Connections > Oracle connection properties > Prerequisites
  

Prerequisites

You can use Oracle Connector to connect to an SSL-enabled Oracle database with Oracle database authentication or Kerberos authentication.
To connect to an SSL-enabled Oracle database, see SSL configuration.
To connect to Oracle databases with Kerberos authentication, see Kerberos authentication.

SSL configuration

Before you use a secure Oracle connection with Oracle database authentication or Kerberos authentication to connect to an SSL-enabled Oracle database, the organization administrator needs to perform the prerequisite tasks.
  1. 1Create a truststore certificate.
  2. 2Create a keystore certificate. Applicable only when Client authentication is enabled in the Oracle database.

Adding the server certificate to the truststore

Add the server certificate to the client's truststore to establish a secure Oracle connection.
Use the following keytool command to add the server certificate to the client's truststore:
keytool -import -trustcacerts -alias ca -file <server certificate with path> -keystore
<name of truststore to be generated with extension> -storepass <password for truststore> -storetype <store type>
For example, consider you have a server certificate oratls_server.cert in the following location: C:\SSL\oracle
    1Run the following command to create the truststore truststore.jks with the truststore password “password”:
    C:\SSL\oracle> keytool -import -trustcacerts -alias ca -file oratls_server.cert -keystore truststore.jks -storepass password -storetype JKS
    2Run the following command to create the PKCS12 truststore truststore.p12 with truststore password “password”:
    C:\SSL\oracle> keytool -import -trustcacerts -alias ca -file oratls_server.cert -keystore truststore.p12 -storepass password -storetype PKCS12

Creating a keystore certificate

Create a keystore certificate when client authentication is enabled in the Oracle server. You must create a keystore certificate that contains all the client certificates to establish an Oracle connection.
Perform the following steps to create a keystore certificate:
    1Download and install the Oracle client from the Oracle website.
    2Run the following command to create an Oracle wallet:
    orapki wallet create -wallet <Path where wallet is to be created> -auto_login -pwd <wallet password>
    3Run the following command to create a self-signed client certificate to the Oracle wallet:
    orapki wallet add -wallet <Path where wallet is to be created> -dn "CN=<common name>, OU=<organization unit>, O=<organization>, L=<locality>, ST=<state>, C=<country>" -keysize <key size in bits> -self_signed-validity <number of days> -pwd <wallet password>
    The command runs and creates the pkcs12 certificate at the specified location.
    You must specify the values of the CN=<common name>, OU=<organization unit>, O=<organization>, L=<locality>, ST=<state>, C=<country>, keysize <key size in bits>, self_signed -validity <number of days>, and pwd <wallet password> from the server certificate.
    4 Run the following orapki command to export the self-signed client certificate:
    orapki wallet export -wallet <wallet path> -dn "CN=<common name>, OU=<organization unit>, O=<organization>, L=<locality>, ST=<state>, C=<country>" -cert <Name of the exported certificate with path>
    The -dn command identifies the client certificate uniquely as the server wallet contains multiple client certificates installed.
    5Install the self-signed client certificate in the server Oracle wallet.
    Note: The client authentication fails if you do not add the self-signed client certificate to the server database Oracle wallet.
    6 Add the server certificate as a trusted certificate to the Oracle wallet.
    Run the following command to add the server certificate:
    orapki wallet add -wallet <wallet path> -trusted_cert -cert <Name of the server certificate with path> -pwd <wallet password>
    Note: You must use the same wallet password for all orapki commands.
    Example Tasks
    Perform the following tasks to create a keystore certificate:
    1. aRun the following command to create an Oracle wallet:
      2. C:\app\client\ksuwalka\product\12.1.0\client_1\BIN>orapki wallet create -wallet C:\app\client\ksuwalka\product\12.1.0\client_1\owm\wallet -auto_login -pwd oracle4u
    2. bRun the following command to create a self-signed client certificate to the Oracle wallet:
      3. C:\app\client\ksuwalka\product\12.1.0\client_1\BIN>orapki wallet add -wallet C:\app\client\ksuwalka\product\12.1.0\client_1\owm\wallet -dn "CN=inw1pc07_kriti, OU=DEV, O=infa,L=blr, ST=ka, C=IN" -keysize 2048 -self_signed -validity 3650 -pwd oracle4u
      The ewallet.p12 certificate is created in the following location: C:\app\client\ksuwalka\product\12.1.0\client_1\owm\wallet
    3. cRun the following orapki command to export the self-signed client certificate:
      4. C:\app\client\ksuwalka\product\12.1.0\client_1\BIN>orapki wallet export -wallet C:\app\client\ksuwalka\product\12.1.0\client_1\owm\wallet -dn "CN=inw1pc07_kriti, OU=DEV, O=infa,L=blr, ST=ka, C=IN" -cert C:\Users\ksuwalka\Desktop\client_inw1pc07.cert
    4. dAdd the server certificate as a trusted certificate to the Oracle wallet. Run the following command to add the server certificate:
      5. C:\app\client\ksuwalka\product\12.1.0\client_1\BIN>orapki wallet add -wallet C:\app\client\ksuwalka\product\12.1.0\client_1\owm\wallet -trusted_cert -cert C:\SSL\oracle\oratls_server.cert -pwd oracle4u
      You can now use the keystore C:\app\client\ksuwalka\product\12.1.0\client_1\owm\wallet\ewallet.p12 with keystore password oracle4u.

Kerberos authentication

You can use Kerberos authentication to connect to Oracle databases by placing the required configuration files on the Secure Agent machine. You can also use Kerberos authentication to connect to SSL-enabled Oracle databases.
When you configure Kerberos authentication to connect to Oracle, consider the following guidelines:

Configuring Kerberos authentication

Before you use Kerberos authentication to connect to Oracle on Linux or Windows, the organization administrator needs to perform the prerequisite tasks.
  1. 1To configure the Java Authentication and Authorization Service configuration file (JAAS), perform the following tasks:
    1. aCreate a JAAS configuration file on the Secure Agent machine.
    2. bAdd the following entries to the JAAS configuration file:
      3. JDBC_DRIVER_01 {
      com.sun.security.auth.module.Krb5LoginModule required useTicketCache=true;
      };
  2. 2To configure the krb5.conf file, perform the following tasks:
    1. aCreate a krb5.conf file on the Secure Agent machine.
    2. bAdd the details of the Key Distribution Center (KDC) and admin server to the krb5.conf file in the following format:
      3. [libdefaults]
      default_realm = <Realm name>
      forwardable = true
      ticket_lifetime = 24h

      [realms]
      <REALM NAME> = {
      kdc = <Location where KDC is installed>
      admin_server = <Location where KDC is installed>
      }
      [domain_realm]
      <domain name or host name> = <Domain name or host name of Kerberos>
      <domain name or host name> = <Domain name or host name of Kerberos>
  3. 3Set the following environment variables on the Secure Agent machine.
    4. For more information about the required environment variables, see Setting environment variables.
  4. 4Restart the Secure Agent.
  5. 5To generate the credential cache file on the Secure Agent machine and use Kerberos authentication to connect to Oracle, perform the following tasks:
    1. aOn the Secure Agent machine, run the following command and specify the Oracle user name and realm name:
      2. Kinit <user name>@<realm_name>
    2. bWhen prompted, enter the password for the Kerberos principal user.

Setting environment variables

To use Kerberos authentication to connect to Oracle, you need to set the required environment variables on the Secure Agent machine.
Set the following environment variables:
After you set the environmental variables, you need to restart the Secure Agent.
Alternatively, you can add the environment variables when you create an Oracle connection.
To add the environment variables when you configure a connection and use Kerberos authentication, you need to add the KRB5_CONFIG, KRB5CCNAME, and JAASCONFIG properties in the Metadata Advanced Connection Properties field in an Oracle connection.
For example, add the properties in the following format:
KRB5_CONFIG=<Absolute path of the Kerberos configuration file>\krb5.conf;KRB5CCNAME=<Absolute path of the credential cache file>/<File name>;JAASCONFIG=<Absolute path of the JAAS config file>\<File name>.conf
Note: Ensure that you separate each key-value pair with a semicolon.