, euro-area leaders agreed on a plan to impose losses on deposits in Cypriot banks. The franc since has strengthened 1 percent against the euro.
Swiss 'Homework'
Scenes of Cypriots lining up at cash machines raised the specter of capital flight elsewhere and threatened to disrupt a market calm that settled over the currency bloc since the European Central Bank's pledge in September to backstop troubled nations' debt. The euro-zone economy has contracted for five straight quarters and the ECB predicts gross domestic product will shrink 0.5 percent in 2013.
Most Swiss companies, which employ Europe's highest-paid workforce, are able to operate under the ceiling as currency losses in recent years prompted them to cut costs, said Martin Lehmann, a money manager at 3v Asset Management in Zurich.
"Most of the companies did their homework and adapted their cost base well to the new level," he said.
Bucher Chief Executive Officer Philip Mosimann said in a March 14 interview that, while many bigger Swiss companies such as his maker of agricultural machinery and street sweepers with annual sales of 2.6 billion francs are able to live with the current exchange rate, smaller companies are desperate for the currency to weaken as they can't move production abroad and depend on sales to Europe.
Since 2008, Bucher probably lost at least 400 million francs in sales because of the currency's gain versus the euro, a figure that would be difficult to stomach for other companies, according to Mosimann.
"If you ask the CEO of a small or medium-sized company, he'll tell you, 'I just can't live with 1.20,'" he said.
To contact the reporter on this story: Patrick Winters in Zurich at email@example.com
To contact the editor responsible for this story: Simon Thiel at email@example.com