Oracle Database B10772-01 Administrator's Manual page 131

The Oracle database server, acting as the RADIUS client, passes the data from
2.
the Oracle client to the RADIUS server.
The RADIUS server passes the data to the appropriate authentication server,
3.
such as a Smart Card, SecurID ACE, or token card server.
The authentication server sends a challenge, such as a random number, to the
4.
RADIUS server.
The RADIUS server passes the challenge to the Oracle database server /
5.
RADIUS client.
The Oracle database server / RADIUS client, in turn, passes it to the Oracle
6.
client. A graphical user interface presents the challenge to the user.
The user provides a response to the challenge. To formulate a response, the user
7.
can, for example, enter the received challenge into the token card. The token
card provides a dynamic password to be entered into the graphical user
interface. The Oracle client passes the user's response to the Oracle database
server / RADIUS client.
The Oracle database server / RADIUS client sends the user's response to the
8.
RADIUS server.
The RADIUS server passes the user's response to the appropriate authentication
9.
server for validation.
The authentication server sends either an Access Accept or an Access Reject
10.
message back to the RADIUS server.
The RADIUS server passes the response to the Oracle database server /
11.
RADIUS client.
The Oracle database server / RADIUS client passes the response to the Oracle
12.
client.
Example: Asynchronous Authentication with Smart Cards
With smart card authentication, the user logs in by inserting the smart card—a
plastic card (like a credit card) with an embedded integrated circuit for storing
information—into a hardware device which reads the card. The Oracle client sends
the login information contained in the smart card to the authentication server by
way of the Oracle database server/RADIUS client and the RADIUS server. The
authentication server sends back a challenge to the Oracle client, by way of the
RADIUS server and the Oracle database server, prompting the user for
authentication information. The information could be, for example, a PIN as well as
additional authentication information contained on the smart card.
RADIUS Authentication Modes
Configuring RADIUS Authentication 5-7