Oracle® Key Vault

Administrator's Guide

12c Release 1 (12.1)

E41361-13

March 2016

Oracle Key Vault Administrator's Guide, 12c Release 1 (12.1)

E41361-13

Copyright © 2013, 2016, Oracle and/or its affiliates. All rights reserved.

Contributors: Janet Blowney, Todd Bottger, Janis Greenberg, Min-Hank Ho, Patricia Huey, Swapna Jawarikapisha , Srivatsan Kannan, Shirley Kumamoto, Michael Leong, Dah-Yoh Lim, Rahil Mir, Sunil Pulla, Sindhu Ravichandran, Scott Rotondo, Saikat Saha, Vipin Samar

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Contents

List of Examples

List of Figures

List of Tables

Preface

- Audience

- Documentation Accessibility

- Related Documents

- Conventions

Changes in This Release for Oracle Key Vault Administrator's Guide

- Changes in Oracle Key Vault Release 1 (12.1)

1 Introduction to Oracle Key Vault

- About Oracle Key Vault and Key Management

- Benefits of Using Oracle Key Vault

- Who Should Use Oracle Key Vault?

- Major Features of Oracle Key Vault

- Centralization of TDE Master Keys, Oracle Wallets, Java Keystores, and Credential Files

- Management of Key Lifecyle

- Reporting and Alerts

- Separation of Duties for Oracle Key Vault Users

- Support for a High Availability Environment

- Backup and Restore Functionality for Security Objects

- Compatibility and Deployment Support

- Support for OASIS Key Management Interoperability Protocol (KMIP)

- Oracle Key Vault Interfaces

- Outline of Steps for Using Oracle Key Vault

2 Oracle Key Vault Concepts

- Overview of Oracle Key Vault Concepts

- Oracle Key Vault Use Cases

- Centralized Storage of Oracle Wallet Files and Java Keystores

- Centralizing Management for a TDE Direct Connection of TDE Master Keys

- Storage of Credential Files

- Access Control Configuration

- Access Control Options

- Access Grants

- Oracle Key Vault Deployment Architecture

- Oracle Key Vault Administration

- About the Administration of Oracle Key Vault

- Separation of Duties

- Overview of Administrative Roles

- Emergency System Recovery Process

- Endpoint Administrators

3 Oracle Key Vault Installation and Configuration

- Oracle Key Vault Installation Requirements

- Oracle Key Vault: A Software Appliance

- System Requirements

- Network Ports

- Supported Endpoint Platforms

- Endpoint Database Requirements

- Installing Oracle Key Vault

- Task 1: Install the Oracle Key Vault Appliance

- Task 2: Perform Postinstallation Tasks

- Overview of the Management Console

- Logging In to the Oracle Key Vault Management Console

- Performing Actions and Searches

- Actions Menus

- Search Bars

4 High Availability, Backup and Restore Operations

- Configuring High Availability for Oracle Key Vault

- About Configuring High Availability for Oracle Key Vault

- Configuring High Availability for Oracle Key Vault

- Switching Primary and Standby Nodes in a High Availability Cluster

- Restoring High Availability After a Failover

- Unconfiguring High Availability

- Backing Up and Restoring Data for Oracle Key Vault

- About Backing Up and Restoring Data for Oracle Key Vault

- Oracle Key Vault Backup Destinations

- About Oracle Key Vault Backup Destinations

- Creating Oracle Key Vault Remote Backup Destinations

- Editing Oracle Key Vault Remote Backup Destinations

- Deleting Oracle Key Vault Remote Backup Destinations

- Scheduling Backup Operations for Oracle Key Vault

- About Scheduling Oracle Key Vault Backups

- Scheduling Oracle Key Vault Backups

- Editing Oracle Key Vault Scheduled Backups

- Deleting Oracle Key Vault Scheduled Backups

- How Other Processes Affect the Oracle Key Vault Backup Process

- Protecting the Backup Using the Recovery Passphrase

- Restoring Oracle Key Vault Data

- About Restoring Oracle Key Vault Data

- Oracle Key Vault Restore Process

- Restoring Oracle Key Vault Data

- High Availability and the Restore Operation

- Changes Resulting from a System State Restore

5 Managing Oracle Key Vault Users

- About Managing Oracle Key Vault Users

- Creating Oracle Key Vault Users

- Granting or Revoking Roles

- Viewing the Users List

- Oracle Key Vault User Details

- About User Details

- Adding and Modifying User Details

- Managing Oracle Key Vault User Group Membership

- Adding an Oracle Key Vault User to a Group

- Removing an Oracle Key Vault User from a Group

- Oracle Key Vault Password Changes

- Who Can Change Oracle Key Vault Passwords?

- Changing Oracle Key Vault User Passwords

- Deleting Oracle Key Vault Users

- Managing User Groups

- Creating a User Group

- Adding and Modifying User Group Details

- Adding an Oracle Key Vault User to a Group

- Removing an Oracle Key Vault User from a Group

- Deleting an Oracle Key Vault User Group

6 Managing Oracle Key Vault Endpoints

- About Managing Endpoints

- Searching for Endpoints

- Adding, Deleting, or Reenrolling Endpoints

- Types of Endpoint Enrollment

- Enrollment Status

- Adding an Endpoint Using Administrator-Initiated Enrollment

- Adding an Endpoint Using Self-Enrollment

- Deleting or Reenrolling Endpoints

- About Deleting or Reenrolling Endpoints

- Deleting or Reenrolling an Endpoint

- Managing Endpoint Details

- About Endpoint Details

- Modifying Endpoint Details

- Adding Endpoint Membership in a Group

- Managing Virtual Wallet Access to Endpoints

- Adding Endpoint Access to a Virtual Wallet

- Removing Endpoint Access to a Virtual Wallet

- Managing Endpoint Groups

- Creating Endpoint Groups

- About Creating Endpoint Groups

- Creating an Endpoint Group

- Modifying Endpoint Group Details

- Setting Access from an Endpoint Group to a Virtual Wallet

- Removing a Member from an Endpoint Group

- Deleting Endpoint Groups

- About Deleting Endpoint Groups

- Deleting an Endpoint Group

7 Managing Oracle Key Vault Virtual Wallets and Security Objects

- About Virtual Wallets

- Viewing Virtual Wallets

- Creating Virtual Wallets

- About Creating Virtual Wallets

- Creating a Virtual Wallet

- Managing Details of Security Objects

- Searching for Security Object Items

- Viewing, Adding, and Modifying Security Object Details

- About Viewing, Adding, and Modifying Security Object Details

- Item Details Page: Basic Attributes Pane

- Item Details Page: Advanced Pane

- Changing the State of a Key or Other Security Object Item

- About Changing the State of a Key or Other Security Object Item

- Deactivating a Key

- Revoking a Key

- Adding or Removing Items to and from Virtual Wallets

- Managing Virtual Wallet Access

- Granting User and Endpoint Access to Virtual Wallets

- Setting Access for an Individual User to a Virtual Wallet

- Adding Individual User Access to a Virtual Wallet

- Removing Individual User Access to a Virtual Wallet

- Controlling User Group Access to Virtual Wallets

- Adding User Group Access to a Virtual Wallet

- Removing User Group Access from a Virtual Wallet

- Revoking Access Settings of a Virtual Wallet

- Deleting Virtual Wallets

8 Using Oracle Key Vault Endpoints

- About Oracle Key Vault Endpoints

- Overview of Endpoint Enrollment and Provisioning

- Finalizing Enrollment and Provisioning

- Task 1: Enroll and Provision the Endpoint

- Task 2: Install the Oracle Key Vault Client Software on the Endpoint

- Special Notes About Endpoint Provisioning

- Transparent Data Encryption Endpoint Management

- Endpoint okvclient.ora Configuration File

- Oracle Key Vault okvutil Endpoint Utility Reference

- About the okvutil Utility

- okvutil Utility Syntax

- okvutil list Command

- okvutil upload Command

- okvutil download Command

- okvutil changepwd Command

9 Oracle Key Vault Use Case Scenarios

- Uploading and Downloading Oracle Wallets

- About Uploading and Downloading Oracle Wallets

- Uploading Oracle Wallets

- Downloading Oracle Wallets

- Recommendations for Uploading and Downloading Oracle Wallets

- Uploading and Downloading JKS and JCEKS Keystores

- About Uploading and Downloading JKS and JCEKS Keystores

- Uploading JKS or JCEKS Keystores

- Downloading JKS or JCEKS Keystores

- Recommendations for Uploading and Downloading JKS and JCEKS Keystores

- Uploading and Downloading Credential Files

- About Uploading and Downloading Credential Files

- Uploading a Credential File

- Downloading a Credential File

- Recommendations for Uploading and Downloading Credential Files

- Using a TDE Direct Connection with Oracle Key Vault

- About Using a TDE Direct Connection with Oracle Key Vault

- Other Oracle Database Features That Oracle Key Vault Supports

- Configuring a Connection Between Oracle Key Vault and a New TDE-Enabled Database

- Migrating Existing TDE Wallets to Oracle Key Vault

- About Migrating Existing TDE Wallets to Oracle Key Vault

- Migrating an Existing TDE Wallet to Oracle Key Vault

- Restoring Database Contents Previously Encrypted by TDE Using an Oracle Wallet

- Using a TDE-Configured Oracle Database in an Oracle RAC Environment

- Using a TDE-Configured Oracle Database in an Oracle GoldenGate Environment

- About Uploading Oracle Wallets in an Oracle GoldenGate Environment

- Using a TDE Direct Connection in an Oracle GoldenGate Deployment

- Migrating TDE Wallets on an Oracle GoldenGate Deployment to Oracle Key Vault

- Using a TDE-Configured Oracle Database in an Oracle Active Data Guard Environment

- About Uploading Oracle Wallets in an Oracle Active Data Guard Environment

- Uploading Oracle Wallets in an Oracle Active Data Guard Environment

- Performing a TDE Direct Connection in an Oracle Active Data Guard Environment

- Migrating Oracle Wallets in an Oracle Active Data Guard Environment

- Migrating an Oracle TDE Wallet to Oracle Key Vault for a Logical Standby Database

- Checking the Oracle TDE Wallet Migration for a Logical Standby Database

10 General Oracle Key Vault Management

- About General Management of Oracle Key Vault

- Oracle Key Vault Alert Configuration

- About Configuring Alerts

- Configuring the Alerts That Appear in the Oracle Key Vault Dashboard

- Viewing Open Alerts

- Oracle Key Vault Auditing

- About Auditing in Oracle Key Vault

- How Oracle Key Vault Audit Record Export and Deletion Operations Work

- Exporting and Deleting Oracle Key Vault Audit Records

- Viewing Oracle Key Vault Reports

- About Oracle Key Vault Reports

- Accessing the Oracle Key Vault Management Reports

- Viewing Oracle Key Vault Status on the Dashboard

- Status Panes in the Dashboard

- Oracle Key Vault System Administration

- Viewing Oracle Key Vault Status

- Setting the Oracle Key Vault Configurations

- Settings for Configurations Page

- Enabling SSH Access

- System Recovery

- About System Recovery

- Performing System Recovery

- Changing the Recovery Passphrase

A Troubleshooting Oracle Key Vault

- How Do I Find and Troubleshoot Errors?

- How Do I Handle the Error: Cannot Open Keystore Message?

- How Do I Handle General KMIP Errors?

- How Do I Handle WARNING: Could Not Store Private Key Errors?

- How Do I Handle Errors After Upgrading Oracle Key Vault?

Glossary

Index

List of Examples

- 8-1 Setting an Encryption Key

- 8-2 Listing Security Objects for the Current Endpoint

- 8-3 Listing the Contents of an Oracle Wallet File

- 8-4 Uploading a Java Keystore Using the -v 2 Option

- 8-5 Uploading a Password-Protected Wallet File

- 8-6 Downloading a Virtual Wallet to a Java Keystore

- 8-7 Changing an Oracle Key Vault Endpoint Password

List of Figures

- 1-1 How Oracle Key Vault Manages Keys, Secrets, and Wallets for Endpoints

- 2-1 Centralized Storage of Oracle Wallet Files and Java Keystores

- 2-2 Centralized Management of a TDE Direct Connection of TDE Master Keys

- 2-3 Backing Up Credential Files

- 2-4 Sharing from Endpoint to Wallet

- 2-5 Oracle Key Vault Deployment Architecture

- 10-1 Oracle Key Vault Audit Trail Reports Page

- 10-2 Oracle Key Vault Management Reports Page

- 10-3 Alerts and Managed Content Panes

- 10-4 Data Interval, Operations, Endpoint Activity, and User Activity Panes

- 10-5 Settings Page for Oracle Key Vault Configurations

List of Tables

- 3-1 Ports Required for Oracle Key Vault

Preface

Welcome to Oracle Key Vault Administrator's Guide. This guide explains how to install, configure, and use Oracle Key Vault.

This preface contains:

- Audience

- Documentation Accessibility

- Related Documents

- Conventions

Audience

This document explains how to install and configure Oracle Key Vault. In addition, it explains how to perform operations such as:

- Managing security object attributes and their associated lifecycle policies

- Enrolling and managing Oracle Key Vault endpoints, which can be databases, middleware, and other data sources that contain security objects that Oracle Key Vault can manage

- Managing alert policies

- Administering the Oracle Key Vault server, including configuring high availability and backup operations

- Creating administrative users, setting password policies, and resetting passwords

- Reviewing and managing audit logs

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

Related Documents

For more information, see these Oracle resources:

- Oracle Database Advanced Security Guide

- Oracle Database Security Guide

- Oracle Database Administrator's Guide

- Oracle Data Guard Concepts and Administration

- Oracle Real Application Clusters Administration and Deployment Guide

To download free release notes, installation documentation, white papers, or other collateral, visit the Oracle Technology Network (OTN). You must register online before using OTN; registration is free and can be done at

http://www.oracle.com/technetwork/index.html

If you already have a user name and password for OTN, then you can go directly to the documentation section of the OTN website at

http://www.oracle.com/technetwork/documentation/index.html

Conventions

The following text conventions are used in this document:

Convention

Meaning

boldface

Boldface type indicates graphical user interface elements associated with an action, or terms defined in text or the glossary.

italic

Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values.

monospace

Monospace type indicates commands within a paragraph, URLs, code in examples, text that appears on the screen, or text that you enter.

Changes in This Release for Oracle Key Vault Administrator's Guide

This preface contains:

- Changes in Oracle Key Vault Release 1 (12.1)

Changes in Oracle Key Vault Release 1 (12.1)

The following are changes in Oracle Key Vault Administrator's Guide for Oracle Key Vault Release 1 (12.1).

- New Features

New Features

The following feature is new in this release:

- okvutil changepwd Command
The okvutil changepwd command enables you to change the Oracle Key Vault endpoint password. Use this command if you chose to use a password-protected wallet to store the Oracle Key Vault endpoint user credentials.

See Also:
"okvutil changepwd Command"

1 Introduction to Oracle Key Vault

Before you begin to use Oracle Key Vault, you should understand its purpose, benefits, user audience, major features, interfaces, and general steps for using Key Vault.

Topics:

- About Oracle Key Vault and Key Management

- Benefits of Using Oracle Key Vault

- Who Should Use Oracle Key Vault?

- Major Features of Oracle Key Vault

- Oracle Key Vault Interfaces

- Outline of Steps for Using Oracle Key Vault

About Oracle Key Vault and Key Management

Oracle Key Vault enables you to quickly deploy encryption and other security solutions by centrally managing encryption keys, Oracle wallets, Java keystores (JKS), Java Cryptography Extension keystores (JCEKS), and credential files.

Oracle Key Vault is optimized for managing Oracle Advanced Security Transparent Data Encryption (TDE) master keys. The full-stack, security-hardened Oracle Key Vault software appliance uses Oracle Linux and Oracle Database technology for security, availability, and scalability. This centralized approach addresses challenges that are caused by the increased use of keys, wallets, and keystores, and prevents their accidental loss, while enabling long-term retention and restoration of encrypted data.

In addition to supporting Oracle database and application servers, Oracle Key Vault follows the industry standard OASIS Key Management Interoperability Protocol (KMIP) for compatibility with KMIP-based clients.

See Also:

- "Support for OASIS Key Management Interoperability Protocol (KMIP)"

- Oracle Database Advanced Security Guide for a complete discussion of Transparent Data Encryption (TDE)

Benefits of Using Oracle Key Vault

Oracle Key Vault addresses the rising need to use encryption in data centers by providing a secure key management platform that quickly and efficiently deploys encryption across your enterprise.

Oracle Key Vault provides the following benefits:

- A centralized platform to securely store and manage encryption keys, credential files, Oracle wallets, and Java keystores. This centralized platform enables you to achieve the following:

- Manage the key lifecycle, including creation, rotation, and removal, for all endpoints. This includes the ability to share access to security objects among multiple endpoints. Endpoints can be databases, middleware, and other data sources that contain the keys that you want to manage with Oracle Key Vault.

- Prevent the loss of keys and wallets due to forgotten passwords or accidentally deleted wallets and keystores.

- Easy enrollment and provisioning of endpoints, that is; configuring the connections between Oracle Key Vault and endpoints. Endpoint provisioning uses a single package that contains all the necessary software binaries and configuration files as well as the endpoint certificates needed for mutually authenticated connections with Oracle Key Vault.

- The ability to work with other Oracle products: in addition to TDE, Oracle Key Vault works with Oracle Real Application Clusters (Oracle RAC), Oracle Active Data Guard, and Oracle GoldenGate. Oracle Key Vault facilitates the movement of encrypted data using Oracle Data Pump and the transportable tablespaces feature of Oracle Database.

Figure 1-1 illustrates the Oracle Key Vault environment.

Figure 1-1 How Oracle Key Vault Manages Keys, Secrets, and Wallets for Endpoints

In Figure 1-1, Oracle Key Vault, in the center, stores and manages the security objects and backup devices. It works with the following components:

- Transparent Data Encryption refers to Oracle databases that have tables and tablespaces configured to use TDE.

- Other Keystore Files can be JCEKS keystores that you upload to Oracle Key Vault from endpoints or download from Key Vault to endpoints.

- Management Console refers to the Oracle Key Vault graphical user interface, in which you log in to manage objects that you upload to Key Vault.

- Appliance Backup refers to a backup device for Oracle Key Vault data, which you configure for a high availability environment.

- Oracle Wallets and Java Keystores refers to the wallets and keystores that you upload to Oracle Key Vault and download to endpoints.

Who Should Use Oracle Key Vault?

Users who are responsible for managing security objects should use Oracle Key Vault.

These users can be database administrators, IT personnel, system administrators, security administrators, and any information security personnel who are responsible for database servers, application servers, operating systems, and other systems that manage Oracle wallets, encryption keys, Java keystores, credential files, and certificates.

Other users can include personnel responsible for Oracle databases and servers that interact with Oracle databases, because Oracle Key Vault provides inherently tighter integration. These systems may have a need to simplify encryption key and wallet management.

Although Oracle Key Vault is designed for easy integration with Oracle Advanced Security TDE, it is compatible with endpoints that support OASIS KMIP.

Major Features of Oracle Key Vault

Oracle Key Vault provides a number of features designed to enhance the security of key management, such as centralized management of keys, wallets, keystores, and credential files.

Topics:

- Centralization of TDE Master Keys, Oracle Wallets, Java Keystores, and Credential Files

- Management of Key Lifecyle

- Reporting and Alerts

- Separation of Duties for Oracle Key Vault Users

- Support for a High Availability Environment

- Backup and Restore Functionality for Security Objects

- Compatibility and Deployment Support

- Support for OASIS Key Management Interoperability Protocol (KMIP)

Centralization of TDE Master Keys, Oracle Wallets, Java Keystores, and Credential Files

Oracle Key Vault centralizes keys in a modern, secure, and robust key management platform. This enables you to secure, share, and manage the keys all in one place.

You can centrally manage the following types of security objects:

- TDE master keys
For Oracle databases that use Transparent Data Encryption (TDE), Oracle Key Vault manages TDE master keys over a direct network connection as an alternative to using local wallet files. The keys stored in Oracle Key Vault can be shared across databases according to endpoint access control settings. This method of sharing keys without local wallet copies is useful when TDE is running on database clusters such as Oracle RAC, Oracle Active Data Guard, or Oracle GoldenGate. You can easily migrate master keys that are used for existing encrypted data in Oracle databases from Oracle wallets to Oracle Key Vault. Oracle Key Vault supports direct connections between TDE and Oracle Key Vault for Oracle Database 11g Release 2 and Oracle Database 12c.

- Oracle wallets and Java keystores
Oracle wallets and Java keystores are often widely distributed across servers and server clusters, with backup and distribution of these files performed manually. Oracle Key Vault itemizes and stores contents of these files in a master repository yet allows server endpoints to continue operating while disconnected from Oracle Key Vault using their local copies. After you have archived wallets and keystores, you can recover them to their servers if their local copies are mistakenly deleted or their passwords are forgotten. Oracle Key Vault streamlines the sharing of wallets across database clusters such as Oracle RAC, Oracle Active Data Guard, and Oracle GoldenGate. Sharing of wallets also facilitates the movement of encrypted data using Oracle Data Pump and the transportable tablespaces feature of Oracle Database. You can use Oracle Key Vault with Oracle wallets from all supported releases of Oracle middleware products and Oracle Database.

- Backup of credential files
Credential files that contain Secure Shell (SSH) keys, Kerberos keytabs, and similar keys are often widely distributed without appropriate protective mechanisms. Oracle Key Vault backs up credential files for long-term retention and recovery. Oracle Key Vault easily recovers these files when you need them, audits access to them, and shares them across trusted server endpoints.

Management of Key Lifecyle

The management of the key lifecycle entails activities such as reminding users to rotate passwords.

Most systems that create keys and passwords, including TDE, do not have a mechanism to remind customers of the key rotation requirements for staying in compliance, but Oracle Key Vault provides one. Oracle Key Vault enables you to create policies that track the lifecycle of keys (their creation, rotation, and expiration) and raise alerts when keys or passwords approach the end of their useful lives. You can use Oracle Key Vault reports to ensure that the keys have not expired (that is, that the keys are being rotated on a proper schedule).

Lifecycle tracking is very important because standards such as the Payment Card Industry Data Security Standard (PCI DSS) have specific requirements for the maximum lifetime of encryption keys and passwords.

Reporting and Alerts

Oracle Key Vault provides report and alert capabilities.

- Report capabilities
Oracle Key Vault provides both audit reports and management reports. Audit reports capture the actions that users perform and the results of those actions. Management reports capture information about wallet access, key deactivation or expiration, endpoint certificate expiration, and the user password expiration date.

See Also:
"About Oracle Key Vault Reports"

- Alert capabilities
You can configure alerts for key rotations, endpoint certificate expirations, user password expirations, disk space, system backups, and high availability events. You can choose to send alerts regarding the Oracle Key Vault server to syslog to allow for external monitoring.

See Also:
"Oracle Key Vault Alert Configuration"

Separation of Duties for Oracle Key Vault Users

For better security, Oracle Key Vault is designed to provide separation of duties for anyone who uses it.

Oracle Key Vault provides three roles for specific tasks: the Key Administrator role, the System Administrator role, and the Audit Manager role. The user who is responsible for uploading and downloading security objects between Oracle Key Vault and the endpoint is referred to as the endpoint administrator.

See Also:
"Overview of Administrative Roles"

Support for a High Availability Environment

To ensure that Oracle Key Vault can access security objects in the event of a failure, Oracle Key Vault can be configured for a high availability environment.

You can deploy two Oracle Key Vault appliances in a two-node cluster for a high availability configuration. The primary appliance services the requests that come from endpoints. If the primary appliance fails, then the standby appliance takes over after a preset delay. The preset delay prevents the standby appliance from taking over prematurely if there is a transient communication problem between the nodes.

Oracle Key Vault uses Oracle Data Guard to synchronize data between the primary and standby nodes in a high availability deployment.

See Also:
"Configuring High Availability for Oracle Key Vault"

Backup and Restore Functionality for Security Objects

Oracle Key Vault enables you to back up all security objects including keys, certificates, and passwords. It encrypts the backups.

Oracle Key Vault can securely store backups at a remote destination. This enables backups to be restored to a new appliance if the original appliance encounters a irrecoverable error. Therefore, Oracle Key Vault can restore the previous state that is represented in the backup to the same Oracle Key Vault appliance or to a new one if the originating appliance must be replaced due to a catastrophic failure.

Oracle Key Vault can transfer backup files to any remote location that implements the secure copy protocol (SCP).

Users who have been granted the System Administrator role can perform the following backup and restore tasks in Oracle Key Vault:

- Set up and modify remote backup locations. This task automatically transfers the encrypted backup media to a remote location on a preconfigured schedule.

- Set up, modify, or disable the current backup schedule.

- Initiate an immediate one-time backup.

- Schedule a future one-time backup.

Oracle Key Vault performs the backup in hot backup mode, which ensures that the system is not interrupted while the backup is being created.

See Also:
"Backing Up and Restoring Data for Oracle Key Vault"

Compatibility and Deployment Support

You should be aware of Oracle Key Vault compatibility with earlier releases and platforms on which the deployment is certified.

- Compatibility
Oracle Database 11g Release 2 and later can use Oracle Key Vault to store TDE master keys with no database patching required.

- Deployment
You can deploy Oracle Key Vault on Oracle Linux x86-64 systems. Oracle Key Vault works with endpoints that are on Oracle Linux and Oracle Solaris systems.

See Also:
"Oracle Key Vault Installation Requirements"

Support for OASIS Key Management Interoperability Protocol (KMIP)

OASIS Key Management Interoperability Protocol (KMIP) standardizes key management operations between key management servers and endpoints provided by different vendors.

Oracle Key Vault implements the following OASIS KMIP Version 1.1 profiles:

- Basic Discover Versions Server Profile: Provides the server version to endpoints.

- Basic Baseline Server KMIP Profile: Provides core functionality to retrieve objects from the server.

- Basic Secret Data Server KMIP Profile: Provides endpoints the ability to create, store, and retrieve secret data (typically passwords) on the server.

- Basic Symmetric Key Store and Server KMIP Profile: Provides endpoints the ability to store and retrieve symmetric encryption keys on the server.

- Basic Symmetric Key Foundry and Server KMIP Profile: Provides endpoints the ability to create new symmetric encryption keys on the server.

See Also:
http://docs.oasis-open.org/kmip/spec/v1.1/os/kmip-spec-v1.1-os.html for information about the OASIS KMIP specification

Oracle Key Vault Interfaces

Oracle Key Vault provides two interfaces: a management console and an endpoint command-line utility for uploading and retrieving security objects.

- Oracle Key Vault management console
The Oracle Key Vault management console, which is a browser-based graphical user interface, enables Oracle Key Vault administrators (depending on their role and access) to manage endpoints, wallets, users, and reports, and to configure high availability, backup, and recovery. The information that is viewable depends on the type of user (the role this user has or does not have) who is logged in.

- Oracle Key Vault okvutil endpoint utility
You use the okvutil command-line utility from an endpoint to upload and download security objects between Oracle Key Vault and endpoints. For example, you can upload an Oracle wallet from one endpoint to Oracle Key Vault, and then later on download this wallet to a different endpoint. The okvutil utility communicates with Oracle Key Vault over a mutually authenticated secure connection.

See Also:

- "Logging In to the Oracle Key Vault Management Console"

- "Oracle Key Vault okvutil Endpoint Utility Reference"

Outline of Steps for Using Oracle Key Vault

Oracle recommends that you follow a general set of steps for using Oracle Key Vault.

1. Read Chapter 2, "Oracle Key Vault Concepts," which covers conceptual information for using Oracle Key Vault.

2. Install and configure Oracle Key Vault.
You install Oracle Key Vault onto its own dedicated server. The configuration process entails creating or providing the user accounts, setting the IP address and recovery passphrase, and optionally, configuring the system time and Domain Name Service (DNS) setup.

See Chapter 3, "Oracle Key Vault Installation and Configuration," for more information.

3. (Optional) Configure a high availability environment for your Oracle Key Vault endpoints. An Oracle Key Vault user with the System Administrator role performs this task.

Note:
You must have a separate license for each Oracle Key Vault server installation in a high availability environment.

Oracle recommends that you deploy two Oracle Key Vault appliances, in primary and standby configurations, for a high availability environment.

See "Configuring High Availability for Oracle Key Vault" for more information.

4. Create users to manage the day-to-day tasks for Oracle Key Vault.
The installation process includes creating user accounts, but you may want to configure additional user accounts to handle Oracle Key Vault tasks, depending on the requirements of your site. The ability to manage specific security objects can be assigned to individual users as necessary.

See Chapter 5, "Managing Oracle Key Vault Users," for more information.

5. Add endpoints so that users can use Oracle Key Vault to store their security objects.
Endpoints are systems (such as Oracle databases) that use security objects for various cryptographic operations.

See Chapter 6, "Managing Oracle Key Vault Endpoints," for more information.

6. Manage the Oracle Key Vault virtual wallets.
Virtual wallets reside in Oracle Key Vault and are containers for security objects that you upload from endpoints.

See Chapter 7, "Managing Oracle Key Vault Virtual Wallets and Security Objects," for more information.

7. Enroll endpoints and then upload or download security objects between the endpoints and Oracle Key Vault.
In this step, you register the databases or other endpoints that contain the keys, credentials, and other secure data with Oracle Key Vault. Users who are responsible for the endpoint (endpoint administrators) upload and download security objects.

Chapter 8, "Using Oracle Key Vault Endpoints," describes how to enroll endpoints for more information.

8. Manage the endpoint data.
In this step, you upload and download data (Oracle wallets, Java keystores, credential files, and so on) between Oracle Key Vault and the endpoints.

See Chapter 9, "Oracle Key Vault Use Case Scenarios," for more information.

9. Perform periodic maintenance tasks.
Depending on the task, users who have the Key Administrator, System Administrator, or Audit Manager roles perform periodic maintenance tasks.

See Chapter 10, "General Oracle Key Vault Management," for more information.

2 Oracle Key Vault Concepts

Conceptual information for Oracle Key Vault covers use cases; how the access control configuration, deployment architectures, and administration works; and roles of the endpoint administrators.

Topics:

- Overview of Oracle Key Vault Concepts

- Oracle Key Vault Use Cases

- Access Control Configuration

- Oracle Key Vault Deployment Architecture

- Oracle Key Vault Administration

- Endpoint Administrators

Overview of Oracle Key Vault Concepts

Oracle Key Vault provides a secure, central repository for security objects, such as keys, certificates, passwords, and opaque objects. As an enterprise key management platform, Oracle Key Vault provides a central platform to manage these security objects and their lifecycle.

Oracle Key Vault keeps track of all the endpoints that you enroll with it. Endpoints are the database servers, application servers, and computer systems where actual cryptographic operations such as encryption or decryption are performed. Endpoints request Oracle Key Vault to store and retrieve security objects.

Endpoints must be registered and enrolled to communicate with Oracle Key Vault. Some endpoints, which can generate keys or already possess keys, use Oracle Key Vault as a secure, long-term external storage.

Oracle Key Vault access control facilities provide the flexibility to meet the needs of almost any organization.

Oracle Key Vault allows grouping of keys and other security objects to form a virtual wallet. The main purpose of a virtual wallet is to allow access to security objects by endpoints other than the endpoint that created the objects. Any user can create a new virtual wallet and then add keys to which they have access to that wallet. After you create the empty wallet, you can add any keys to which you have Read and Modify access, to any wallet where you have Manage Wallet access.

Note:
Some endpoints may already have Oracle wallet files. You can extract the security objects from the wallet files, upload them to Oracle Key Vault, and then add those objects to a virtual wallet.

In Oracle Key Vault, one security object may belong to multiple wallets. Every security object has an owner, which is the endpoint that created the security object. This owner has Read and Modify access to the security object, even if the security object is not included in any virtual wallet.

An endpoint might need to share these security objects with its trusted peers. For example, an Oracle Database Real Application Clusters (Oracle RAC) node might need to share keys with other nodes in the cluster.

During enrollment of an endpoint, you can specify a default wallet. Keys created or uploaded by the endpoint are automatically added to the default wallet.

Multiple endpoints can have a common default wallet. The contents of this default wallet are shared across all the endpoints without the need to specify an endpoint group for these endpoints. This enables endpoints to create keys or upload an Oracle wallet without specifying a virtual wallet to contain the keys.

Oracle Key Vault audits all actions performed by users and endpoints.

Oracle Key Vault Use Cases

Use cases for Oracle Key Vault include centralized storage and management.

Topics:

- Centralized Storage of Oracle Wallet Files and Java Keystores

- Centralizing Management for a TDE Direct Connection of TDE Master Keys

- Storage of Credential Files

Centralized Storage of Oracle Wallet Files and Java Keystores

Oracle Key Vault stores copies of Oracle wallet files and keystores in a centralized location for long-term retention and recovery.

Oracle Key Vault stores the security objects from Oracle wallets and Java keystores in a centralized location so they can be downloaded to a new wallet or keystore file when needed.

Without Oracle Key Vault, Oracle wallet files and Java keystores are often dispersed across servers and server clusters and require manual backup to prevent accidental loss of keys. Managing these dispersed objects poses operational as well as security challenges, which the Oracle Key Vault centralized storage platform can prevent.

Oracle Key Vault also enables sharing of Oracle wallet files and keystore files with trusted server peer endpoints. The endpoint software can read the format of Oracle wallet files and keystores and itemize each element of the Oracle wallet files or keystores, and perform a backup, element by element. You can upload both password-protected and auto-login wallets, and then download the wallet contents to a new wallet of either type.

See Also:
"About Uploading and Downloading Oracle Wallets"

Because the endpoint utility can interpret the contents of Oracle wallet files and keystores, users can manage the individual objects separately, including grouping them to share with other endpoints.

- Oracle wallet files
Oracle Key Vault stores and manages the content of Oracle wallet files: symmetric keys (TDE master keys) for encryption, passwords (Secure External Password Store), and X.509 certificates (network encryption).

- Java keystores
Oracle Key Vault stores and manages the content of Java keystores: symmetric keys, asymmetric keys such as private keys, and X.509 certificates.

Oracle wallet files from all supported releases of Oracle Database are supported. Oracle Key Vault supports both JKS and JCEKS types of Java keystores.

Figure 2-1 illustrates the centralized storage of Oracle wallet files and Java keystores.

Figure 2-1 Centralized Storage of Oracle Wallet Files and Java Keystores

See Also:

- "Uploading and Downloading Oracle Wallets"

- Oracle Database Advanced Security Guide for topics related to Oracle wallet files (but note that in Oracle Database 12c, TDE wallets are called keystores)

Centralizing Management for a TDE Direct Connection of TDE Master Keys

For Oracle databases using TDE, Oracle Key Vault provides centralized management of TDE master keys over a direct network connection as an alternative to copying local wallet files to multiple endpoints.

In this use case, TDE generates the master key and stores it in Oracle Key Vault.

Sharing TDE master keys rather than maintaining local wallet copies is especially useful when TDE is running on database clusters such as Oracle RAC, as the following comparison shows:

- With a local wallet copy, for each Oracle RAC node, when a key rotation operation is performed on the master key in the primary node, the local wallet copy is updated and must then be manually copied to other nodes in the Oracle RAC cluster to propagate the new TDE master key.

- With the shared TDE keys that Oracle Key Vault provides, a new TDE master key is immediately shared with other nodes in a cluster after a key rotation operation and does not require manual copying of the wallet.

Centralized management is also helpful when copying encrypted data between databases using Oracle Data Pump Export, Import, or the transportable tablespaces of Oracle Database if master keys are stored in the wallet:

- Without centralized management, the wallet must be manually copied from source to target databases.

- With centralized management, these master keys are easily shared through Oracle Key Vault by granting each endpoint access to a virtual wallet that contains the master keys.

Direct network connections between TDE and Oracle Key Vault are supported on Oracle Database 11g Release 2 and Oracle Database 12c.

Figure 2-2 illustrates the centralized management of a TDE direct connection of TDE master keys.

Figure 2-2 Centralized Management of a TDE Direct Connection of TDE Master Keys

See Also:

"Using a TDE Direct Connection with Oracle Key Vault"

Storage of Credential Files

Oracle Key Vault can back up credential files other than Oracle wallets and Java keystores for long-term retention and recovery.

Oracle Key Vault does not interpret the actual content of a credential file; it stores the entire file as an opaque object and provides a handle to the endpoint for retrieval at a later time.

A credential file can contain security objects such as keys, passwords, SSH keys, Kerberos keytabs, and X.509 certificates.

You can directly upload credentials into Oracle Key Vault, consolidating these files in a central repository and sharing them across endpoints in a trusted group. In addition, the files will be backed up and made highly available along with all the other security objects in Oracle Key Vault. Key Vault administrators can set up access control policies to share these credential files with other endpoints.

Previously, without Oracle Key Vault, credential files tended to be scattered in numerous servers in an organization.

Figure 2-3 illustrates how credential files are archived in Oracle Key Vault.

Figure 2-3 Backing Up Credential Files

See Also:
"Uploading and Downloading Credential Files"

Access Control Configuration

Oracle Key Vault uses virtual wallets to establish access control and share security objects.

A virtual wallet is a group of security objects that can be used to share access to the objects they contain.

Note:
Security objects stored in Oracle Key Vault can exist outside a wallet, but then they cannot be shared and are only accessible by the owner.

Access is granted to subjects (endpoints and administrative users). To make granting access easier, users and endpoints can belong to one or more groups, and access can be granted to a group instead of to each individual member of the group. Groups cannot contain other groups.

See Also:

- To grant access from virtual wallets to subjects:
"Granting User and Endpoint Access to Virtual Wallets"

- To set up access or membership from subjects to wallets:
"Oracle Key Vault User Details"

"Adding and Modifying User Group Details"

"Modifying Endpoint Group Details"

Access Control Options

A user, user group, endpoint, or endpoint group can have special access control options on virtual wallets.

These access control options are as follows:

- Read Only: The selected subject can read the attributes of the security object.

- Read and Modify: The selected subject can read and modify the attributes of the security object.

- Manage Wallet. The selected subject can do the following:

- Add or remove security objects from the wallet. The user must also have Read and Modify access on any object to be added to the virtual wallet.

- Grant others access to the wallet.

Access Grants

Oracle Key Vault uses two approaches to granting access to objects: direct grants to endpoints or users, or indirect grants through endpoint or user groups.

- Access to a virtual wallet is granted directly to subjects (endpoints or users).

- Access to a virtual wallet is provided indirectly, by group membership, to users or endpoints. If an endpoint group has access to a virtual wallet, then all the endpoints that are members of that endpoint group also have access to that wallet. This is a simpler alternative to granting access to each of the group members individually.

Anyone with the Manage Wallet access on a wallet can define access or membership relationships. See "Access Control Options".

Note:
The Oracle Key Vault management console enables you to set up access and membership bidirectionally. Although access is always granted by the subject to the virtual wallet, links enable you to go from a wallet to the subjects that access it or from a subject to the wallets it can access.

Figure 2-4 is taken from the Endpoint Details page but is similar to the details pages for the other subjects (endpoint groups, users, and user groups). The panels show the two different approaches.

The left panel shows groups that this individual endpoint belongs to. For a group, it would show endpoints that are members of the group.

The right panel shows all the wallets this endpoint or group can access, whether through direct grants to this endpoint or to one of the endpoint groups it belongs to.

Figure 2-4 Sharing from Endpoint to Wallet

Oracle Key Vault Deployment Architecture

Oracle Key Vault is deployed on a server, with connections to the endpoints that have the data to be protected.

Oracle Key Vault is packaged as a software appliance. It is hardened for security according to operating system and database hardening best practices. Unnecessary packages and software have been removed, and unused services and ports are disabled. It is preconfigured with an operating system, database, and the Oracle Key Vault application itself, so that you do not have to install and configure individual components.

Endpoints communicate with Oracle Key Vault over a mutually authenticated Transport Layer Security (TLS) connection using OASIS Key Management Interoperability Protocol (KMIP).

Administrators log in to the browser-based management console using a user ID and password.

The Oracle Key Vault high availability configuration defines one primary appliance and one standby appliance. The standby appliance operates in a passive mode, whereas the primary appliance is active. That is, all the endpoints communicate with the primary appliance only. Communication related to data replication between the primary and standby appliances is mutually authenticated TLS.

When primary appliance is unresponsive for a certain period of time, the standby appliance is automatically promoted as the primary appliance and becomes an active node for the cluster.

See Also:
"Configuring High Availability for Oracle Key Vault" for more details

Figure 2-5 illustrates the deployment architecture of Oracle Key Vault.

Figure 2-5 Oracle Key Vault Deployment Architecture

Oracle Key Vault Administration

Additionally, some users may not have a specific administrative role, but may be responsible for a specific area, such as a virtual wallet. They can perform actions on the virtual wallet (based on the privileges they have been granted). However, they cannot grant privileges to other users for their virtual wallet.

Topics:

- Separation of Duties

- Overview of Administrative Roles

- Emergency System Recovery Process

About the Administration of Oracle Key Vault

The Oracle Key Vault administrative roles are designed to be flexible enough to support various organizational structures.

Oracle Key Vault provides three separate roles, so that you can grant each user only the privileges needed for their area of responsibility. Oracle Key Vault does not require that the roles be granted to different users because some organizations may have individuals with multiple areas of responsibility.

Oracle Key Vault controls access and prevents privilege escalation by separating the various duties and functions performed by users and administrators, and ensuring that only those who should be using a function or operating on a specific object are able to do so.

Separation of Duties

Oracle Key Vault provides separation of duty in a fine-grained manner, to better secure objects.

The separation of duty works as follows:

- Access to one object or function can be granted independently of all others by a fine-grained division of access control and operational privileges. This enables you to match the responsibility of each user based.

- Three roles provide privileges specific to particular functional areas. These are the Key Administrator, System Administrator, and Auditing Manager roles described in "Overview of Administrative Roles".

You should ensure that every user who interacts with Oracle Key Vault has a unique user account and password.

Overview of Administrative Roles

Administrative roles are divided into key, system, and audit management functions.

The corresponding roles, Key Administrator, System Administrator, and Audit Manager, can only be granted by users who have those roles. One user can be granted multiple roles, if desired.

In some situations, a user with one administrative role must perform one part of the operation and a user with a different role performs a different but related part of the operation: for example, only System Administrators can enroll endpoints and only Key Administrators can create endpoint groups.

During the post-install configuration process, each role is initially granted to a user. If the situation arises where there is no user with a particular role, then you can use the recovery passphrase to repeat the post-install configuration and grant each role to a new or existing user account as described in "Emergency System Recovery Process".

When you use the management console, your access to the various tabs, menus, and actions described "General Oracle Key Vault Management" depends on your role and the objects that you have access to.

The administrative roles are:

- System Administrator
The System Administrator manages the Oracle Key Vault server:

- Creates, modifies, and deletes users

- Enrolls endpoints and deletes them

- Sets up high availability

- Configures alerts and key rotation reminders

- Schedules backups

- Starts and stops Oracle Key Vault

- Grants the System Administrator role to other users

- Key Administrator
The Key Administrator controls access to security objects and virtual wallets:

- Controls user and endpoint access to virtual wallets

- Creates and manages user groups

- Creates and alters endpoint groups

- Has Read, Modify, and Manage Access on all virtual wallets and security objects

- Grants the Key Administrator role to other users

- Audit Manager
The Audit Manager manages the collection of audit data that records the actions of users and endpoints:

- Manages the audit trail as the only user who has privileges to export or delete Oracle Key Vault audit records

- Has Read access on all security objects

- Grants the Audit Manager role to other users

Dashboards in the management console provide a quick look at the current Oracle Key Vault status and open issues that require attention.

Emergency System Recovery Process

Oracle Key Vault uses a special recovery passphrase to recover from emergency situations where there is no user who can access one of the three administrative roles (perhaps due to a forgotten password).

Knowledge of the recovery passphrase allows you to repeat the post-install process where administrative roles are assigned to new or existing user accounts.

The recovery passphrase is also required to restore Oracle Key Vault from a previous backup.

Note the following:

- Setting or changing a recovery passphrase

- To create or change a recovery passphrase, see "Task 2: Perform Postinstallation Tasks".

- To use the recovery passphrase in an emergency "System Recovery".

- Performing system recovery
If there is no user who can access one of the administrative roles, you can use the System Recovery process to assign the administrative roles to new or existing user accounts. See "System Recovery".

- Maintaining the correct recovery passphrase with a backup
It is important to have the correct passphrase if you need to restore a backup. See "Backing Up and Restoring Data for Oracle Key Vault".

Endpoint Administrators

Endpoint administrators are administrators of the respective endpoints, such as Oracle databases or Oracle application servers.

For Oracle database endpoints, the endpoint administrator is the database administrator who is responsible for managing the database. Endpoint administrators perform operations such as archiving and downloading credential files, wallet files, and Java keystores.

Although the endpoint administrator does not have Oracle Key Vault access by default, the same user could have a Key Vault user account.

Any endpoint administrator can use the okvutil utility.

3 Oracle Key Vault Installation and Configuration

You should understand the system requirements, how to install Oracle Key Vault, and how to perform postinstallation tasks. You should also understand how to access the Oracle Key Vault management console after you complete the installation process.

Topics:

- Oracle Key Vault Installation Requirements

- Installing Oracle Key Vault

- Overview of the Management Console

- Logging In to the Oracle Key Vault Management Console

- Performing Actions and Searches

Oracle Key Vault Installation Requirements

Oracle Key Vault is a software appliance whose installation requirements cover system requirements, network ports, supported endpoint platforms, and endpoint database requirements.

Topics:

- Oracle Key Vault: A Software Appliance

- System Requirements

- Network Ports

- Supported Endpoint Platforms

- Endpoint Database Requirements

Oracle Key Vault: A Software Appliance

Oracle Key Vault is packaged as a software appliance and delivered as an ISO package, which must be installed onto its own dedicated server.

This software appliance consists of a preconfigured operating system, an Oracle database, and the Oracle Key Vault application.

See Also:
"Oracle Key Vault Deployment Architecture"

System Requirements

Because it is a software appliance, remember that when you install Oracle Key Vault, the installation removes any existing software on a server.

Deployment on virtual machines is not recommended for production systems. However, you can use virtual machines for testing and proof of concept.

The hardware requirements for deploying the software appliance are:

- CPU: Minimum: 2 x86 cores, Recommended: 2+ cores with cryptographic acceleration support (Intel Westmere or later)

- Memory: Minimum 4 GB of RAM

- Disk: Minimum 500 GB hard disk

- Network interface: One network interface

- Compatibility: Compatible with Oracle Linux, Release 5 Update 10.
To find supported hardware, see the following hardware certification list for Oracle Linux and Oracle VM, for the system supported by 5.10: http://linux.oracle.com/pls/apex/f?p=117:1:470867609629060

Network Ports

Oracle Key Vault and endpoints use the a set of special ports for communication.

Network administrators must ensure that some or all these ports are not blocked by the firewalls.

Table 3-1 describes the ports that Oracle Key Vault requires.

Table 3-1 Ports Required for Oracle Key Vault

Port Number

Protocol

Descriptions

22

SSH/SCP Port

Used by Oracle Key Vault administrators and support personnel to remotely administer Oracle Key Vault.

See the description of the Network Services pane under "Settings for Configurations Page".

443

HTTPS Port

Used by web clients such as browsers to communicate with Oracle Key Vault.

1522

Database TCPS Listener Port

Listener Port

Used for communication between the Oracle Key Vault primary and standby appliances in high availability configurations.

5696

KMIP Port

Used by Oracle Key Vault endpoints and third party KMIP clients to communicate with the Oracle Key Vault KMIP Server.

See "Endpoint okvclient.ora Configuration File".

Supported Endpoint Platforms

The supported platforms for endpoints in this release are for Oracle Linux and Oracle Solaris.

The supported releases are as follows:

- Oracle Linux (5.x and 6.x)

- Oracle Solaris (10.x and 11.x)

Oracle supports both 32-bit and 64-bit Linux endpoints. However, only 64-bit endpoints are supported for Oracle databases that use TDE direct connections.

Endpoint Database Requirements

Depending on the release of Oracle Database that you plan to use for endpoints, you may need to set the COMPATIBLE initialization parameter.

You can create endpoints from Oracle Database 10g and later and use the okvutil upload command to upload Oracle wallets from these releases. Direct connections between TDE and Oracle Key Vault are supported on Oracle Database 11g Release 2 and later.

If you plan to use Oracle Key Vault with Oracle Database 11.2, then set the COMPATIBLE initialization parameter for 11.2.0.0 or higher. For example:

SQL> ALTER SYSTEM SET COMPATIBLE = 11.2.0.0 SCOPE=SPFILE;

This is applicable if an Oracle database endpoint is connected with Oracle Key Vault using a TDE direct connection, but this compatibility mode setting is not required for Oracle wallet upload or download operations.

Also, be aware that after setting the COMPATIBLE parameter for 11.2.0.0, you cannot set it to a lower value, such as 10.2. Ensure that you restart the database after setting this parameter.

See Also:
Oracle Database Administrator's Guide for more information about setting the COMPATIBLE parameter

Installing Oracle Key Vault

The Oracle Key Vault installation process entails first the installation of the Key Vault appliance, and second, postinstallation tasks.

Topics:

- Task 1: Install the Oracle Key Vault Appliance

- Task 2: Perform Postinstallation Tasks

Task 1: Install the Oracle Key Vault Appliance

The installation process installs all required software components onto a dedicated server. The installation process may take from 30 minutes to an hour to complete, depending on the server resources where you are installing Oracle Key Vault.

Caution:
This installation takes over the server completely and removes any existing data on the server.

1. Request a fixed IP address, network mask, and gateway address from your network administrator for the dedicated server. You will need this information for Step 9.

2. Ensure that this server meets the recommended requirements described in "Oracle Key Vault Installation Requirements".

3. Insert the installer disk for Oracle Key Vault in the disk drive and then restart the computer.
The system restarts from the disk, and the initial splash screen appears:

4. Type install, and then press the Enter key.
The installation proceeds. This step can take several minutes to complete. The next screen prompts for the installation passphrase, which you must create.

5. Enter the installation passphrase.

Make a note of this passphrase because it is used for authentication during the first login to the Oracle Key Vault management console.

The installation passphrase must have 8 or more characters and contain at least one of each of the following: an uppercase letter, lowercase letter, number, and punctuation character. The allowed punctuation characters are period (.), comma (,), underscore (_), plus sign (+), colon (:), and space.

Confirm the installation passphrase in the Confirmation screen.

The Oracle Key Vault installation proceeds if the installation passphrase in the confirmation screen matches the one entered previously. Otherwise, the confirmation screen prompts again for confirmation.

6. Press Enter to select OK.
The Select Management Interface screen appears.

7. Select the interface and select Select.

8. Press Enter to accept the defaults when the installer prompts for the MAC address of the management interface.
If more than one network interface is available, then select the interface that you want to serve as the management interface and to communicate with endpoints. Note that the management interface appears as the MAC address in the following screen.

Press Enter to select Select in the following screen.

The screen entitled ”Please enter management interface IP setting” appears next.

9. Enter the configuration information for the appliance that includes a fixed IP address, the network mask, and the gateway address.

Press Enter to select Reboot to complete installation.

10. Wait while the installer installs and configures the operating system, database, and Oracle Key Vault on the server to make it a self-contained hardened appliance.
This process will take several minutes, during which time the screen may turn off due to the screen saver. To see whether the installation has completed, press the Shift key to turn the screen back on. If the installation has completed successfully, the following screen appears.

Task 2: Perform Postinstallation Tasks

After you have installed the Oracle Key Vault appliance, you are ready to perform the postinstallation tasks, which include creating administrative user accounts, creating a recovery passphrase, and optionally, setting the time and DNS configuration.

1. Open a web browser.

2. Connect to the Oracle Key Vault appliance, using an HTTPS connection and the IP address provided in Step 9 under "Task 1: Install the Oracle Key Vault Appliance."
For example, to log in to an Oracle Key Vault server whose IP address is 192.0.2.254, enter:

https://192.0.2.254

Your browser may produce a warning saying that you are connecting to a website with an untrusted or self-signed security certificate. You can safely ignore this warning and proceed.

3. When the following screen appears, log in to the Oracle Key Vault appliance for the first time using the installation passphrase created in Step 5 under "Task 1: Install the Oracle Key Vault Appliance."

This screen only appears after you have just installed the Oracle Key Vault appliance. The next time that you log in to the appliance, the standard Oracle Key Vault login screen will appear.

4. When the one-time Post-Install Configuration page for Oracle Key Vault appears, enter the following information:

- Administrative role information (See "Overview of Administrative Roles").
Enter the user name, password, full name (optional), and email (optional) for the Key Administrator, System Administrator, and Audit Manager.

To fully support separation of duty requirements, you can create a different user account for each of these administrative roles. However, if one person performs multiple functions, you can assign two or more roles to the same user account.

Passwords must have 8 or more characters and contain at least one of each of the following: an uppercase letter, lowercase letter, number, and punctuation character. The allowed punctuation characters are period (.), comma (,), underscore (_), plus sign (+), colon (:), and space.

- Recovery passphrase

The recovery passphrase has the same minimum requirements as the passwords that you create for the administrative users. However, it is a good idea to make this passphrase longer and more complex, because it provides access to backups containing all of the data on Oracle Key Vault. Because the recovery passphrase is extremely powerful and infrequently used, it is important to establish a process to store it securely and make it available only in emergency situations.

The recovery passphrase can be used for these situations:

- When there are no administrators who are able to access the administrative roles (Key Administrator, System Administrator, Audit Manager). The recovery passphrase can be used to return to this screen to assign each administrative role to a new or existing user account.

- When the Oracle Key Vault server must be restored from a previous backup file. The recovery passphrase is required to restore from a backup file and must match the recovery passphrase used when the backup was performed.

5. Complete the advanced section of the page by supplying the root password and the support user password. If you restore an existing backup to this appliance, then the root and support password you set here will remain the same, but all other data and user passwords will revert to the values when the backup was performed. This is also true if this system is added as the standby node of an high availability cluster.
Time Setup and DNS Setup settings are optional at this stage and can be set up later by a user with the System Administrator role using the Oracle Key Vault management console. (These are available by selecting the System tab, and then Settings.)

6. Click Save.
When the configuration is successful, the Oracle Key Vault post-install configuration is complete, and the login page appears.

Overview of the Management Console

To perform most tasks in Oracle Key Vault, administrators and users use the Oracle Key Vault management console.

This wide range of tasks includes creating and managing endpoints, virtual wallets, security objects, users, and passwords, and setting up operations such as high availability and system backup.

The management console is a browser-based console that connects to the appliance using the https secure communication channel.

Logging In to the Oracle Key Vault Management Console

To use Oracle Key Vault, users can log in to the Oracle Key Vault management console.

1. Open a web browser.

2. Connect using an HTTPS connection and the IP address provided in Step 9 under "Task 1: Install the Oracle Key Vault Appliance."
For example, to log in to a server whose IP address is 192.0.2.254, enter:

https://192.0.2.254

The login screen appears.

3. Enter your user name and password.

4. Click the Login.

Performing Actions and Searches

Many of the tab and menu pages contain an Actions menu or Search bars that allow you to search and perform actions on lists and the results of searches.

Topics:

- Actions Menus

- Search Bars

Note:
Detailed help for the Actions menus and Search bars is provided in the Help selection of the Actions drop-down list.

Actions Menus

The actions available from an Actions drop-down menu can vary but typically include a set of standard menu items.

These items are as follows:

- Select Columns: Select which column should be displayed.

- Filter: Filter by column or row and a user-defined expression.

- Format: Choose formatting such as Sort, Control Break, Highlight, Compute, Aggregate, Chart, and Group By.

- Save Report: Save reports.

- Reset: Reset the report settings, removing any customizations.

- Help: Get information about these actions.

- Download: Download the result set in CSV or HTML.

Search Bars

Along with Actions menus, many tabs contain search bars.

This demonstration searches for endpoints, but the process is the same for other searches, except that the column headings are different.

Wildcard characters are not supported, but the search does match any letter or phrase that you enter. You can use the Filter menu item under Actions to further fine-tune the search.

To perform a search:

1. Enter a name or other identifier in the search field or (optionally) place your cursor on the magnifying icon in the Search bar to select one of the table headings (in this case, All Columns, Endpoint Name, Endpoint Type, Description, Platform, Status, Enrollment Token, and Alert) and then enter a search term.

2. Click Go.
A new endpoint list appears, displaying only those endpoints that meet the search criteria. A filter icon (looks like a funnel) indicates that a search has been performed and displays the search criteria.

3. You can select or deselect the filter icon to disable the search and enable the entire list to reappear.

4 High Availability, Backup and Restore Operations

After you compete the installation process, Oracle strongly recommends that you configure high availability before you begin to create endpoints. You should also configure Oracle Key Vault for automatic backups.

Topics:

- Configuring High Availability for Oracle Key Vault

- Backing Up and Restoring Data for Oracle Key Vault

Configuring High Availability for Oracle Key Vault

A high availability configurations provides many benefits for Oracle Key Vault. It is important to configure high availability as soon as possible.

Topics:

- About Configuring High Availability for Oracle Key Vault

- Configuring High Availability for Oracle Key Vault

- Switching Primary and Standby Nodes in a High Availability Cluster

- Restoring High Availability After a Failover

- Unconfiguring High Availability

About Configuring High Availability for Oracle Key Vault

Oracle recommends that you configure high availability to ensure continued access to your security objects if Oracle Key Vault fails.

If you plan to configure high availability, then do so before you begin to create endpoints. An endpoint only knows about the standby appliance if the standby was configured before the endpoint was enrolled.

For Oracle Key Vault high availability, you must set up two Oracle Key Vault appliances, which are called peers. At any given time, one appliance is primary and the other is standby (also called the secondary). The primary appliance is the one that services requests from endpoints. The standby appliance takes over as the primary if the primary fails for any reason. The configuration process involves connecting to the primary appliance and providing it with the IP address and certificate of the standby, and then going to the standby appliance and doing the same thing for the primary.

Additionally, you can switch primary and standby nodes and unconfigure high availability entirely.

Configuring High Availability for Oracle Key Vault

The configuration process requires accessing two appliances separately (as a user who has been granted the System Administrator role) and copying the certificate. You should use two separate browsers to allow for copying and pasting from one appliance to another.

1. Acquire the IP address and certificate for both of the appliances involved as follows:
Log in to the Oracle Key Vault management console as a user who has the System Administrator role.

See "Logging In to the Oracle Key Vault Management Console."

To find the IP address of the server, select the System tab, click Settings, and find the IP address under Network.

To get the certificate of the server, select the System tab, then click High Availability, and copy the Current system Certificate.

2. Go to the Oracle Key Vault management console for the standby appliance.

3. From this appliance, select the System tab.

4. Click the High Availability menu.

5. Enter the IP address of the primary server in the Peer system IP Address field.

6. Paste the certificate of the primary server in a Peer system Certificate.

7. Click Save.
This stores the settings. Nothing else needs to be done on the standby appliance. You can log out or close the browser. The following steps only affect the primary appliance.

8. Log in to the Oracle Key Vault management console for the primary appliance.

9. Select the System tab.

10. Click the High Availability menu.

11. Select the Configure this system as the Primary server check box.

12. Change the Failover Timeout (mins) from the default of 10 minutes, if you want. Failover timeout is the time from when the primary fails to when the standby takes over. This delay prevents a failover in a brief network outage.

13. In the Peer system IP Address field, enter the IP address of the standby server as a peer system.

14. In the Peer system Certificate field, paste in the certificate of the standby server as a Peer system.

15. Click Save.

16. Click Activate.

A message appears, indicating that the High Availability configuration setup has been initiated and the system will reboot in a few minutes.

This process takes several minutes to complete.

The High Availability Status page appears, indicating that high availability is now enabled and providing buttons to Unconfigure and Switchover operations.

Switching Primary and Standby Nodes in a High Availability Cluster

If high availability has been configured, then you can perform a complete switchover to change the current primary node to the standby and make the current standby node the new primary node. This is useful during updates or patches to software or appliances.

1. Log in to the Oracle Key Vault management console for the primary node as a user who has been granted the System Administrator role.

2. Select the System tab and select High Availability for the primary node. Then click the Switchover button.
On success, this message appears: Switchover initiated successfully. Please wait while the system reboots.

Both the primary node and the standby node are restarted.

After the restart, the high availability status looks as it did after activation in Step 16 in "Configuring High Availability for Oracle Key Vault", but the primary is now the standby and conversely, the standby is now the primary.

Restoring High Availability After a Failover

If the primary node fails, then the cluster automatically fails over to the standby node after the configured failover timeout, and the standby node becomes a standalone appliance.

1. Replace the failed node with a newly installed Oracle Key Vault appliance. Be sure to use the original IP address for the failed node.
See "Installing Oracle Key Vault".

2. Log on to the original standby node (now a standalone appliance) and follow the steps to configure high availability, making sure to designate the appliance as the primary server.
See "Configuring High Availability for Oracle Key Vault".

3. After successfully configuring high availability, perform a switchover to restore the cluster to its original configuration before the failover.
See "Switching Primary and Standby Nodes in a High Availability Cluster".

Unconfiguring High Availability

You can unconfigure a high availability setup in the browser for the primary node. This removes the high availability setup and makes the primary node a standalone node again.

You must reinstall Oracle Key Vault on the standby node to use it again.

1. Log in to the Oracle Key Vault management console for the primary node as a user who has been granted the System Administrator role.

2. Select the System tab and select High Availability for the primary node. Then click Unconfigure.
On success, this message appears: Unconfiguration of High Availability initiated successfully. Please wait while the system restarts.

When you log in to Oracle Key Vault after it restarts, the high availability page looks the way it did before the high availability configuration.

Backing Up and Restoring Data for Oracle Key Vault

You can back up and restore data for Oracle Key Vault, including scheduling backup operations.

Topics:

- About Backing Up and Restoring Data for Oracle Key Vault

- Oracle Key Vault Backup Destinations

- Scheduling Backup Operations for Oracle Key Vault

- Restoring Oracle Key Vault Data

About Backing Up and Restoring Data for Oracle Key Vault

Users who have the System Administrator role can back up Oracle Key Vault and then restore it on the same appliance or another installed appliance.

These backups can help restore data lost due to natural or man-made disaster, accidental deletion or data corruption, or simply to restore the system state to an earlier time. Backups are stored off the appliance on an external server, or locally on the Oracle Key Vault appliance.

Oracle Key Vault should be backed up at regular intervals to ensure that the backup holds the most recent data. Oracle Key Vault encrypts all data backed up in the backup file.

To perform the backup, ensure that the backup destination supports the secure copy protocol (SCP).

Oracle Key Vault Backup Destinations

You can create, edit, and delete backup destinations for Oracle Key Vault.

Topics:

- About Oracle Key Vault Backup Destinations

- Creating Oracle Key Vault Remote Backup Destinations

- Editing Oracle Key Vault Remote Backup Destinations

- Deleting Oracle Key Vault Remote Backup Destinations

About Oracle Key Vault Backup Destinations

Backup destinations are locations where Oracle Key Vault backup files are stored. Backup files are often stored in a remote backup destination to safeguard against any catastrophic failure of the Oracle Key Vault appliance.

You must create backup destinations before you can schedule Oracle Key Vault backups. You can have many backups for each backup destination.

A backup destination can be either external (remote) or local:

- Remote Backup Destinations
Remote backup destinations are locations on external servers for remote backups. These destinations can be different geographical locations for disaster recovery purposes.

The Backup Destination name signifies the external server and the directory location on the server. After the directory location is specified, it cannot be modified for a given backup destination. To create a remote backup destination, you must provide a user account, a unique existing directory location on an external server, and an authentication method. Oracle Key Vault needs the information about the user account and authentication method to make a secure connection with the remote server for copying the backup file.

Each backup destination and corresponding directory on the external server is associated with a backup catalog file. Oracle Key Vault maintains the backup catalog file, okvbackup.mgr, at the backup location. The backup catalog file maintains a catalog of the backups performed and is used during restore operations.

Caution:

- Do not delete or modify the catalog file or you will not be able to find the backups to restore from them later.

- Do not configure the same destination directory on the external server for different backup destinations. Backups scheduled to these backup destinations will overwrite each other's catalog file, preventing Oracle Key Vault from recognizing the backups correctly.

Backups on remote destinations can be used to recover a system from data loss.

- LOCAL Backup Destinations
Oracle Key Vault provides a special backup destination, LOCAL, which is present out of the box and cannot be deleted.

Backups to LOCAL are stored on the Oracle Key Vault appliance itself and therefore are not available after a failover or switchover. However, they can be used to restore the system state to what it was at the time of the backup.

LOCAL destinations can store only the most recent one-time backup and for periodic backups, only the most recent full backup and subsequent cumulative incremental backups. The previous one-time backup is overwritten by the most recent one-time full backup, and the previous periodic backups are overwritten by the most recent periodic full backup.

See "Types of Oracle Key Vault Backups" for more information about periodic and one-time backups.

Note:
The Oracle Key Vault appliance itself cannot be used as the remote backup destination.

Creating Oracle Key Vault Remote Backup Destinations

You can create a remote backup destination for Oracle Key Vault data.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the System tab, and then click the System Backup menu.

The System Backup page contains a table listing any currently scheduled backups and another table listing the last 10 completed backups, if any.

3. Click Manage Backup Destinations.
The Manage Backup Destinations page contains a table that shows the local backup destination (LOCAL) provided with the Oracle Key Vault appliance, and any previously created remote destinations.

4. Select Create to create a new remote backup destination, which will appear in the table.

5. When the Create Backup Destination page appears, provide the following information for the backup location.

Caution:
The Username, Hostname and Destination Path for remote backup destinations should not have a space, single or double quotes in them.

- Destination Name: Oracle Key Vault name for the remote backup destination where the backup is stored.

- Transfer Method: Automatically populated with SCP, which is the protocol for copying backup files over SSH.

- Hostname: External server that stores the backup. Can be the host name (if DNS is configured) or IP address. Do not use another Oracle Key Vault appliance to store any backups for Oracle Key Vault.

- Port: Port number running SCP on the external server. The default is 22.

- Destination Path: The existing path to the directory on the external server that stores the backup. This path should not be the destination for backups from another Oracle Key Vault appliance.

- Username: The username of a user account that has write permission on the directory that is mentioned in the Destination Path field.

- Authentication Method: Choose one of the following:

- Password Authentication
The password of the user account entered in the Username field.

Note:
The password of the user account used for backup destination should be strong, unique, and unrelated to other accounts of the user.

- Key-based Authentication
Copy the public key that appears and paste it in the appropriate configuration file, such as authorized_keys, on the destination server.

6. Click Save.
A dialog box appears indicating that the backup destination was created successfully.

Oracle Key Vault validates the input supplied to create the backup destination successfully. If this fails, then check for correct input parameters such as hostname, username, password, and directory or destination paths.

Editing Oracle Key Vault Remote Backup Destinations

You can edit Oracle Key Vault remote backup destinations.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the System tab, and then click System Backup as shown in "Creating Oracle Key Vault Remote Backup Destinations", Step 2.

3. Select Manage Backup Destinations.
The Manage Backup Destinations page contains a table showing any LOCAL and remote destinations as in Step 3 of "Deleting Oracle Key Vault Remote Backup Destinations".

4. Click the backup destination name to edit it.

5. When the Edit Backup Destination page appears, you can edit the following information for the backup location:

- Port: Port number running SCP on the external server: (Default 22).

- Username: The username of a user account on the external server. It is used to copy the backup data to the remote system using SCP.

- Authentication Method: Choose one of the following:

- Password Authentication
The password of the user account entered in the Username field.

- Key-based Authentication
Copy the public key that appears and paste it in the appropriate configuration file, such as authorized_keys, on the destination server.

6. Click Save.
A dialog box appears, indicating that the backup destination was edited successfully.

Oracle Key Vault validates the input supplied to the edited backup destination successfully. If this validation fails, then check for and pass correct input parameters such as username and password.

Deleting Oracle Key Vault Remote Backup Destinations

Deleting the backup destination in the Oracle Key Vault management console does not delete the backup files that are stored in the specified location.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the System tab, and then click System Backup as shown in Step 2 "Creating Oracle Key Vault Remote Backup Destinations".

3. Select Manage Backup Destinations.

The Manage Backup Destinations page contains a table showing any LOCAL and remote destinations.

4. Select the check box for one or more backup destinations.

5. Click Delete to delete the scheduled backups.

Note:
You cannot delete the LOCAL backup destination.

Scheduling Backup Operations for Oracle Key Vault

You can schedule a backup for Oracle Key Vault to a specified destination and at a specified time. At the specified time, the backup processing starts and generates a system backup, which is a file that is stored on the destination. There is one backup file for each completed backup.

Topics:

- About Scheduling Oracle Key Vault Backups

- Scheduling Oracle Key Vault Backups

- Editing Oracle Key Vault Scheduled Backups

- Deleting Oracle Key Vault Scheduled Backups

- How Other Processes Affect the Oracle Key Vault Backup Process

- Protecting the Backup Using the Recovery Passphrase

About Scheduling Oracle Key Vault Backups

Oracle Key Vault provides different states for and types of scheduled backups.

Topics:

- Oracle Key Vault Backup Process

- Oracle Key Vault Schedule State

- Types of Oracle Key Vault Backups

Oracle Key Vault Backup Process

The scheduled backup is in the active state after it has been created.

See "Oracle Key Vault Schedule State", for further information about backup schedule states. You can edit the start time of the scheduled backup or the period of the periodic backup, if the backup is in the active or paused state. You can schedule a backup to start immediately or at a specific start time in the future.

The processing for the scheduled backup begins at the start time if it is in active and not paused state, whereupon it is put into the ongoing state. During processing, a backup file for the Oracle Key Vault system is created and transported to the backup destination. After the processing completes, the scheduled backup is either completed (DONE) or put back into the active state, depending on its type. See "Types of Oracle Key Vault Backups" for further information.

All scheduled backups are serialized. If a backup is already in progress or is ongoing, then no backups can start unless the current ongoing backup completes. Oracle Key Vault operations can continue unhindered while the backup is in progress.

Note:
Ongoing backups are terminated on System Restart.

Oracle Key Vault Schedule State

The different stages of the scheduled backups are indicated by their status.

See "Creating Oracle Key Vault Remote Backup Destinations", Step 2, for a listing of these stages. The states are as follows:

- ACTIVE
The backup is scheduled and will be processed at the specified start time or at the next interval.

- PAUSED
The scheduled backup is paused and will not be processed even if the start time has passed. It will be processed when it is activated.

- ONGOING
The scheduled backup is in progress. Oracle Key Vault is generating a backup file for the Oracle Key Vault system and transporting it to the backup destination.

- DONE
Scheduled backup has completed.

You can control schedules by changing their state from active to paused and back. Put a scheduled backup in the paused state for these situations:

- When Oracle Key Vault communication with the remote destination is broken

- If the remote destination is down

- If you want to delay or defer backup processing

You can delete the scheduled backups that have not completed.

Types of Oracle Key Vault Backups

Oracle Key Vault enables you to schedule two types of backups (a one-time backup and a periodic backup).

The types of backups are as follows:

- One-time backup (full backup)
A one-time backup makes a full backup of the Oracle Key Vault system. More than one such one-time backup can be scheduled together.

One-time local backups should be taken before making a significant configuration change to the Oracle Key Vault.

LOCAL destinations can only store the last one-time backup. When a one-time backup to LOCAL completes, the previous backup is deleted.

- Periodic backups (full backup plus cumulative incremental backups)
The periodic backup process makes a backup at regular intervals at the specified frequency (period). The process first makes a full backup (one-time backup) of the Oracle Key Vault system and when this completes, puts it back in the active state. At the end of the subsequent periodic interval, a cumulative incremental backup starts. This cumulative incremental backup holds changes from the last full backup. Another full back is made after 7 days have passed since the last full backup.

For example, if the backup period is once a day, then every seventh one is a full backup. If the backup period is every 8 days, then all backups are full backups. If the backup period is 12 hours, then there are 13 cumulative backups before a full backup.

Periodic backups should be scheduled with a period of one day to minimize data loss.

A LOCAL destination can store only the last full backup and the cumulative incremental backups after that full backup. After a new full backup of the periodic backup to LOCAL completes, previous periodic full or cumulative incremental backups are deleted.

Cumulative incremental backups are faster than full backups. Only one periodic backup can be scheduled at any time.

Scheduling Oracle Key Vault Backups

You can schedule Oracle Key Vault backups from the Oracle Key Vault management console.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the System tab, and then select System Backup.

3. Click the Backup button.

4. In the Name field, enter a name for the backup.

5. Enter the Start Time, click the Calendar icon to select it, or click Now to start the backup immediately.

6. Select the Destination for the backup.

7. Select the Type: One-Time or Periodic.

The Backup page is the same for either one-time or periodic backups, except that the fields for days, hours, and minutes only appear for the periodic type.

8. Select Schedule.

Editing Oracle Key Vault Scheduled Backups

You can edit a scheduled backup for Oracle Key Vault.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the System tab, and then select System Backup.

3. Select the check box for the scheduled backup in the Scheduled Backup list.

4. Edit the Start Time or click the Calendar icon and select it in the Backup page.

5. Click Now to start the backup immediately.

6. Edit the period if this is a periodic backup.

7. Select Save to save the changes.

Deleting Oracle Key Vault Scheduled Backups

You can delete an Oracle Key Vault scheduled backup.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the System tab, and then select System Backup.

3. Select the check box for one or more scheduled backups in the Scheduled Backup(s) table as shown in Step 3 "Editing Oracle Key Vault Scheduled Backups".

4. Click Delete to delete the scheduled backups.

How Other Processes Affect the Oracle Key Vault Backup Process

You should be aware of how other features, such as high availability, are affected by the Oracle Key Vault backup process.

- High availability
When Oracle Key Vault is configured for high availability, the backup operation is performed on the primary system.

- Failover or switchover
Any backups in progress will terminate if there is a failover or a high availability switchover. Backups to LOCAL are private to the Oracle Key Vault appliance and therefore the local backup on the primary appliance is not available after a failover or switchover.

Backups scheduled with password authentication start as usual after the failover or switchover.

Remote backups using key-based authentication will need to update the public key on the destination to match the one shown on the new primary system.

See Also:
"Configuring High Availability for Oracle Key Vault"

Protecting the Backup Using the Recovery Passphrase

Oracle Key Vault uses the recovery passphrase to encrypt all user and system data at the time of backup. The recovery password is also used to decrypt the backup at the time of the restore operation.

To restore a backup, use the Oracle Key Vault recovery passphrase from the time when the backup was initiated. This is necessary even if the recovery passphrase was changed after the backup completed. Oracle recommends that you make a new backup every time the recovery passphrase is changed to ensure that there is always a copy of the backup that is protected by the most recent recovery passphrase.

See "Emergency System Recovery Process" for further information about the recovery passphrase and how it is used.

Restoring Oracle Key Vault Data

You can restore Oracle Key Vault data from a backup when there is a data loss.

Topics:

- About Restoring Oracle Key Vault Data

- Oracle Key Vault Restore Process

- Restoring Oracle Key Vault Data

- High Availability and the Restore Operation

- Changes Resulting from a System State Restore

About Restoring Oracle Key Vault Data

If the Oracle Key Vault appliance unexpectedly fails, then the data it previously stored can be restored into a new appliance from the remote backup destination of the original appliance.

Note that the restore process replaces all data on the new appliance except for the root and support user passwords.

For backups scheduled before the Oracle Key Vault appliance was corrupted or lost, the Oracle Key Vault restore operation will reinstate one of the completed backups from the available backup destinations, restoring everything except the root and support passwords.

Remote backups can be used to recover a system from data loss. In disaster recovery, Oracle Key Vault restores the backup onto an installed appliance from a remote destination. You cannot restore if a scheduled backup is in process on this appliance.

Note:
Oracle Key Vault backups should be restored on the system whose timestamp is later than the time of the backup being restored.

In disaster recovery, Oracle Key Vault restores the backup onto an installed appliance from a remote destination.

Oracle Key Vault Restore Process

The Oracle Key Vault restore process involves a setup phase, followed by the restore process.

- Setup of the Oracle Key Vault appliance in disaster recovery or if the current appliance is not usable:

- Install the Oracle Key Vault appliance.
See "Installing Oracle Key Vault".

- Set up the backup destinations.
You should set up the backup destination used for the completed backup that is to be restored. Use a remote backup destination as described in "Creating Oracle Key Vault Remote Backup Destinations".

- Restore the Oracle Key Vault appliance.
Determine a backup from remote or local destinations to use for the restore operation.

If the backup chosen is a cumulative incremental backup, then Oracle Key Vault determines the full backup from the catalog file and restores the full backup before restoring the incremental backup. The backup is protected by a key derived from the recovery passphrase, which you must supply during the restore process. The recovery passphrase was created in "Task 2: Perform Postinstallation Tasks".

Caution:
Restoring removes the current content of Oracle Key Vault and replaces it with the content of the backup. Any changes made since the last backup will be lost.
The maximum life of a backup is 1 year. Any backup older than a year cannot be restored.

Restoring Oracle Key Vault Data

You can restore the data from a backup of Oracle Key Vault.

During the restore process, Oracle Key Vault prompts for the recovery passphrase created at the time when the system was installed.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the System tab, and then select System Backup.

3. Click Restore.

4. In the Source field, from the drop-down list, select the source of the backup files to recover from.

5. View the list of available backups for the source, using the Search bar if needed.

6. Select the Restore option next to the backup you want to restore from.

7. Click Restore to initiate the restore or recovery process.
You are prompted for the recovery passphrase.

8. Provide the recovery passphrase and then click Restore to begin the restore operation.
The system will restore from the backup and then reboot.

High Availability and the Restore Operation

Two considerations apply when you must restore data to an Oracle Key Vault system that is configured for high availability.

These considerations are as follows:

- If the standby server has taken over after failure of the primary, then there is no need to restore data from a backup. Just configure a new standby server and it automatically synchronizes with the (new) primary.

- If you restore a backup on the primary node, then you must discard (or reinstall) the standby server and configure a new standby.

Changes Resulting from a System State Restore

Restoring an Oracle Key Vault appliance brings the system state back to the time when the backup was created.

Therefore, any users, objects, endpoints, groups, wallets, and so on, created or changed after the backup was made do not exist on the restored system: they have been replaced by those on the restored backup. For example, if a user's password was changed after the backup operation, then the user's password is restored to what it was at the time of the backup.

Note:
Restoring also changes the recovery passphrase to the one used for the backup.

You should change the user passwords, enroll the endpoints created after backup, and make other similar changes, if required. You should confirm that everything is configured correctly after restoring.

If you are not certain that you restored the correct completed backup, then you can restore a different one. To restore another completed backup, first configure the remote destination of this backup on the restored Oracle Key Vault itself and then start the restore process. You do not need to reinstall the Oracle Key Vault appliance.

When the appliance has been restored to an acceptable state, then you can continue to work with this appliance and to schedule subsequent backups to any of the previously configured remote destinations or new remote destinations.

See Also:
"Changing Oracle Key Vault User Passwords"

5 Managing Oracle Key Vault Users

This chapter contains the following topics:

- About Managing Oracle Key Vault Users

- Creating Oracle Key Vault Users

- Granting or Revoking Roles

- Viewing the Users List

- Oracle Key Vault User Details

- Managing Oracle Key Vault User Group Membership

- Oracle Key Vault Password Changes

- Deleting Oracle Key Vault Users

- Managing User Groups

About Managing Oracle Key Vault Users

You can create and delete Oracle Key Vault users, and grant and revoke administrative roles on users.

How you manage these users depends on whether the users have or do not have roles.

- Users who must have roles
The administrative roles required depend on the specific task or objects. User accounts are needed for individuals who will manage either security objects or Oracle Key Vault. Each individual should have his or her own account.

- Users who do not have roles
Not all users need to be granted roles. If you want to restrict a user to a specific area, such as the ability to modify a virtual wallet, then only grant that user access to the virtual wallet or a set of virtual wallets. Users who have no roles only have the privileges to which they have been granted, and they can grant these privileges to other users only if they have Manage Wallet access to the virtual wallet.

Creating Oracle Key Vault Users

A user with the System Administrator role can create user accounts in the Oracle Key Vault management console.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Users tab.

3. Select Manage Users.
If there are existing users, then the Users table appears listing them.

4. the Manage Users page, click Create.

5. Enter a user name and password.
Passwords must have 8 or more characters and contain at least one of each of the following: an uppercase letter, lowercase letter, number, and punctuation character. The allowed punctuation characters are period (.), comma (,), underscore (_), plus sign (+), colon (:), and space.

6. Add the user's full name and an email address, if desired.

7. Click Save.
The Users table reappears and now includes the new user. After a new user has been created, that user can be granted a role, but only by another user who has that same role. See "Granting or Revoking Roles" for more information.

Granting or Revoking Roles

Users can be granted Oracle Key Vault roles (or have the role revoked) only by users who already have the role. For example, if you want to grant a user the Audit Manager role, then you must have the Audit Manager role yourself.

1. Log in to the Oracle Key Vault management console as a user who has the role that the user is to be granted.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Users tab and then select Manage Users.
The Manage Users page appears.

3. In the User Name column, click the name of the user.
The User Details page appears.

4. Under Roles in User Details, select the appropriate check box for the Audit Manager, Key Administrator, or System Administrator role.

5. Optionally, add the user to any existing groups or grant the user access to any wallets and their contents.

6. Click Save.

Viewing the Users List

All users can view the Users List on the Manage Users page.

For each user, this page lists the user name with check marks that indicate what roles or combination of roles the user has: Key Administrator, System Administrator, Audit Manager, or none. Users have the ability to grant any role they have to other users.

See Also:
"Oracle Key Vault Administration"

To search for users:

1. Log in to the Oracle Key Vault management console.
See "Logging In to the Oracle Key Vault Management Console."

2. Select Manage Users.

3. Search as described in "Search Bars".

4. Select one of the Users table columns to search.

Oracle Key Vault User Details

After you have created user accounts, you can add user details to these accounts, such as role grants.

Topics:

- About User Details

- Adding and Modifying User Details

About User Details

On the User Details page, you can view information about the user, such as roles, full name, email, user's access to wallets, and user group membership.

The User Details page allows you to:

- Grant or revoke an administrative role that you currently have.

- Reset the password of another user, provided you have all of the administrative roles that the other user has. See also "Oracle Key Vault Password Changes".

Adding and Modifying User Details

You can view and manage the user details, such as the roles the user has or the virtual wallets that this user can access.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role:
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Users tab, which displays Manage Users.

3. On the Manage Users page, in the User Name column, click the user's name.
The User Details page appears.

4. Make any of these changes:

- Reset another user's password if you have all the roles that user has.

- Add or remove a user's role, using the check boxes, for a role that you have.

5. Click Save.

Managing Oracle Key Vault User Group Membership

You can add or remove user membership if you have the Key Administrator role.

Topics:

- Adding an Oracle Key Vault User to a Group

- Removing an Oracle Key Vault User from a Group

See Also:
"Creating a User Group"

Adding an Oracle Key Vault User to a Group

You can add an Oracle Key Vault user to a group.

1. Log in as a user who has the Key Administrator role.
Select the Users tab, and then select Manage Users. In the User Name column, click the user's name.

2. Click Add in the User Group Membership region.

3. Select the check box next to the group in the list that the user is being added to.

4. Click Save.
A dialog box appears, indicating that the user has been successfully added.

Removing an Oracle Key Vault User from a Group

You can remove an Oracle Key Vault user from a group:

1. Log in as a user who has the Key Administrator role.
Select the Users tab, and then select Manage Users. In the User Name column, click the user's name.

2. In the User Group Membership region, select the check box next to the group that the user is being removed from.

3. Click Remove.

4. When the confirmation dialog box asks if you are sure you want to delete the membership to the selected group, click OK.
A dialog box appears, indicating that the user has been successfully removed from the group.

Oracle Key Vault Password Changes

Depending on your permissions, you can modify user passwords.

Topics:

- Who Can Change Oracle Key Vault Passwords?

- Changing Oracle Key Vault User Passwords

Who Can Change Oracle Key Vault Passwords?

Any valid Oracle Key Vault user can change his or her own password.

You can reset another user's password only if you the same roles that the user has. For example, if you want to change the password of a user who has the Audit Manager role, then you also must have this role before you can change the password.

Consider the following users and roles:

User

System Admin

Key Admin

Audit Manager

OKV_ALL_JANE

Yes

Yes

Yes

OKV_SYS_KEYS_JOE

Yes

Yes

OKV_SYS_SEAN

Yes

OKV_KEYS_KATE

Yes

OKV_AUD_AUDREY

Yes

OKV_OLIVER

Suppose that user OKV_SYS_KEYS_JOE, who has the System Administrator and Key Administrator roles, logs in. If user OKV_SYS_KEYS_JOE wants to change the other users' passwords, then the following happens:

- OKV_AUD_AUDREY: Because OKV_SYS_KEYS_JOE does not have the Audit Manager role, which OKV_AUD_AUDREY has, OKV_SYS_KEYS_JOE cannot change OKV_AUD_AUDREY's password. When user OKV_SYS_KEYS_JOE selects the OKV_AUD_AUDREY user name link to access the user details, the Audit Manager check box has a check to indicate that OKV_AUD_AUDREY has the Audit Manager role. However, because user OKV_SYS_KEYS_JOE is logged in and does not have this role, the check box is grayed out. This prevents him from revoking the role from OKV_AUD_AUDREY.

- OKV_ALL_JANE: Because OKV_SYS_KEYS_JOE does not have Audit Manager role, as with the OKV_AUD_AUDREY user account, OKV_SYS_KEYS_JOE cannot change the OKV_ALL_JANE password, either. (Conversely, user OKV_ALL_JANE, who has all the roles the other users have, can change their passwords if she wants.)

- OKV_KEYS_KATE: User OKV_KEYS_KATE only has the Key Administrator role, which user OKV_SYS_KEYS_JOE also has. Therefore, OKV_SYS_KEYS_JOE can change the password for OKV_KEYS_KATE. When OKV_SYS_KEYS_JOE selects the OKV_KEYS_KATE name link to display the user details, the Reset Password button appears, enabling OKV_SYS_KEYS_JOE to change the password.

- OKV_OLIVER: User OKV_OLIVER has no roles at all, and therefore cannot change anyone else's passwords (or grant them roles). Only a user who has the System Administrator role (users OKV_ALL_JANE, OKV_SYS_KEYS_JOE, and OKV_SYS_SEAN) can change his password. See the description of users who do not have roles under "About Managing Oracle Key Vault Users" for more information.

Changing Oracle Key Vault User Passwords

You can change an Oracle Key Vault user password using either of two methods.

- To change your own password: Select the Users tab, then select Manage Users. Select Change Password. The Change Password page appears. After you modify your password, click Save.
Any user can change his or her password.

- To reset another user's password: Select the Users tab, and then select Manage Users. Ensure that you have all the same roles as the other user. Select the user name, and in the User Details region, select Reset Password. The Reset User Password page appears. After you modify the password, then select Save.
To reset a password for a user who has no roles, you must be the System Administrator.

Deleting Oracle Key Vault Users

Deleting Oracle Key Vault users removes them from any groups that they are have membership in.

To delete a user, you must have all the same administrative roles as that user, and you need the System Administrator role. If you do not have these roles, then you can have another user who does have those roles revoke the roles for the user in question. Then you can delete the user. See "Granting or Revoking Roles" for information about revoking roles from a user.

1. Log in to the Oracle Key Vault management console as a user who has the same roles as the user being deleted.

2. Select the Users tab and then select Manage Users.

3. Find the user and select the check box at the beginning of the row.

4. Click Delete.

5. In the confirmation dialog box, click OK.

6. Click Save.
A message appears, indicating that the user has been dropped.

Managing User Groups

Users who have been granted the Key Administrator role can view, create, and delete user groups, add members to groups, and add group access to virtual wallets.

Topics:

- Creating a User Group

- Adding and Modifying User Group Details

- Adding an Oracle Key Vault User to a Group

- Removing an Oracle Key Vault User from a Group

- Deleting an Oracle Key Vault User Group

Creating a User Group

You can create a named group of Oracle Key Vault users.

1. Log in as a user who has been granted the Key Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Users tab.

3. Select Manage Access.
The User Groups page appears.

4. Click Create User Group.
The Create User Group page appears.

5. On the Create User Group page, do the following:

- Name: Enter a name for the user group.

- Description: Optionally, enter a description for the user group.

- Members: Under Members, use the check box to select the users who you want to add to the user group.

6. Click Save.

Adding and Modifying User Group Details

You can change the description and members of a user group and, add or remove wallet access and group membership. You cannot change the name of the user group.

1. Log in as a user who has been granted the Key Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Users tab, and then select Manage Access.

3. On the User Groups page, under Details, select the edit pencil icon for the user group that you want to modify.

4. On the User Group Details page, do the following as necessary:

- To modify the description, enter a new description in the Description field.

- To add or remove access to wallets, click Add or Remove.

- To modify the group members, under User Group Members, click Add to add new members. To delete existing members, select their check boxes and then click Remove.

5. Click Save.

Adding an Oracle Key Vault User to a Group

You can add an existing Oracle Key Vault user a group.

1. Log in as a user who has the Key Administrator role.
Select the Users tab, then select Manage Access and click the edit pencil icon in the details column next to the user group name.

2. In the User Group Members region, click Add.

3. Select the check box for the user (member) being added.

4. Click Save.
A dialog box appears, indicating that the user (member) has been successfully added.

Removing an Oracle Key Vault User from a Group

You can remove an existing Oracle Key Vault user from a group.

1. Log in as a user who has the Key Administrator role.
Select the Users tab, then select Manage Access and click the edit pencil icon in the details column next to the user group name.

2. In the User Group Members region, select the check box for the user (member) being removed.

3. Click Remove.

4. When the confirmation dialog box asks if you want to delete the user, click OK.
A dialog box appears, indicating that the group has successfully dropped a member.

Deleting an Oracle Key Vault User Group

You can delete an Oracle Key Vault user group.

1. Log in as a user who has been granted the Key Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Users tab, and then select Manage Access.

3. On the User Groups page, select the check boxes for the user groups that you want to delete, and then click Delete.

4. In the Confirmation dialog box, click OK.

6 Managing Oracle Key Vault Endpoints

An endpoint is the database on which the data that Oracle Key Vault protects resides. You can create, delete, and reenroll endpoints, manage their virtual wallet access, and organize endpoints into groups.

Topics:

- About Managing Endpoints

- Searching for Endpoints

- Adding, Deleting, or Reenrolling Endpoints

- Managing Endpoint Details

- Managing Virtual Wallet Access to Endpoints

- Managing Endpoint Groups

About Managing Endpoints

You store security objects on endpoints, and then upload these objects to and from Oracle Key Vault. This enables you to share these security objects on other endpoints throughout the enterprise.

You can manage endpoints and endpoint groups as follows:

- Endpoints
Endpoints are databases and other systems that use Oracle Key Vault to store security objects for various cryptographic operations.

You can view and search for endpoints by specific criteria and then drill down to endpoint details. You can enroll endpoints, rename endpoints, delete endpoints, and create endpoint groups and modify their memberships.

- Endpoint groups
Endpoint groups are groups of endpoints that have shared access to virtual wallets.

Administrators who have the Key Administrator role can provide access to specific or multiple virtual wallets at the endpoint group level. Then all the member endpoints of that endpoint group automatically have access to the wallets or keys. For example, if the nodes of an Oracle RAC cluster are set up in an endpoint group, then they can share wallets and wallet contents.

Administrators for endpoints perform different tasks depending on their roles. These roles are as follows:

- The System Administrator role changes endpoint names, endpoint types, descriptions (any information that would be useful), platforms, or email addresses.

- The Key Administrator role changes or adds a default virtual wallets, endpoint group memberships, or access to existing virtual wallets.

Searching for Endpoints

You can search for existing endpoints.

1. Log in to the Oracle Key Vault management console.
See "Logging In to the Oracle Key Vault Management Console."

2. Search for the endpoints as described in "Search Bars".
Select one of the columns to search, such as All Columns, Endpoint Name, Endpoint Type, Description, Platform, Status, Enrollment Token, or Alert.

Adding, Deleting, or Reenrolling Endpoints

You can add, delete, or reenroll endpoints, and find the enrollment status. You can add an endpoint using either administrative-initiated enrollment or self-enrollment.

- Types of Endpoint Enrollment

- Enrollment Status

- Adding an Endpoint Using Administrator-Initiated Enrollment

- Adding an Endpoint Using Self-Enrollment

- Deleting or Reenrolling Endpoints

Types of Endpoint Enrollment

There are two methods for enrolling an endpoint, depending on who initiates the enrollment.

- Administrator-initiated enrollment
An Oracle Key Vault user who has the System Administrator role initiates the enrollment from the Key Vault side by adding the endpoint. When the endpoint is added, Oracle Key Vault generates a one-time token, called an enrollment token. This token must be communicated to the endpoint administrator using an out-of-band method such as email or telephone. The endpoint administrator then submits the enrollment token, from the endpoint side, to Oracle Key Vault as proof of authentication.

When the endpoint is enrolled, the enrollment token is consumed and can never be used again. To resolve any particular problems or configuration issues, administrators can reenroll the endpoint. See "Deleting or Reenrolling Endpoints" for more information. The reenrollment process generates a new one-time enrollment token.

See "Adding an Endpoint Using Administrator-Initiated Enrollment" for more information about administrator-initiated enrollment.

- Endpoint self-enrollment

Endpoint self-enrollment is performed in an environment where it is acceptable to enroll new endpoints without action by an Oracle Key Vault user who has the System Administrator role. This facilitates enrollment with less human administrative intervention. Endpoint self-enrollment is particularly useful when the endpoints do not share security objects and use Oracle Key Vault mainly to archive and restore security objects. In addition, endpoint self-enrollment is useful for testing purposes.

A self-enrolled endpoint is created with a generic endpoint name, such as ENDPT_001, and it initially has access only to the security objects that it uploads or creates. It does not have access to any virtual wallets. You can subsequently grant the endpoint access to virtual wallets, but you must be careful to ensure that you are granting access to the intended endpoint.

Endpoint self-enrollment is disabled by default and must be enabled by an Oracle Key Vault administrator with the System Administrator role. Oracle recommends that you only enable endpoint self-enrollment during the period when you expect endpoints to self enroll.

See "Adding an Endpoint Using Self-Enrollment" for more information about self-enrollment.

Enrollment Status

The status (in processing order) for the Oracle Key Vault endpoint enrollment process can be either registered or enrolled.

- Registered: The endpoint has been added by an administrator and an enrollment token has been generated (from administrator-initiated enrollment), but the okvclient.jar file has not been downloaded to the endpoint.

- Enrolled: The endpoint has presented the enrollment token, if one was necessary, and downloaded the okvclient.jar file.

Adding an Endpoint Using Administrator-Initiated Enrollment

With administrator-initiated enrollment, a user who has the System Administrator role registers the endpoint with Oracle Key Vault, providing details such as a name for the endpoint, the type of endpoint it is, the platform the endpoint uses, and the administrator email address for notifications.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Endpoints tab, and then select Endpoints.

When the Endpoints page appears, it displays a table listing previously added endpoints, describing their names, types, IP addresses, platform, and any alerts that may have been generated for the endpoint. The Status column lists each endpoint as being either Registered or Enrolled. Registered indicates that an endpoint has been registered with the Oracle Key Vault server. In this case, an enrollment token appears in the Enrollment Token column. The Status column changes to Enrolled when the endpoint administrator downloads the endpoint software package along with the necessary configuration files after providing the enrollment token. At this time, the one-time enrollment token has been used as part of the process, so it disappears from the page.

3. Click Add on the Endpoints page.

4. On the Register Endpoint page, enter the following metadata for the new endpoint:

- Endpoint name: The endpoint name is case-insensitive. For example, Oracle Key Vault regards "APP_SERVER1" and "app_server1" as the same endpoint. The name can have letters, numbers, and underscores. The endpoint will be referred to by this name elsewhere (for example, in access settings).

- Type: Valid values are Oracle Database, Oracle (non-database), and Other. An example of Other is a third-party KMIP endpoint.

Note:
If you are using Oracle Advanced Security Transparent Data Encryption (TDE) and want to use Oracle Key Vault to manage a TDE master key or wallet, then you must set Type to Oracle Database.

- Platform: Valid values are Linux, Solaris SPARC, and Solaris x64.

- Description (optional): Enter a description, such as the host name or IP address of the endpoint.

- Administrator Email (optional): Email address of the endpoint administrator. This is useful for notification purposes.

5. Click Register to generate a temporary one-time token for use by the endpoint to complete the enrollment process.
On the Endpoints page, the Endpoints table now shows the newly created entry, including a one-time enrollment token in the Enrollment Token field. The status now reads Registered, indicating that the enrollment process has begun.

6. Add any necessary information for the endpoint, as described in "Managing Endpoint Details".

7. Provide the endpoint administrator with the temporary one-time token, so that he or she can complete the enrollment process on the endpoint side, as described in "Task 1: Enroll and Provision the Endpoint".
At this stage, the endpoint is configured on the Oracle Key Vault side.

Adding an Endpoint Using Self-Enrollment

Endpoint self-enrollment is disabled by default and must be enabled by a user who has the System Administrator role.

Note:
Oracle recommends that you, as the System Administrator, enable endpoint self-enrollment (by selecting the Allow Endpoint Self Enrollment check box) only during the period when you expect endpoints to self enroll. After all the endpoints have been enrolled, then you should disable endpoint self-enrollment by deselecting the Allow Endpoint Self Enrollment check box.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Endpoints tab, and then select the Settings menu.

3. Select the Allow Endpoint Self-Enrollment check box.

4. Click Save.
A dialog box appears, indicating that the settings have been saved.

5. Notify the endpoint administrator for this endpoint that the self-enrollment is complete on the Oracle Key Vault side.
The endpoint administrator now can enroll this endpoint by following the steps in "Task 1: Enroll and Provision the Endpoint". (Self-enrollment does not require an endpoint token.)

Note:
Oracle Key Vault associates a self-enrolled attribute with all endpoints that are enrolled through endpoint self-enrollment. For self-enrolled endpoints, the status becomes Enrolled after you complete the enrollment process. (There is no Registered status for self-enrolled endpoints.)

Deleting or Reenrolling Endpoints

When endpoints are no longer necessary, System Administrators can delete them, and then reenroll them when they are needed again.

Topics:

- About Deleting or Reenrolling Endpoints

- Deleting or Reenrolling an Endpoint

About Deleting or Reenrolling Endpoints

Users who have the System Administrator role can enroll endpoints in Oracle Key Vault and delete endpoints when they no longer use Oracle Key Vault.

Deleting an endpoint removes it permanently from Oracle Key Vault. Security objects created by that endpoint will have no owner. Now these objects can only be accessed through a virtual wallet or by a user who has the Key Administrator role.

Reenrolling an endpoint enables you to download a new endpoint certificate to communicate with Oracle Key Vault, if the old certificate was lost or has expired.

If you must update the software on an enrolled endpoint, you only need to download the software. You do not need to reenroll the endpoint.

Deleting or Reenrolling an Endpoint

You can delete or reenroll an existing endpoint.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Endpoints tab, and then select Endpoints.

3. On the Endpoints page, search for the endpoint as described in "Searching for Endpoints".

4. Select the check box beside the endpoint name.

5. Click Delete or Enroll.

6. Depending on whether you are deleting or enrolling an endpoint:

- If you are deleting an endpoint, a confirmation dialog box appears. Click OK.

- If you are reenrolling an endpoint, a new enrollment token appears in the Enrollment Token column for the selected endpoint. From here, an endpoint administrator must provide this token as part of the reenrollment process (as described in "Task 1: Enroll and Provision the Endpoint").

Managing Endpoint Details

After you create an endpoint, you can manage the endpoint details, such as adding a default wallet or manage the endpoint group membership.

Topics:

- About Endpoint Details

- Modifying Endpoint Details

- Adding Endpoint Membership in a Group

About Endpoint Details

The details of an endpoint cover information such as its email settings, status, creation date, whether it has a default wallet, and whether it is part of a group membership.

You can view information about the endpoint, such as administrator email, status, and creation date on the Endpoints Details page. You can add a default virtual wallet, add and remove endpoint group memberships, and set access to virtual wallets. You can perform these activities after the endpoint is registered, even before the full enrollment process has been completed.

Some changes can only be performed after a virtual wallet has been created.

To use a default virtual wallet, you should add it to Oracle Key Vault and associate it with the endpoint, before you download the Oracle Key Vault client software to the endpoint. If you add a default wallet after downloading the client software, you must reenroll the endpoint for the change to take effect.

Note:
If working with a default wallet, it is very important that you add the wallet and associate it with the endpoint before downloading the client software and installing it at the endpoint.

For endpoints using default virtual wallets, every key that the endpoint creates is automatically added to the default wallet. Default wallets are useful for sharing with other endpoints, such as nodes in an Oracle RAC cluster.

Modifying Endpoint Details

You can modify endpoint details from the Oracle Key Vault management console.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Endpoints tab, and then select Endpoints.

3. On the Endpoints page, select the name of the endpoint to be viewed or modified.
The Endpoint Details pane for that endpoint appears.

4. On the Endpoints Details pane, optionally modify the endpoint name, endpoint type, description, platform, and email, as necessary.
This page also enables you to view access information about wallets and endpoint groups.

5. Click Save.
The Endpoint page for that endpoint appears.

Adding Endpoint Membership in a Group

You can add an endpoint to a group by using the Oracle Key Vault management console.

1. Log in to the Oracle Key Vault management console as an administrator who has the Key Administrator role.

2. Select the Endpoints tab, and then select Endpoints.

3. Select the endpoint to be added to a group.

4. Click Add in the Endpoint Group Membership region of the Endpoint Details page.

5. On the Add Endpoints Group Membership page, select the check box next to the group that the endpoint is to become a member of.

6. Click Save.
A dialog box appears indicating that the member has been successfully added to the group.

Managing Virtual Wallet Access to Endpoints

You can map access or remove access from an endpoint to a virtual wallet, after the wallet has been created.

Topics:

- Adding Endpoint Access to a Virtual Wallet

- Removing Endpoint Access to a Virtual Wallet

Adding Endpoint Access to a Virtual Wallet

You can add endpoint access to a virtual wallet by using the Oracle Key Vault management console.

1. Log in to the Oracle Key Vault management console as an administrator who has the Key Administrator role.

2. Select the Endpoints tab, and then select Endpoints.

3. On the Endpoints page, select the endpoint that must have access to the virtual wallet

4. In the Access to Wallets pane of the Endpoint Details page, click Add.

5. On the Add Access to Endpoint page, select a wallet from the available list.

6. Select the desired access control. See "Access Control Options".

7. Click Save.
A message indicates that the access mapping succeeded.

Removing Endpoint Access to a Virtual Wallet

You can remove endpoint access to a virtual wallet by using the Oracle Key Vault management console.

1. Log in to the Oracle Key Vault management console as an administrator who has the Key Administrator role.

2. Select the Endpoints tab, and then select Endpoints.

3. On the Endpoints page, select the endpoint that should not have access to the virtual wallet.

4. In the Access to Wallets pane, select the check box next to the wallet name.

5. Click Remove.

6. When the confirmation dialog box asks if you want to remove this access, click OK.
A message indicates that the access mapping has been removed.

Managing Endpoint Groups

An endpoint group is a group of endpoints that have a common set of security objects.

Topics:

- Creating Endpoint Groups

- Modifying Endpoint Group Details

- Setting Access from an Endpoint Group to a Virtual Wallet

- Removing a Member from an Endpoint Group

- Deleting Endpoint Groups

Creating Endpoint Groups

Endpoint groups enable you to centralize multiple endpoints that share a common set of security objects.

Topics:

- About Creating Endpoint Groups

- Creating an Endpoint Group

About Creating Endpoint Groups

Endpoints that must share a common set of security objects can be grouped into an endpoint groups.

For example, endpoints using Oracle RAC, Oracle GoldenGate, or Oracle Active Data Guard may need to share keys for access to shared data.

The Endpoint Groups page displays a table of existing endpoint groups. New endpoint groups appear in the table after they are created.

When you click a group name in the table, the group members and mappings to wallets are listed.

Creating an Endpoint Group

You can create an endpoint group b using the Oracle Key Vault management console.

1. Log in to the Oracle Key Vault management console as a user who has the Key Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Endpoints tab.

3. Select Endpoint Groups.
The Endpoint Groups page appears.

4. Click the Create Endpoint Group button.

5. On the Create Endpoint Group page, enter the name of the new group and a brief description.
(Optional) You can use the Search bar and Actions menu preceding the list of endpoint names to select the endpoints you want to add to the group. See "Performing Actions and Searches".

6. (Optional) Select the check box next to each endpoint name that you want to add to the group.
You can add members later as described in "Modifying Endpoint Group Details".

7. (Optional) Click Actions again to select any actions that you want to perform on the final list of endpoint names.

8. Click Save.
A message appears indicating that the group has been successfully saved. The Endpoint Group page reappears, listing the new group.

The Endpoint Groups page also provides a link to the Wallet Overview page.

From the Wallet Overview page, you can view Wallet Access Settings and Wallet Contents and add or remove access settings as described in "Granting User and Endpoint Access to Virtual Wallets", or "Revoking Access Settings of a Virtual Wallet".

Modifying Endpoint Group Details

You can modify the details of an endpoint group by using the Oracle Key Vault management console.

1. Log in to the Oracle Key Vault management console as a user who has the Key Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Endpoints tab, and then select Endpoint Groups.

3. On the Endpoint Groups page, find the endpoint group to be modified, using the Search bar and Actions menu to filter.

See "Performing Actions and Searches".

4. Click the edit pencil icon next to the endpoint group that you want to modify.

The Endpoint Group Details page appears.

5. Modify the description, access to wallets, and endpoint group members as necessary.

6. Click Save.

Setting Access from an Endpoint Group to a Virtual Wallet

You can add access to or remove it from an endpoint group to an existing virtual wallet.

1. Log in to the Oracle Key Vault management console as a user who has the Key Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Endpoints tab, and then Endpoints Group.

3. Select the edit pencil icon next to the endpoint group being modified, as described in "Modifying Endpoint Group Details".

4. In the Access to Wallets pane, click Add.

5. Select a virtual wallet from the available list.

6. Select an Access Level:

- Read Only: The selected subject only has Read access on the virtual wallet and items in the wallet.

- Read and Modify: The selected subject has Read and Modify access on the virtual wallet and the items in the wallet.

7. (Optional) Select the Manage Wallet check box.
This option enables the selected subject to do the following:

- Add or remove objects from the virtual wallet.

- Grant others access to the virtual wallet.

8. Click Save.
A message appears, indicating that the access mapping was successful.

Removing a Member from an Endpoint Group

You can remove a member from an endpoint group. This does not remove the member from Oracle Key Vault.

1. Log in to the Oracle Key Vault management console as a user who has the Key Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Endpoints tab, and then select Endpoint Groups.

3. From the Endpoint Groups page, find the endpoint group to be removed, using the Search bar or Actions menu to filter.
See "Performing Actions and Searches".

4. Click the edit pencil icon next to that endpoint group.
The Endpoint Group Details page appears.

5. On the Endpoint Group Details page, determine which members (endpoints) to remove, using the Search bar and the Actions menu as necessary.

6. Select the check box next to the endpoint name.

7. Click Remove.

8. When the confirmation dialog box asks if you want to remove the endpoint from the group, click OK.
A dialog box appears, indicating that the endpoint has been successfully removed from the group.

Deleting Endpoint Groups

You can easily delete endpoint groups if you no longer need them.

Topics:

- About Deleting Endpoint Groups

- Deleting an Endpoint Group

About Deleting Endpoint Groups

You can delete an endpoint group when it is no longer necessary (for example, if you no longer need to group certain endpoints together).

This does not delete the actual endpoints, but it does remove access to virtual wallets that the endpoints gained through their membership in the endpoint group.

Deleting an Endpoint Group

You can delete an endpoint group by using the Oracle Key Vault management console.

1. Log in to the Oracle Key Vault management console as a user who has the Key Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Endpoints tab, and then select Endpoint Groups.

3. From the Endpoint Groups page, find the endpoint group being removed, using the Search bar and Actions menu to filter existing endpoint groups if necessary.
See "Performing Actions and Searches".

4. Select the check box next to the endpoint group name.

5. Click Delete.

6. In the Confirmation dialog box, click OK.

7 Managing Oracle Key Vault Virtual Wallets and Security Objects

A virtual wallet stores security objects, such as Oracle wallets, keystores, certificates, and other objects that hold sensitive data, on the Oracle Key Vault server. After you create a virtual wallet, you can check its details, add or remove items to and from it, and control who has access to the virtual wallet.

Topics:

- About Virtual Wallets

- Viewing Virtual Wallets

- Creating Virtual Wallets

- Managing Details of Security Objects

- Adding or Removing Items to and from Virtual Wallets

- Managing Virtual Wallet Access

- Deleting Virtual Wallets

About Virtual Wallets

Virtual wallets are groups of security objects that can be shared between users and endpoints.

These security objects are typically public and private keys, TDE master encryption keys, passwords, credentials, certificates, and so on.

In the Wallets & Keys tab of the Oracle Key Vault management console, you can view the virtual wallets that you are authorized to access. You can create, modify, and delete wallets, and add or remove items from wallets.

Viewing Virtual Wallets

You can view the contents of a virtual wallet by using the Oracle Key Vault management console.

1. Log in to the Oracle Key Vault management console as a user who has the Manage Wallet permission on any virtual wallet or as a user with the Key Administrator role.

2. Click the Keys & Wallets tab.
The Wallets page appears with the Wallets table, if there are any existing wallets.

3. In the Wallets table, find the wallet needed and double-click the wallet name. Use the Search bar or the Actions menu, if necessary.
The Wallets table remains visible, and the page then displays sublists for the wallet contents and access settings specific to that wallet.

4. To view the Item Details for Wallets from the Wallet Contents sublist, click the edit pencil icon for the item.
See the graphic in "Viewing, Adding, and Modifying Security Object Details".

Creating Virtual Wallets

After you create a virtual wallet, you can manage its contents and control who has access to it.

Topics:

- About Creating Virtual Wallets

- Creating a Virtual Wallet

About Creating Virtual Wallets

A user who has the Key Administrator role can create a virtual wallet.

The user who creates the virtual wallet is automatically granted the Read, Read and Modify, and Manage Wallet access on the virtual wallet. To perform actions on the virtual wallet, this user must have the Manage Wallet permission on the wallet, or the Key Administrator role. Users can only add items to the wallet if the user has the Read or Read and Modify privilege on the item.

Creating a Virtual Wallet

You can create a virtual wallet by using the Oracle Key Vault management console.

1. Log in to the Oracle Key Vault management console as a user who has the Key Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Keys & Wallets tab.

3. Select the Wallets menu.

4. On the Wallets page, click Create.

5. Enter name for the virtual wallet and, optionally, a description.
Virtual wallet names are case-sensitive. For example, wallet1 and Wallet1 are two different wallets. Oracle recommends that you enter a description for the wallet for future reference and ease of identification.

6. In the Add Items pane, select the check box beside the name of any items that you want to add to the wallet.
The security objects in this list are the items to which you have Read and Modify access.

You can filter this list to find the items that you want by using the Search bar or the Actions menu, as described "Performing Actions and Searches".

After you add security objects to the virtual wallet, you can modify the contents, as described in "Managing Details of Security Objects".

7. Click Save.
A message appears indicating that the virtual wallet has been successfully created, and the new wallet name appears in the Wallets table.

8. Grant the necessary access to users, user groups, endpoints, and endpoint groups to the virtual wallet.
As part of the access control settings for a virtual wallet with an endpoint, you must select Read and Modify and Manage Wallet if the user plans to use this virtual wallet as part of the okvutil upload and download commands.

See "Managing Virtual Wallet Access" for more information.

Managing Details of Security Objects

After you create a virtual wallet, you can manage its details, such as searching for a specific security object item and then modifying the wallet contents.

Topics:

- Searching for Security Object Items

- Viewing, Adding, and Modifying Security Object Details

- Changing the State of a Key or Other Security Object Item

Searching for Security Object Items

The term item refers to any single security object managed by Oracle Key Vault, such as a key, certificate, password, or opaque object.

1. Log in to the Oracle Key Vault management console as a user who has access to this wallet or has been granted the Key Administrator role.

2. Search as described in "Search Bars".

3. Select a search choice, from the following: All Columns, Type, Identifier, Creation Time, Owner, Wallets, and State.
The All Items page of the Keys & Wallets tab contains all items in Oracle Key Vault, in a table with their names and other information, such as the virtual wallets that contain the security objects. You can click the row heading to sort in ascending and descending order, hide columns, or create control breaks. Also, you can filter this list using the Actions menu. See "Actions Menus".

Table headings are as follows:

- Type: Indicates the object type of the item. Valid values are Symmetric Key, Private Key, Template, Opaque Object, Certificate, and Secret Data.

- Identifier: Lists the identifier for the item and includes a prefix that helps identify a subtype for the item.

- Creation Time: Date and time that the item was added to Oracle Key Vault.

- Owner: The endpoint that owns the item.

- Wallets: Indicates the virtual wallet membership.

- Details: Link to the Item Details page.

- State: Indicates the state of items. See "Item Details Page: Basic Attributes Pane".

Viewing, Adding, and Modifying Security Object Details

The details of security objects can include information such as the description, item identifier, and type.

Topics:

- About Viewing, Adding, and Modifying Security Object Details

- Item Details Page: Basic Attributes Pane

- Item Details Page: Advanced Pane

About Viewing, Adding, and Modifying Security Object Details

Users who have been granted the Key Administrator role can view, add, and modify item details in the Item Details page.

Users who have been granted the Audit Manager role can view the Item Details page. Item details are generally attributes relevant to the security object specified, and may include description, item identifier, and type. To access this page, select the Keys & Wallets tab, and then select All Items. You can respond to queries using the check boxes and fields provided.

To view an Item Details page, from the All Items page, click the edit pencil icon of the item that you need to examine or modify.

To modify these attributes you must have Read and Modify access for the security object, or you must have the Key Administrator role.

As a user or endpoint, you are granted the Read and Modify access privileges in one of two ways:

- You are the owner of the object.

- You have the Read and Modify access on a wallet that contains the object. See "Granting User and Endpoint Access to Virtual Wallets" for information about granting users and endpoints access to wallets and items.

Item Details Page: Basic Attributes Pane

The Basic Attributes pane of the Item Details page provides information such as an identifier, a unique identifier, the type of security object, whether it is active, and so on.

The beginning pane of the Item Details page includes the Cancel and Save buttons. In some instances, the Item Details page contains buttons and fields to change the item state depending on the item type. See "Changing the State of a Key or Other Security Object Item" for examples.

This section of the Item Details page also enables you to add or delete wallet membership.

This pane of the Item Details page contains additional information or queries for the following attributes:

- Identifier: A summary description to help identify the item to the user. For example, if the item is a TDE master key, the Identifier shows the prefix TDE Master Key followed by the identifier used by the database to identify the key.

- Unique Identifier: This is a globally unique ID that identifies an item.

- Type: Indicates the object type of the item. Valid values are Symmetric Key, Private Key, Template, Opaque Object, Certificate, and Secret Data.

- State: Indicates the state of items. Values are as follows:

- Pre-active: The object exists but is not yet usable for any cryptographic purpose.

- Active: The object is available for use. Endpoints should examine the Cryptographic Usage Mask attribute to determine which uses are appropriate for this object.

- Deactivated: The object is no longer active and should not be used to apply cryptographic protection (for example, encryption or signing). It may still be appropriate to use for decrypting or verifying previously protected data.

- Compromised: The object is believed to be compromised and should not be used.

- Destroyed: The object is no longer usable for any purpose.

- Destroyed Compromised: The object was compromised and subsequently destroyed. It is no longer usable for any purpose.

See Also:
Key Management Interoperability Protocol Specification Version 1.1 for complete definitions

- Creator: The endpoint that created the security object.

- Last Modified: The date last modified.

- Date of Creation: The date created.

- Date of Activation: The date of activation.

- Date of Deactivation: The date of deactivation. After this date, security objects should not be used.

Item Details Page: Advanced Pane

The Advanced pane of the Item Details page contains additional information or queries.

The Advanced pane appears similar to the following:

Attribute information and queries may vary depending on the item type. These are some attributes:

- Cryptographic Algorithms: The encryption algorithm used by the item

- Key Usage: Operations that the key can be used for

- Names: Labels attached by a user or endpoint to identify the key

- Custom attributes: Additional attributes defined by the endpoint and not interpreted by Oracle Key Vault

- Cryptographic Parameters: Optional parameters for the encryption algorithm used by the item, such as block cipher mode and padding method

- Digests: Digest values of the security object

- Link Details: Links to related objects

Changing the State of a Key or Other Security Object Item

You can activate or deactivate a key or other security object item.

Topics:

- About Changing the State of a Key or Other Security Object Item

- Deactivating a Key

- Revoking a Key

About Changing the State of a Key or Other Security Object Item

You can change the state of some virtual wallet items, such as keys, in the main section of the All Items page.

You can do the following to a key or other item:

- Activate: The state automatically changes to active on the specified date. If the date has passed, the state is also active. To activate an item, set the Activation date to any date.

- Destroy: Destroys an item. Click Destroy.

- Revoke: To mark as not valid to use. Click Revoke. See "Revoking a Key".

- Deactivate: Expires a key based on the Date of Deactivation. See "Deactivating a Key".

Deactivating a Key

A key deactivates or expires when it passes the date that has been set for deactivation.

1. Log in to the Oracle Key Vault management console as a user who has the Read and Modify access on this key.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Keys & Wallets tab.

3. Select the All Items menu and then click the edit pencil icon beside the item to be deactivated.

4. On the Item Details page for the item, set the Protect Stop Date to the date by which you want the key to be deactivated.

5. Click Save.

Revoking a Key

When you revoke a key, the key no longer can be downloaded but it can still be examined by the endpoints.

1. Log in to the Oracle Key Vault management console as a user who has the Read and Modify access on this key.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Keys & Wallets tab.

3. Select the All Items menu and then click the edit pencil icon beside the item to be changed.

4. On the Item Details page, click Revoke.
The Revoke Key page appears.

5. (Optional) Select a Revocation Reason and write a Revocation message.

6. Click Save.
A message appears, indicating that the revocation succeeded.

Adding or Removing Items to and from Virtual Wallets

You can add items to wallets or remove items from wallets. You can also add items while creating the wallet.

1. Log in to the Oracle Key Vault management console as a user who has the Manage Wallet access on the virtual wallet or as a user with the Key Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Keys & Wallets tab, and then select Wallets.

3. From the Wallets table, click the edit pencil icon in the Details column beside the wallet name.
The Wallet Overview page appears.

4. Do one of the following:

- To add items: In the Wallet Contents pane, click Add Items. On the Add Wallet Contents page, you can see a list of the security objects for which you have both the Read and Modify permissions. Select the items that you want to add, and then click Save.

- To remove items: In the Wallet Contents list, select the check box beside each item that you want to remove from the wallet. Then click Remove Items.

For both of these methods, use the Search bar or the Actions menu to locate the items, if necessary.

5. After you add items to a virtual wallet, ensure that users, user groups, endpoints, and endpoint groups have the appropriate access to it.
As part of the access control settings for a virtual wallet with an endpoint, you must select Read and Modify and Manage Wallet if the user plans to use this virtual wallet as part of the okvutil upload and download commands.

See Also:

- "Creating a Virtual Wallet"

- "Managing Virtual Wallet Access"

Managing Virtual Wallet Access

Managing virtual wallet access enables you to control which users have access to the virtual wallet and the kinds of actions they can perform on the virtual wallet.

Topics:

- Granting User and Endpoint Access to Virtual Wallets

- Setting Access for an Individual User to a Virtual Wallet

- Controlling User Group Access to Virtual Wallets

- Revoking Access Settings of a Virtual Wallet

Granting User and Endpoint Access to Virtual Wallets

You can add access settings to a virtual wallet in the Select Access Level pane.

This gives the specified endpoint groups, endpoints, user groups, or users access to the virtual wallet and the objects in it. The access settings are Read Only, Read and Modify, and Manage Wallet.

1. Log in to the Oracle Key Vault management console as a user who has the Manage Wallet access on the virtual wallet or as a user with the Key Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Keys & Wallets tab, and then select Wallets.

3. On the Wallets page, from the Wallets table, next to the wallet being accessed, click the edit pencil icon in the Details column.
The Wallet Overview page appears.

4. In the Wallet Access Settings pane, click Add.

5. On the Add Access to Wallet page, under Select Endpoint/User Group, select the Type of subject.

Possible values are Endpoint Groups, Endpoints, User Groups, and Users depending on the subject types currently existing in Oracle Key Vault.

6. Select an Access Level:

- Read Only: The selected subject only has read access on the virtual wallet and items in the wallet.

- Read and Modify: The selected subject has read and modify access on the wallet and the items in the wallet.

7. (Optional) Select the check box next to Manage Wallet.
This option enables the selected subject to do the following:

- Add or remove objects from the wallet.

- Grant others access to the wallet.

8. Click Save.

Setting Access for an Individual User to a Virtual Wallet

You can add access for a user to a virtual wallet or remove this access, after the virtual wallet has been created.

Topics:

- Adding Individual User Access to a Virtual Wallet

- Removing Individual User Access to a Virtual Wallet

Adding Individual User Access to a Virtual Wallet

You can add access to a virtual waller for an individual user by using the Oracle Key Vault management console.

1. Log in to the Oracle Key Vault management console as a user who has the Manage Wallet permission on the virtual wallet, or as a user with the Key Administrator role.

2. Select the Users tab, then select Manage Users, and in the User Name column, click the user's name.

3. In the Access to Wallets pane, click Add.

4. On the Add Access to User page, select a virtual wallet from the available list.

5. Select the desired access levels.
See "Access Control Options".

6. Click Save.
A message appears, indicating that the access mapping has been saved. The access will appear in the User Details page.

Removing Individual User Access to a Virtual Wallet

You can remove access to a virtual wallet for an individual user by using the Oracle Key Vault management console.

1. Log in to the Oracle Key Vault management console as a user who has the Manage Wallet access on the virtual wallet, or as a user with the Key Administrator role.

2. Select the Users tab, then select Manage Users, and in the User Name column, click the user's name.

3. Check the box next to the virtual wallet name.

4. Click Remove.

5. In the confirmation dialog box, click OK.
A message appears, indicating that the access mapping has been removed.

Controlling User Group Access to Virtual Wallets

With the Key Administrator role, you can set access for a user group to a virtual wallet or remove this access, after the virtual wallet has been created.

Topics:

- Adding User Group Access to a Virtual Wallet

- Removing User Group Access from a Virtual Wallet

Adding User Group Access to a Virtual Wallet

You can add user group access to a virtual wallet by using the Oracle Key Vault management console.

1. Log in to the Oracle Key Vault management console as a user who has the Key Administrator role.

2. Select the Users tab, and then select Manage Access.

3. In the User Groups page, click the edit pencil icon in the details column next to the user group name.

4. In the Access to Wallets pane, click Add.

5. Select a virtual wallet from the available list in the Add Access to User Group page.

6. Select the desired access levels. See "Access Control Options".

7. Click Save.
A message indicates that the access mapping was successfully added.

Removing User Group Access from a Virtual Wallet

You can remove user group access from a virtual wallet by using the Oracle Key Vault management console.

1. Log in to the Oracle Key Vault management console as a user who has the Key Administrator role.

2. Select the Users tab, and then select Manage Access.

3. On the User Groups page, click the edit pencil icon in the details column next to the user group name.

4. In the Access to Wallets pane, select the check box next to the virtual wallet name.

5. Click Remove.

6. In the confirmation dialog, click OK.
A message indicates that the user group access was successfully dropped.

Revoking Access Settings of a Virtual Wallet

You can revoke the access settings of a virtual wallet by using the Oracle Key Vault management console.

1. Log in to the Oracle Key Vault management console as a user who has the Manage Wallet permission on the virtual wallet or as a user with the Key Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Keys & Wallets tab, and then select Wallets.

3. On the Wallets page, from the Wallets table, next to the wallet, click the edit pencil icon in the Details column.

4. In the Wallet Contents pane, select the check box next to the access setting being removed, and then click Remove.

5. In the Wallet Overview pane, click Save.

Deleting Virtual Wallets

Deleting a virtual wallet removes the wallet but does not delete the objects that are part of it, and for endpoints that have downloaded this wallet, it does not delete their local copy.

1. Log in to the Oracle Key Vault management console as a user who has the Manage Wallet permission on the virtual wallet or as a user with the Key Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Keys & Wallets tab, and then select Wallets.

3. On the Wallets page, from the Wallets table, select the check box next to the name of the wallet name that you want to delete.
Use the Search bar or the Actions menu, if necessary.

The Wallet Overview appears.

4. Click Delete.

5. In the Confirmation dialog box, click OK.

8 Using Oracle Key Vault Endpoints

An endpoint administrator can enroll and provision endpoints, which contain security objects, so that these endpoints can share security objects with one another, using the Oracle Key Vault server as a medium.

Topics:

- About Oracle Key Vault Endpoints

- Overview of Endpoint Enrollment and Provisioning

- Finalizing Enrollment and Provisioning

- Transparent Data Encryption Endpoint Management

- Endpoint okvclient.ora Configuration File

- Oracle Key Vault okvutil Endpoint Utility Reference

About Oracle Key Vault Endpoints

Endpoints are Oracle Key Vault clients that use Oracle Key Vault to store and retrieve security objects, such as keys, passwords, certificates, and credential files.

These systems can be Oracle database servers, Oracle middleware servers, operating systems, and so on. Endpoints use Oracle Key Vault to store secrets for long-term retention, share them with trusted peers, and retrieve them whenever needed.

Oracle Key Vault provides a library that enables Transparent Data Encryption (TDE) to communicate with Key Vault. You can use Oracle Enterprise Manager to manage database targets (Oracle Key Vault database server endpoints), but be aware that Enterprise Manager does not support TDE integration with Oracle Key Vault.

An endpoint administrator can finalize the endpoint enrollment and provisioning after an Oracle Key Vault System Administrator has configured the endpoint to connect to Oracle Key Vault. The administrator can use an endpoint configuration file and the okvutil utility, which is used to upload, download, and find security objects.

See Also:
"Adding, Deleting, or Reenrolling Endpoints" for information about the initial process of configuring an endpoint to connect to Oracle Key Vault

Overview of Endpoint Enrollment and Provisioning

Endpoint enrollment is the process of adding an endpoint to (registering it with) Oracle Key Vault. After the endpoint is registered, it is provisioned.

The okvclient.jar file is downloaded from Oracle Key Vault to the endpoint. This file installs the utilities necessary for the endpoint to communicate with Oracle Key Vault.

Endpoints must be enrolled in order to communicate with Oracle Key Vault. In an Oracle Real Application Clusters (Oracle RAC) environment, you must enroll and provision each Oracle RAC node as an endpoint. Endpoint enrollment ensures that only authorized endpoints are allowed to communicate with Oracle Key Vault.

Endpoint enrollment and provisioning involves an Oracle Key Vault administrator with the System Administrator role on the Oracle Key Vault side, and an endpoint administrator on the endpoint side. Essentially, the Key Vault administrator starts the process and the endpoint administrator finishes it.

At the end of the enrollment process, Oracle Key Vault prompts the endpoint administrator to download the okvclient.jar file, described in Step 6 of "Finalizing Enrollment and Provisioning".

The okvclient.jar that is downloaded contains those items from the following list that apply to this endpoint:

- TLS certificate and private key for the endpoint

- TLS certificate for Oracle Key Vault: trust anchor

- Endpoint libraries and utilities

- Additional information that is used by okvutil to create the okvclient.ora configuration file, described in "Task 2: Install the Oracle Key Vault Client Software on the Endpoint".

See Also:

- "Adding, Deleting, or Reenrolling Endpoints" for more information about the enrollment process

- "Endpoint okvclient.ora Configuration File"

Finalizing Enrollment and Provisioning

An endpoint administrator completes the endpoint enrollment and provisioning, for both endpoint self-enrollment and administrator-initiated enrollment.

Topics:

- Task 1: Enroll and Provision the Endpoint

- Task 2: Install the Oracle Key Vault Client Software on the Endpoint

- Special Notes About Endpoint Provisioning

Task 1: Enroll and Provision the Endpoint

To finalize enrollment and provision the endpoint, you must download the appropriate software to the correct endpoint.

1. As an endpoint administrator, log in to the endpoint.

2. Connect to the Oracle Key Vault management console.
For example:

https://192.0.2.254

3. When the Oracle Key Vault management console login page appears, do not log in.

4. Under the login area, click the Endpoint Enrollment and Software Download link.
The Enroll Endpoint page appears.

Do not fill in any information for the Download Endpoint Software area. (It is used for downloading the software for an already-enrolled endpoint. You can use this area when you update the endpoint software.)

5. Under Enroll Endpoint, do one of the following:

- If the enrollment type was administrator-initiated: Enter the enrollment token that was supplied by the Oracle Key Vault user with the System Administrator role and press Submit Token. If the token is invalid, an error message appears near the Submit Token button. You do not need to perform this action for self-enrolled endpoints. See "Types of Endpoint Enrollment" for more information about the types of enrollment.

- If the enrollment type was self-enrollment: Fill in or correct Type, Platform, and Email fields as necessary. For self-enrollment, there is no token.

- Type: Oracle Database, Oracle Non-database, or Other. If you are using TDE, enter Oracle Database.

- Platform: Select Linux, Solaris SPARC, or Solaris x64.

- Administrator Email: Optionally, enter the email address of the endpoint administrator.

6. Click Enroll to complete the process.

A processing message appears, followed by downloading the okvclient.jar file for your endpoint.

7. Save the file to the desired location.

8. Install the okvclient.jar file on the endpoint as described in "Task 2: Install the Oracle Key Vault Client Software on the Endpoint".

Task 2: Install the Oracle Key Vault Client Software on the Endpoint

After you download the Oracle Key Vault client software, you are ready to install the it on the endpoint.

1. Ensure that you have the necessary privileges to install software on the endpoint.

2. Ensure that you have JDK 1.4 or later installed and that the PATH environment variable includes the java executable (which is in the JAVA_HOME/bin directory).
Oracle Key Vault supports JDK versions 1.4, 1.5, 1.6, and 7.

3. Navigate to the directory in which you saved the okvclient.jar file.

4. Run the java command to install the okvclient.jar file.
For example:

java -jar okvclient.jar -d /home/oracle/okvutil -v

In this specification:

- The -d argument specifies the directory location for the Oracle Key Vault software and configuration files, in this case, the $OKV_HOME directory.

- The -v argument writes the installation logs to the $OKV_HOME/log/okvutil.deploy.log file in the server endpoint.

See "How the Oracle Key Vault Client Installation Process Determines the Java Home Location" for information about how the installation process finds the Java home directory.

5. When prompted, do one of the following to store the credentials for accessing Oracle Key Vault in an Oracle wallet file:

- For a password-protected wallet, enter a password between 8 and 30 characters, and then press Enter. This password will be required when the endpoint connects to Oracle Key Vault. (If necessary, you can change this password later on by using the okvutil changepwd command.)

- For an auto-login wallet, do not enter a password. Press Enter only. No password is required when the endpoint connects to Oracle Key Vault.

Enter new Key Vault endpoint password (<enter> for auto-login): Key_Vault_endpoint_password
Confirm new Key Vault endpoint password: Key_Vault_endpoint_password

Where the extraction process installs the okvclient.ora file depends on how you have set the Oracle environment variables. See "How the Oracle Key Vault Installation Process Determines the okvclient.ora File Location" for more information.

The directory structure contains the following directories:

- bin: Contains the okvutil program, the root.sh script, and other binary files

- conf: Contains configuration files

- jlib: Contains Java library files

- lib: Contains the file liborapkcs.so

- log: Contains log files

- ssl: Contains TLS-related files and wallets to connect to Oracle Key Vault. After the extraction process completes, the file ewallet.p12 is added to this directory for a password-based wallet, or the file cwallet.sso is added for an auto-login wallet.

After the extraction process is complete, the following message should appear:

Oracle Key Vault endpoint software installed successfully.

6. If you are planning to use a TDE direct connection, then run root.sh to copy the liborapkcs.so file (located in the lib directory) to the following directory:

/opt/oracle/extapi/64/hsm/oracle/1.0.0

The liborapkcs.so file contains the library that the Oracle database uses to communicate with Oracle Key Vault.

Log in as the root user and run the root.sh script to copy the liborapkcs.so file.

For example:

$ sudo ./$OKV_HOME/bin/root.sh

Or:

$ su -
# bin/root.sh

Note:

- If the endpoint does not use the Oracle Key Vault client software, then you must manually set the TLS authentication. See "If the Endpoint Does Not Use the Oracle Key Vault Client Software" for more information.

- You can find help information for the okvclient.jar file as follows:

java -jar okvclient.jar -h

The output is similar to the following:

Oracle Key Vault Release 12.1.0.0.0 (2014-03-12 15:36:49.839 PDT)
Production on Wed Mar 12 19:55:31 PDT 2014
Copyright (c) 1996, 2014 Oracle. All Rights Reserved.
Usage: java -jar okvclient.jar [-h | -help] [[-v | -verbose] [-d <destination directory>] ]

See Also:
"Using a TDE Direct Connection with Oracle Key Vault"

Special Notes About Endpoint Provisioning

When you provision endpoints, you should be aware of how the installation process determines the Java home location and the okvclient.ora file location. You should also be aware of what happens if the endpoint does not use the Oracle Key Vault client software.

Topics:

- How the Oracle Key Vault Client Installation Process Determines the Java Home Location

- How the Oracle Key Vault Installation Process Determines the okvclient.ora File Location

- If the Endpoint Does Not Use the Oracle Key Vault Client Software

How the Oracle Key Vault Client Installation Process Determines the Java Home Location

The Oracle Key Vault client software installation process determines the Java home location based on a set of rules.

These rules are as follows:

1. If a user-defined JAVA_HOME environment variable is present, then the value in this variable is used for the installation process.

2. If the JAVA_HOME environment variable has not been set, then the installation process tries to infer the JAVA_HOME from the java.home system property of the Java Virtual Machine (JVM).

After the installation is complete, the installer adds the determined JAVA_HOME path into the conf/okvclient.ora configuration file for future use. Afterward, the okvutil command tries to use the JAVA_HOME setting that is found in the okvclient.ora file. You can force okvutil to use a different JAVA_HOME setting by using one of the following methods:

- Set the JAVA_HOME environment variable in the shell where you run okvutil.
For example:

setenv JAVA_HOME path_to_Java_home

Or:

export JAVA_HOME = path_to_Java_home

- Set the JAVA_HOME property in the okvlient.ora configuration file.
For example:

JAVA_HOME = path_to_Java_home

How the Oracle Key Vault Installation Process Determines the okvclient.ora File Location

The okvclient.ora file is a configuration file for the Oracle Key Vault endpoint software.

Where you install this file depends on the following factors:

- The default location for the okvclient.ora file is the $OKV_HOME/conf directory. The $OKV_HOME directory is the destination directory, specified with the -d option, when you install the endpoint software. After you install the endpoint software, you must set the environment variable OKV_HOME to point to the Oracle Key Vault home directory, in order to execute utilities such as Oracle Recovery Manager (RMAN) that access Oracle Key Vault for keys, because installing does not set it automatically. You must set OKV_HOME in all environments where you will run utilities, like RMAN. For example, if you spawn a new xterm, you will need to set OKV_HOME in this environment before running RMAN.

- If the $ORACLE_BASE variable is set, then the installation process creates a symbolic link in the $ORACLE_BASE/okv/$ORACLE_SID location to point to the okvclient.ora configuration file in the $OKV_HOME/conf directory. If the okvclient.ora file already exists in the $ORACLE_BASE/okv/$ORACLE_SID location, then the installation process does not try to create the soft link, and accepts this location as a valid location.

- If the $ORACLE_BASE/okv/$ORACLE_SID directory is not set, then the installation process tries to create it.

- If the $ORACLE_HOME variable is set and the $ORACLE_BASE variable is not set, then the installation process creates a symbolic link for the $ORACLE_HOME/okv/$ORACLE_SID location to point to the configuration file in the $OKV_HOME/conf directory.

See Also:
"Endpoint okvclient.ora Configuration File"

Using Environment Variables in sqlnet.ora

You must consider the following points while using the srvctl utility:

- If you are using the srvctl utility, and if you want to include environment variables in the sqlnet.ora configuration file, then you must set these environment variables in both the operating system and the srvctl environment.

- The operating system (OS) and Server Control (srvctl) should have $ORACLE_SID, $ORACLE_HOME and $ORACLE_BASE set to the same values.

If the Endpoint Does Not Use the Oracle Key Vault Client Software

After you install the Oracle Key Vault client software on the endpoint, there are some cases where the endpoint does not use the Key Vault client software (okvutil and liborapkcs.so).

If this is the case, then follow these steps:

1. Extract the ssl directory from the okvclient.jar file, as follows:

jar xvf okvclient.jar ssl

2. Use the following files to set up the TLS authentication:

- ssl/key.pem: endpoint private key

- ssl/cert.pem: endpoint certificate

- ssl/cert_req.pem: certificate request corresponding to cert.pem

- ssl/CA.pem: trust anchor for verifying the Oracle Key Vault server certificate

See Also:
"Task 2: Install the Oracle Key Vault Client Software on the Endpoint"

Transparent Data Encryption Endpoint Management

TDE has supported storing TDE master encryption keys in Oracle wallets, beginning with Oracle Database 10g Release 2, and in hardware security modules (HSMs), beginning with Oracle Database 11g Release 1.

Oracle Key Vault can manage TDE keys by using the same PKCS#11 library interface that TDE uses to communicate with HSMs. Therefore, you do not need to patch the database to use Key Vault for storing and retrieving TDE master keys. Oracle Key Vault supplies the PKCS#11 library, which is used by TDE just as any HSM PKCS#11 library and used by the database to communicate with Oracle Key Vault.

Oracle Key Vault improves upon TDE key management. For example, the keys in the wallet can be uploaded directly to Key Vault for long-term retention and to share with other database endpoints within the same endpoint group. Therefore, you do not need to store to the wallet indefinitely after migration. You can continue to use the wallet and upload wallet copies to Key Vault as part of every TDE key administration SQL operation involving a WITH BACKUP SQL clause. (However, be aware that though the WITH BACKUP clause is required for the ADMINISTER KEY MANAGEMENT statement, TDE ignores it in an Oracle Key Vault environment.)

Example 8-1 shows examples of setting an encryption key.

Example 8-1 Setting an Encryption Key

ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY secret_passphrase -- For Oracle Database 11g Release 2

ADMINISTER KEY MANAGEMENT SET ENCRYPTION KEY IDENTIFIED BY secret_passphrase WITH BACKUP; -- For Oracle Database 12c

Note:
Migration, in the context of Oracle Key Vault, means that a database is configured as a wallet backup scenario and the administrator intends to migrate to a TDE direct connection. See "Using a TDE Direct Connection with Oracle Key Vault" for more information.

Oracle Database and thus TDE are endpoints for Oracle Key Vault. Endpoint enrollment and installation ensure that the PKCS#11 library is installed in the correct location for TDE to pick up and use. When the PKCS#11 library is installed, all other configurations and operations are in effect.

Endpoint okvclient.ora Configuration File

Information necessary to use Oracle Key Vault is stored in a configuration file called okvclient.ora, which Oracle Key Vault endpoint libraries and endpoint utilities use.

The okvclient.ora file consists of key-value pairs separated by an equal sign (=). The following parameters, showing sample data, can be set in the endpoint configuration file:

- SERVER = 192.0.2.254:5696
This parameter specifies the IP address and port number, separated by a colon. If the port number is not specified, then it defaults to the standard KMIP port 5696.

- STANDBY_SERVER = 192.0.2.114:5696
This is the standby server. If high availability is configured, then this parameter shows the standby IP address. Otherwise, it shows the IP address as 127.0.0.1.

- SSL_WALLET_LOC=/home/oracle/okvutil/ssl/
This parameter specifies the location of the wallet containing TLS credentials for the endpoint.

See Also:
"How the Oracle Key Vault Installation Process Determines the okvclient.ora File Location"

Oracle Key Vault okvutil Endpoint Utility Reference

The Oracle Key Vault okvutil utility enables users to find, upload, and download security objects, such as Oracle wallets or Java keystores.

Topics:

- About the okvutil Utility

- okvutil Utility Syntax

- okvutil list Command

- okvutil upload Command

- okvutil download Command

- okvutil changepwd Command

About the okvutil Utility

If you are managing endpoints, then you can use the Oracle Key Vault okvutil command-line utility to manage the storage and retrieval of security objects in Oracle Key Vault.

The okvutil utility uses the TLS credentials provisioned for the endpoint to authenticate to Oracle Key Vault.

okvutil Utility Syntax

The okvutil utility syntax enables you to list, download, upload, and change passwords for security objects. It provides long and short options for specifying commands.

The syntax for the okvutil utility is as follows:

okvutil command arguments [-v verbosity_level]

In this specification:

- command refers to any of the following commands, which are described in the subsequent sections: list, upload, and download.

- arguments refers to the arguments that you pass for the accompanying command.

- -v, --verbose prints more details about the actions of the okvutil command. For example, it reports the location of the configuration file that was used and the IP addresses of the servers. Valid values are as follows:

- -v 0 disables verbose mode.

- -v 1 includes debug messages.

- -v 2 includes more detailed debug messages.

- -h, --help shows help information.

Short and Long Forms of Specifying Options

You can specify the options in either a short form or a long form.

- Short form: Only use one hyphen and the single-letter option name. For example:

-l /home/username
-t wallet

- Long form: Provide two hyphens and the full option name. For example:

--location /home/username
--type wallet

The examples in this guide use the short form.

How Password Prompts for okvutil Work

The okvutil commands prompt for passwords based on specific situations.

These situations are as follows:

- If you specified a password for accessing Oracle Key Vault during the endpoint installation, then okvutil prompts for the Key Vault password when it executes any command that accesses Key Vault.

- If you specify the -l parameter, then the okvutil command applies to files that are on the current endpoint and hence makes no connection to Oracle Key Vault. When you specify an Oracle wallet file or Java keystore using the -l option, okvutil prompts you to provide the password for the wallet or keystore if it has one.

okvutil list Command

The okvutil list command lists the available security objects that are uploaded. When used without options or with the -g group option, it displays the unique ID, object type, and a descriptor for each item it lists from Oracle Key Vault.

The full syntax for okvutil list is as follows. For the short format:

okvutil list [-l location -t type | -g group] [-v verbosity_level]

Or, for the long format:

okvutil list [--location location --type type | --group group] [--verbose verbosity_level]

In this specification:

- -l, --location specifies the location of an Oracle wallet file or a Java keystore. For an Oracle wallet, the location is the directory that contains the .p12 or .sso files. For all other types, the location is the path name of the file itself. If you omit the -l, --location option, then the default location is Oracle Key Vault. In this case, the okvutil list command lists all the available keys in the server. If you use this setting, then you must also include the -t, --type setting, described next.

- -t, --type specifies one of the following types:

- WALLET for an Oracle wallet

- JKS for the Java keystore

- JCEKS for the Java Cryptography Extension keystore (JCEKS)

The WALLET, JKS, and JCEKS types contain multiple objects; Oracle Key Vault lists each of these objects individually. The SSH, KERBEROS, and OTHER, being opaque objects, are listed as single files.

This setting is not case-sensitive.

- -g, --group lists the content from a single virtual wallet. This option only applies when you omit the -l, --location option to list objects stored in Oracle Key Vault.

- -v, --verbose: See "okvutil Utility Syntax"

- Password prompts: See "How Password Prompts for okvutil Work".

Example: Listing Security Objects for the Current Endpoint

The okvutil list command enables you to list security objects for the current endpoint.

Example 8-2 lists all the authorized security objects for the current endpoint. In the last three lines, the DB Connect Password entries refer to the password that was used to log in to the instance (for example, the password for user psmith on the database instance inst01).

Example 8-2 Listing Security Objects for the Current Endpoint

okvutil list
Enter Oracle Key Vault endpoint password: password

Unique ID                               Type           Identifier
F63E3F4A-C8FB-5560-E043-7A6BF00AA4A6    Symmetric Key  TDE Master Key: 062C4F5BAC53E84F2DBF95B96CE577B525
F63E3F4A-C8FC-5560-E043-7A6BF00AA4A6    Symmetric Key   TDE Master Key: 069A5253CF9A384F61BFDD9CC07D8A6B07
F63E3F4A-C8FD-5560-E043-7A6BF00AA4A6    Opaque Object   -
F63E3F4A-C8FE-5560-E043-7A6BF00AA4A6    Symmetric Key   TDE Master Key: 06A66967E70DB24FE6BFD75447F518525E
F63E3F4A-C8FF-5560-E043-7A6BF00AA4A6    Symmetric Key   TDE Master Key: 0636D18F2E3FF64F7ABF80900843F37456
F63E3F4A-C900-5560-E043-7A6BF00AA4A6    Opaque Object   -
F63E3F4A-C901-5560-E043-7A6BF00AA4A6    Symmetric Key   TDE Master Key: 0611E6ABD666954F2FBF8359DE172BA787
F63E3F4A-C902-5560-E043-7A6BF00AA4A6    Symmetric Key   TDE Master Key: 0657F27D64D1C04FAEBFE00B5105B3CBAD
F63E3F4A-C91B-5560-E043-7A6BF00AA4A6    Opaque Object   Certificate Request
F63E3F4A-C91C-5560-E043-7A6BF00AA4A6    Certificate     X509 DN:OU=Class 1 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
F63E3F4A-C903-5560-E043-7A6BF00AA4A6    Secret Data     DB Connect Password: psmith@inst01
F63E3F4A-C904-5560-E043-7A6BF00AA4A6    Secret Data     DB Connect Password: jdaley@inst02
F63E3F4A-C905-5560-E043-7A6BF00AA4A6    Secret Data     DB Connect Password: tjones@inst03

Example: Listing the Contents of an Oracle Wallet File

The okvutil list command enables you to list the contents of an Oracle wallet file.

Example 8-3 lists the contents of an Oracle wallet file.

Example 8-3 Listing the Contents of an Oracle Wallet File

okvutil list -t WALLET -l /home/oracle/wallets
Enter target wallet password: Oracle_wallet_password

Dumping secret store of wallet:
ORACLE.SECURITY.DB.ENCRYPTION.MASTERKEY
ORACLE.SECURITY.DB.ENCRYPTION.Aa4JEUaCeE8qv0Dsmmwe5S4AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
ORACLE.SECURITY.ID.ENCRYPTION.
ORACLE.SECURITY.KB.ENCRYPTION.
ORACLE.SECURITY.TS.ENCRYPTION.BZuIPES7+k/tv0ZwOlDeIp4CAwAAAAAAAAAAAAAAAAAAAAAAAAAA
Dumping cert store of wallet:

There are 1 Certificate Requests in the list

Certificate request:
DN: CN=oracle
Type: NZDST_CERT_REQ
PUB key size: 2048

There are 0 Certificates in the list

There are 0 TPs in the list

okvutil upload Command

The okvutil upload command uploads the contents of the common key storage files such as Oracle wallets and Java keystores, and credential files such as files with SSH keys and Kerberos keytab.

You can upload Oracle wallets from all currently supported releases of Oracle Database that support TDE Oracle wallets. The okvutil upload command opens the wallet or Java keystore and uploads each item found as an individual security object into Oracle Key Vault. If you are uploading credential files, then Key Vault uploads them as opaque objects.

After you complete the upload operation, you can selectively add the security objects to another virtual wallet.

The full syntax for the okvutil upload command is as follows. For the short format:

okvutil upload [-o] -l location -t type [-g group] [-d description] [-v verbosity_level]

Or, for the long format:

okvutil upload [--overwrite] --location location --type type [--group group] [--description description] [--verbose verbosity_level]

In this specification:

- -o, --overwrite: If there are conflicts with the existing data in the Oracle Key Vault virtual wallet, then Key Vault replaces the existing data with new data that is sent by the endpoint. If there are no conflicts, then the overwrite operation is not necessary and is not performed. Use care if you plan to specify this option.

- -l, --location specifies the location of an Oracle wallet file or a Java keystore. For an Oracle wallet, the location is the directory that contains the .p12 or .sso files. If you are uploading a credential file as an opaque object, then ensure that this file is no larger than 120 kilobytes (KB).

- -t, --type specifies the data type of the object being uploaded to Oracle Key Vault. It must be a value from the following list:

- WALLET for an Oracle wallet

- JKS for a Java keystore

- JCEKS for a Java Cryptography Extension keystore (JCEKS)

- SSH for an SSH key file, to be uploaded as an opaque object. The maximum size is 120 KB.

- KERBEROS for a Kerberos keytab, to be uploaded as an opaque object. The maximum size is 120 KB.

- OTHER for opaque objects, which are other files that store secrets. The maximum size is 120 KB.

The WALLET, JKS, and JCEKS types contain multiple objects. Oracle Key Vault uploads each of these objects individually. The SSH, KERBEROS, and OTHER types, being opaque objects, are uploaded as single files.

This setting is not case-sensitive.

- -g, --group is the name of a Key Vault virtual wallet to which the certificate store or secret store (or both) are added. This name is case-sensitive. The virtual wallet must already exist, and the user must have authorization to access it. (To find existing virtual wallets, see "Viewing Virtual Wallets".) If you omit this setting, then the default group, if there is one, is used. If there is no default group and you omit the -g, --group option, then the data uploaded will not be placed in a group.

- -d, --description enables you to add a description, up to 2000 bytes. It is valid only if the -t type, --type parameter is set to SSH, KERBEROS, or OTHER. Optional.

- -v, --verbose: See "okvutil Utility Syntax" for more information.

- Password prompts: See "How Password Prompts for okvutil Work".

See Also:

- "Adding or Removing Items to and from Virtual Wallets"

- Oracle Database Security Guide for detailed information about the orapki utility

Example: Uploading a Java Keystore Using the -v2 Option

The okvutil upload command enables you to upload a Java keystore.

Example 8-4 shows how to use okvutil upload to upload a Java keystore. The -v 2 option enables the command to list the items that are uploaded.

Example 8-4 Uploading a Java Keystore Using the -v 2 Option

okvutil upload -l ./fin_jceks.jck -t JCEKS -g fin_wal -v 2

okvutil version 12.1.0.0.0
Configuration file: /tmp/fin_okv/conf/okvclient.ora
Server: 192.0.2.254:5696
Standby Server: 127.0.0.1:5696
Uploading from /tmp/fin_okv/keystores/jks/keystore.jks
Enter source Java keystore password:
Uploading private key
Uploading trust point
Uploading trust point
Uploading private key
Uploading private key

Uploaded 3 private keys
Uploaded 0 secret keys
Uploaded 2 trust points

Upload succeeded

The okvutil command prompts if necessary for passwords to connect to Oracle Key Vault and to open the Oracle wallet file.

Example: Uploading a Password-Protected Wallet File

The okvutil upload command enables you to upload a password-protected wallet file.

Example 8-5 shows how to upload a password-protected wallet file when there is no password for the endpoint to connect to Oracle Key Vault.

Example 8-5 Uploading a Password-Protected Wallet File

okvutil upload -l . -t WALLET -g FinanceWallet
Enter source wallet password: password

Upload succeeded

See Also:
"Uploading Oracle Wallets"

okvutil download Command

The okvutil download command takes items (Oracle wallets, Java keystores, SSH key files, Kerberos key tabs, and so on) from Oracle Key Vault.

If you download the contents of a virtual wallet, then you must download it into a keystore (that is, a container such as an Oracle wallet or a JCEKS keystore that can hold multiple security objects), and not into a credential file.

Be aware that some keystores only support the storage of certain types of security objects. If you upload a security object (for example a DSA key from a Java keystore), to Oracle Key Vault and then try to download this security object to a keystore of different type (for example, an Oracle wallet), then an error occurs to tell you that the object cannot be stored in this type of container.

To find the names of virtual wallets that are currently registered with Oracle Key Vault, see "Viewing Virtual Wallets".

The full syntax for the okvutil download command is as follows. For the short format:

okvutil download -l location -t type [-g group | -i object_id] [-o] [-v verbosity_level]

Or, for the long format:

okvutil download --location location --type type [--group group | --item object_id] [--overwrite] [--verbose verbosity_level]

In this specification:

- -l, --location specifies the directory location to store the items that you want to download. Ensure that you have permission to create wallets in this directory. Ensure that the file you download is no more than 120 KB. This setting is mandatory.

- -t, --type specifies the data type of the object being downloaded to Oracle Key Vault. It must be a value from the following list:

- WALLET for an Oracle wallet

- JKS for a Java keystore

- JCEKS for a Java Cryptography Extension keystore (JCEKS)

- SSH for an SSH key file, to be downloaded as an opaque object.

- KERBEROS for a Kerberos keytab, to be downloaded as an opaque object.

- OTHER for opaque objects, which are other files that store secrets.

The WALLET, JKS, and JCEKS types contain multiple objects. Oracle Key Vault downloads each of these objects individually. The SSH, KERBEROS, and OTHER types, being opaque objects, are downloaded as single files.

This setting is not case-sensitive. This setting is mandatory.

- -g, --group is the name of a virtual wallet from which you download an item for the WALLET, JKS, and JCEKS types. The virtual wallet must already exist, and the user must have authorization to access it. The okvutil utility downloads the entire virtual wallet specified by the -g option, and stores it in a new wallet. (To find existing virtual wallets, see "Viewing Virtual Wallets".) There must be no existing wallet at the specified location. The okvutil utility will create one. okvutil prompts you to create and enter a password for the new wallet. Record that password for the future. Remember that the group name is case-sensitive.
If the type is WALLET, JKS, or JCEKS, then you can either include or omit the group setting. If the type is SSH, KERBEROS, or OTHER, then you must include the object_id option, but not include the group setting.

- -i, --item refers to the unique ID of the object that you want to download, such as secrets (for example, -i oracle.security.client.password1 for the first secure external password store (SEPS) entry inside a wallet). You can find the available object IDs by running the okvutil list command, described in "okvutil list Command".

- -o, --overwrite downloads data into an existing WALLET, JKS, or JCEKS file specified by -l, which must exist. If a conflict arises between the data to download and the data that already exists in the container, then the new data overwrites the old data. The -o, --overwrite option does not apply to the other types (SSH, KERBEROS, and OTHER). Use care if you plan to specify this option.
If you omit the o or overwrite option when you download wallets that already exist in the current directory, then the original wallet file is renamed to either ewallet.p12.timestamp.bak or owallet.sso.timestamp.bak before the new wallet file is downloaded. For files that are not wallets (such as Java keystore files), an error appears, and you will need to rename the file or move it to a new location before performing the download.

- -v, --verbose: See "okvutil Utility Syntax" for more information.

- Password prompts: See "How Password Prompts for okvutil Work".

See Also:
"Downloading Oracle Wallets"

Example: Downloading a Virtual Wallet to a Java Keystore

The okvutil download command enables you to download a virtual wallet to a Java keystore.

Example 8-6 downloads the Key Vault virtual wallet FinanceWallet to a Java keystore.

Example 8-6 Downloading a Virtual Wallet to a Java Keystore

okvutil download -l ./fin/okv/work -t JCEKS -g FinanceWallet

Download succeeded

okvutil changepwd Command

The okvutil changepwd command enables you to change the Oracle Key Vault endpoint password. Use this command if you chose to use a password-protected wallet to store the Oracle Key Vault endpoint user credentials.

The full syntax for the okvutil changepwd command is as follows. For the short format:

okvutil changepwd -l location -t type [-v verbosity_level]

Or, for the long format:

okvutil changepwd --location location --type type [--verbose verbosity_level]

In this specification:

- -l, --location specifies the directory location of the wallet whose password you want to change.

- -t, --type specifies the data type. Enter WALLET.

- -v, --verbose: See "okvutil Utility Syntax" for more information.

- Password prompts: See "How Password Prompts for okvutil Work".

Example: Changing an Oracle Key Vault Endpoint Password

the okvutil changepwd enables you to change the password of a Key Vault endpoint.

Example 8-7 shows how to change the Oracle Key Vault endpoint password. When you are prompted to create the new password, enter a password that is between 8 and 30 characters.

Example 8-7 Changing an Oracle Key Vault Endpoint Password

okvutil changepwd -l ./home/oracle/okvutil/ssl -t WALLET
Enter wallet password: current_Key_Vault_endpoint_password
Enter new wallet password: new_Key_Vault_endpoint_password
Confirm new wallet password: new_Key_Vault_endpoint_password

9 Oracle Key Vault Use Case Scenarios

You can manage security objects using Oracle Key Vault in a variety of use case scenarios: uploading and downloading Oracle wallets, JKS keystores, JCEKS keystores, and credential files; and using TDE direct connection and TDE-configured Oracle databases.

Topics:

- Uploading and Downloading Oracle Wallets

- Uploading and Downloading JKS and JCEKS Keystores

- Uploading and Downloading Credential Files

- Using a TDE Direct Connection with Oracle Key Vault

- Using a TDE-Configured Oracle Database in an Oracle RAC Environment

- Using a TDE-Configured Oracle Database in an Oracle GoldenGate Environment

- Using a TDE-Configured Oracle Database in an Oracle Active Data Guard Environment

Uploading and Downloading Oracle Wallets

You can use the okvutil upload and okvutil download commands to upload and download Oracle wallets to and from the Oracle Key Vault server.

Topic:

- About Uploading and Downloading Oracle Wallets

- Uploading Oracle Wallets

- Downloading Oracle Wallets

- Recommendations for Uploading and Downloading Oracle Wallets

About Uploading and Downloading Oracle Wallets

As an endpoint administrator, you can upload Oracle wallet files to Oracle Key Vault for long-term retention, recovery, and sharing by using the Key Vault endpoint software, the okvutil utility.

When you upload an Oracle wallet, the Oracle Key Vault endpoint software can read each item within the wallet. It uploads the wallet contents as individual items. When downloading into a wallet on an endpoint, you can download the same set of items to recreate the original wallet or a modified set of items to create a new wallet. You can upload and download both password-based wallets and auto-login wallets. The wallet contents can be downloaded later into a new wallet of either type. For example, an uploaded password-protected wallet can be downloaded as an auto-login wallet, or an uploaded auto-login wallet can be downloaded as a password-protected wallet.

You can also use Oracle Key Vault to construct a new virtual wallet from the contents of previously uploaded Oracle wallets. For example, suppose that you previously uploaded an Oracle wallet that contains five symmetric keys and three opaque objects. You can create a new virtual wallet consisting of only three of the original five symmetric keys and one of the three original opaque objects. This virtual wallet can be downloaded like the original wallet to provide the endpoint with access to only a subset of the keys. This process does not modify the original wallet.

See Also:
"Oracle Key Vault okvutil Endpoint Utility Reference"

Uploading Oracle Wallets

The upload process, or the okvutil upload command, uploads everything in the Oracle wallet, which typically includes Oracle Advanced Security TDE master keys, wallet metadata, as well as keys or secrets that you have explicitly added.

An Oracle wallet contains security objects such as the current TDE master key, all historical TDE master keys, SSL or TLS certificates, and the metadata that is associated with these objects (stored in Oracle Key Vault as opaque objects). All of these objects, along with their metadata, are uploaded in Oracle Key Vault so that Key Vault can reconstruct the Oracle wallet during the download process.

1. Ensure that the server containing the Oracle wallet has been enrolled and provisioned as a Key Vault endpoint.
See "Adding, Deleting, or Reenrolling Endpoints" for more information.

2. Ensure that the endpoint has access to the virtual wallet that you want to use.

The endpoint must have Read, Modify, and Manage Wallet access to the virtual wallet in Oracle Key Vault.

See "Granting User and Endpoint Access to Virtual Wallets" for more information.

3. Run the okvutil upload command to upload the wallet.
For example:

okvutil upload -l "/etc/oracle/wallets" -t wallet -g "HRWallet"
Enter wallet password (<enter> for auto-login): password
Enter Oracle Key Vault endpoint password: Key_Vault_endpoint_password
Upload succeeeded

In this example:

- -l specifies the directory location of the wallet that you are uploading.

- -t indicates the type, in this case, an Oracle wallet.

- -g specifies the Key Vault virtual wallet that was configured in Step 2, so that this wallet can be part of that virtual wallet.

- Password prompts: See "How Password Prompts for okvutil Work".

At this stage, the virtual wallet in Oracle Key Vault is ready to be shared with other endpoints or ready to be downloaded. Otherwise, go to "Downloading Oracle Wallets".

See "okvutil upload Command" for more information about okvutil upload.

At this point, the upload is complete. You are now ready to share or download the wallet back to the same system or for use elsewhere in the system.

See Also:
"okvutil list Command"

Downloading Oracle Wallets

You can use the okvutil download command to download an Oracle wallet from the Oracle Key Vault server to an endpoint.

1. Ensure that the endpoint has Read access on the virtual wallet that you want to download.

See "Granting User and Endpoint Access to Virtual Wallets".

2. Run the okvutil download command to download the wallet.
For example:

okvutil download -l "/etc/oracle/wallets/orcl/ -t WALLET -g HRWallet
Enter new wallet password(<enter> for auto-login): Oracle_wallet_password
Confirm new wallet password: Oracle_wallet_password
Enter Oracle Key Vault endpoint password: Key_Vault_endpoint_password

In this example:

- -l is the location of the wallet to be created.

- -t indicates the type, in this case, an Oracle wallet.

- -g specifies the Oracle Key Vault virtual wallet that was configured in Step 1.

- Password prompts: See "How Password Prompts for okvutil Work".

If the wallet already exists and you did not use the -o parameter to overwrite the existing wallet, then the following actions take place:

- The existing wallet is renamed to a backup name of the format ewallet.p12.current_timestamp where the timestamp is number of seconds since epoch.

- The newly downloaded wallet is given the name ewallet.p12.

See "okvutil download Command" for more information about okvutil download.

3. If the Oracle wallet that you downloaded from Oracle Key Vault is to be used as a TDE wallet, then close the existing wallet before downloading and, if it is password-protected, then reopen it afterward. (Auto-login wallets are automatically opened the next time that they are accessed.)
Closing and then reopening the wallet loads the wallet contents into the TDE database.

- For Oracle Database 11g Release 2:

ALTER SYSTEM SET ENCRYPTION WALLET CLOSE IDENTIFIED BY "Oracle_wallet_password";

ALTER SYSTEM SET ENCRYPTION WALLET OPEN IDENTIFIED BY "Oracle_wallet_password";

- For Oracle Database 12c:

ADMINISTER KEY MANAGEMENT SET KEYSTORE CLOSE IDENTIFIED BY "Oracle_wallet_password";

ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "Oracle_wallet_password";

4. If you are operating in a shared server configuration such as Oracle RAC, then restart the database.

See Also:

- "okvutil download Command"

- Oracle Database Advanced Security Guide for information about closing and opening keystores in Oracle Database Release 12c

Recommendations for Uploading and Downloading Oracle Wallets

Oracle provides recommendations for when you upload and download Oracle wallets.

- If there is a change to the content of the original wallet, such as a key rotation or a rekey operation, then upload the wallet again to Oracle Key Vault so that Key Vault has the latest copy of the wallet.

- The okvutil upload and download commands provide an overwrite (-o) option. Use care if you plan to specify this option because it overwrites data in the virtual wallet that conflicts with the data to be uploaded. Before you use the -o option, you should create a local backup of the wallet file.

- Do not try to upload the same physical Oracle wallet to more than one virtual wallet on the Oracle Key Vault server. If you want to share an Oracle wallet with multiple endpoints, then create an endpoint group. See "Managing Endpoint Groups" for more information.

Uploading and Downloading JKS and JCEKS Keystores

You can use the okvutil upload and okvutil download commands to upload and download JKS and JCEKS keystores.

Topics:

- About Uploading and Downloading JKS and JCEKS Keystores

- Uploading JKS or JCEKS Keystores

- Downloading JKS or JCEKS Keystores

- Recommendations for Uploading and Downloading JKS and JCEKS Keystores

About Uploading and Downloading JKS and JCEKS Keystores

You can upload both JKS and JCEKS keystores to Oracle Key Vault for long-term retention, recovery, and sharing, and when you need them, download them to an endpoint.

Similar to wallets, when you upload a JKS or JCEKS keystore, Oracle Key Vault can read each item within the keystore. It uploads the keystore contents as individual items.

Uploading JKS or JCEKS Keystores

You can use the okvutil upload command to upload a Java keystore (JKS) or Java Cryptography Extension keystore (JCEKS) to the Oracle Key Vault server.

1. Ensure that the server containing the Java keystore has been enrolled and provisioned as a Key Vault endpoint.
See "Adding, Deleting, or Reenrolling Endpoints" for more information.

2. Ensure that access control has been configured for the endpoint.

If you are uploading the keystore to a virtual wallet, then ensure that the endpoint has the Read, Modify, and Manage Wallet access to this wallet.

See "Granting User and Endpoint Access to Virtual Wallets" for more information.

3. Run the okvutil upload command to upload the keystore.
The following examples show how to upload the keystore to a virtual wallet:

This example shows how to upload a JKS keystore:

okvutil upload -l "/etc/oracle/fin_jks.jks" -t JKS -g "FinanceGrp"
Enter source Java keystore password: Java_keystore_password
Enter Oracle Key Vault endpoint password: Key_Vault_endpoint_password
Upload succeeded

In this example:

- -l is the location of the Java keystore that is being uploaded.

- -t is the type of JKS or JCEKS keystore. Ensure that you upload the correct type of Java keystore when you upload and later on, when you download.

- -g is the virtual wallet in Oracle Key Vault where the Java keystore contents will be uploaded.

- Password prompts: See "How Password Prompts for okvutil Work".

This example shows how to upload a JCEKS keystore:

okvutil upload -l "/etc/oracle/hr_jceks.jceks" -t JCEKS -g "HRGrp"
Enter source Java keystore password: password
Enter Oracle Key Vault endpoint password: password
Upload succeeded

See "okvutil upload Command" for more information about okvutil upload.

At this point, the upload is complete. You are now ready to download the Java keystore back to the same system or for use elsewhere in the system.

Downloading JKS or JCEKS Keystores

You can use the okvutil download command to download an uploaded JKS or JCEKS keystore,

1. Ensure that the endpoint has the Read access on the virtual wallet that you want to download.
See "Granting User and Endpoint Access to Virtual Wallets".

2. As an endpoint administrator, from the command line, run the okvutil download command to download the Java keystore.
For example:

okvutil download -l "/etc/oracle/new_java_files/hr_jceks.jceks" -t JCEKS
Enter new Java keystore password: password
Confirm new Java keystore password: password
Enter Oracle Key Vault endpoint password: Key_Vault_endpoint_password

In this example:

- -l is the directory to which you want to download the uploaded Java keystore.

- -t is the type of JKS or JCEKS keystore. Ensure that you download the correct type of Java keystore.

- Password prompts: See "How Password Prompts for okvutil Work".

See "okvutil download Command" for more information about okvutil download.

Recommendations for Uploading and Downloading JKS and JCEKS Keystores

Oracle provides recommendations for when you upload and download JKS and JCEKS keystores.

- If there is a change to the content of the original JKS or JCEKS keystore, then upload the keystore again to Oracle Key Vault so that Key Vault has the latest copy of the keystore.

- The okvutil upload and download commands provide an overwrite (-o) option. Use care if you plan to specify this option because it overwrites the file. You may want to create backups of the keystores before downloading them.

- Do not try to upload the same physical JKS or JCEKS keystore to more than one virtual wallet on the Oracle Key Vault server. If you want to share a Java keystore with multiple endpoints, then create an endpoint group. See "Managing Endpoint Groups" for more information.

Uploading and Downloading Credential Files

You can use the okvutil upload and okvutil download commands to upload and download credential files.

Topics:

- About Uploading and Downloading Credential Files

- Uploading a Credential File

- Downloading a Credential File

- Recommendations for Uploading and Downloading Credential Files

About Uploading and Downloading Credential Files

You can upload credential files by storing them as opaque objects.

Examples of opaque objects are as follows:

- Files that contain X.509 certificates

- Kerberos keytabs

- Files containing passwords

- Files containing SSH keys

Uploading these credential files provides a central, secure location for long-term retention. After you have uploaded a credential file, you can retrieve or recover (download) it in the same server location or share it with other trusted server locations. Oracle Key Vault supports credential files up to 128 KB in size.

The credential file can be located anywhere in your server infrastructure (which includes database servers and application servers) that is accessible by an Oracle Key Vault endpoint. The upload process does not alter the credential file. Oracle Key Vault uploads the credential file as an opaque object and does not parse the contents of the file.

Uploading a Credential File

You can use the okvutil upload command to upload a credential file.

1. Ensure that the server that contains the credential file has been enrolled and provisioned as a Key Vault endpoint.
See "Adding, Deleting, or Reenrolling Endpoints" for more information.

2. Ensure that access control has been configured for the endpoint.

If you are uploading the credential file to a virtual wallet, then ensure that the endpoint has Read, Modify, and Manage Wallet access to the wallet.

See "Granting User and Endpoint Access to Virtual Wallets" for more information.

3. Run the okvutil upload command.
For example:

okvutil upload -l "/etc/oracle/app/creds/hr.keytab" -t kerberos -g HRWallet -d "Kerberos keytab file for HR group, 06_11_14"
Enter Oracle Key Vault endpoint password: Key_Vault_endpoint_password

In this example:

- -l is the directory path to the hr.keytab credential file that is being uploaded. Enclose the directory location in double quotation marks.

- -t specifies the type of credential file, which in this example is a Kerberos keytab file. In addition to KERBEROS, other types that you can specify are as follows:

- SSH for an SSH key file

- OTHER for other files that store secrets, such as uploaded or downloaded files

- -g adds the credential file to the HRWallet group, which already exists. This parameter enables you to upload the credential to a wallet that is specifically for the HR application users' needs, rather than to the default virtual wallet. In this example, HRWallet is the Key Vault virtual wallet to which access control was configured in Step 2.

- -d is an optional description. As a best practice, include a brief description of what the credential file is used for and the date you performed the upload. This information helps for future reference and tracking of the credential file. You can modify this description later on in the Oracle Key Vault management console if necessary.

- Password prompts: See "How Password Prompts for okvutil Work".

The following output should appear:

Upload succeeded

See "okvutil upload Command" for more information about okvutil upload.

At this point, the upload is complete. You are now ready to download the credential file back to the same system or for use elsewhere in the system.

Downloading a Credential File

You can use the okvutil download command to download a credential file.

1. Find the unique ID of the credential file that you must download, by using one of the following methods:

- Oracle Key Vault management console: Log in as a user who has been granted the Key Administrator role or a user who has the necessary access to the virtual wallet. (See "Logging In to the Oracle Key Vault Management Console.") In the Oracle Key Vault management console, from the Keys & Wallets tab, select All Items to find the uploaded files. Note the unique ID of the uploaded file that you want to download. Credential files are listed as opaque objects.

- okvutil list command: Run the okvutil list command from an endpoint that has access to the credential file or a virtual wallet that contains the credential file. Locate the unique ID of the credential file that you must download based on the description that you provided when you uploaded the file.

2. From the command line, run the okvutil download command to download the uploaded credential file.
For example:

okvutil download -l "/etc/oracle/app/newcreds/hr.keytab" -t kerberos -i 6ba7b810-9dad-11d1-80b4-00c04fd430c8
Enter Oracle Key Vault endpoint password: Key_Vault_endpoint_password

In this example:

- -l is the directory to which you want to download the uploaded credential.

- -t specifies the type of credential file, which in this example is a Kerberos keytab file. In addition to KERBEROS, other types that you can specify are as follows:

- SSH for an SSH key file

- OTHER for other files that store secrets, such as uploaded or downloaded files

- -i is the unique ID of the credential file.

Output similar to the following appears:

Download succeeded

See "okvutil download Command" for more information about okvutil download.

Recommendations for Uploading and Downloading Credential Files

Oracle provides recommendations for when you upload and download credential files.

- After you complete the upload, upload credential file again the next time it is changed. Otherwise, the uploaded (and subsequent downloaded version) file will be outdated. Periodically, you should compare the last modification date of the credential file with the timestamp of the uploaded version.

- The okvutil upload and download commands provide an overwrite (-o) option. Use care if you plan to specify this option, because it overwrites the uploaded credential file. You may want to create backups of the credential files before beginning the upload and download processes.

- You can share one credential file among multiple server endpoints. Add the opaque object to a virtual wallet and then ensure that all of the endpoints have access to that virtual wallet. Optionally, define an endpoint group and then make all the server endpoints members of that group. Upload the credential file that you would like to share using this common wallet into Oracle Key Vault as a group, using the -g option of the okvutil upload command. Define a wallet and attach it to the endpoint group. All the members of the group will have access to that wallet.

Using a TDE Direct Connection with Oracle Key Vault

You can configure Transparent Data Encryption (TDE) to perform a direct connection to an endpoint to centrally manage TDE master keys.

Topics:

- About Using a TDE Direct Connection with Oracle Key Vault

- Other Oracle Database Features That Oracle Key Vault Supports

- Configuring a Connection Between Oracle Key Vault and a New TDE-Enabled Database

- Migrating Existing TDE Wallets to Oracle Key Vault

About Using a TDE Direct Connection with Oracle Key Vault

For Oracle Database 11g Release 2 (11.2) and later, you can use a TDE direct connection to centrally manage Transparent Data Encryption (TDE) master keys over a network connection as an alternative to using local Oracle wallet files.

The connection configuration entails using a PKCS#11 library to connect to Oracle Key Vault. After you perform the configuration, all future TDE master keys will be stored and managed in Oracle Key Vault. This section explains two scenarios that you can use:

- If the database does not yet have TDE wallets, then follow the procedure under "Configuring a Connection Between Oracle Key Vault and a New TDE-Enabled Database".

- If the database has already been configured for TDE, then you must migrate the existing wallet file. See "Migrating Existing TDE Wallets to Oracle Key Vault".

TDE key management operates with Oracle Key Vault in the same way that it operates with hardware security modules (HSMs). You must open the wallet before encryption and decryption. After you close the wallet, encrypted data in tables and tablespace is unavailable to you. You should rotate the TDE master encryption key regularly to remain in compliance with the applicable regulations.

Oracle Key Vault supports the SQL statements that were used to administer earlier TDE releases, specifically the use of the ALTER SYSTEM and ADMINISTER KEY MANAGEMENT SQL statements.

See Also:
"Centralizing Management for a TDE Direct Connection of TDE Master Keys"

Other Oracle Database Features That Oracle Key Vault Supports

You can deploy TDE in multiple topologies with other database features that move or use clustered deployments.

Data movement and replication are major challenges for Oracle Advanced Security TDE because it must keep the master encryption key synchronized at both endpoints. To help with these challenges, Oracle Key Vault supports common Oracle Database features.

To move data, Oracle Key Vault supports:

- Oracle Recovery Manager (RMAN) backup and recovery operations

- Oracle Data Pump

- Transportable tablespaces (Oracle Database 12c and later)

For clustered deployments, Oracle Key Vault supports:

- Oracle Active Data Guard

- Oracle Real Application Clusters (Oracle RAC)

- Oracle GoldenGate

Configuring a Connection Between Oracle Key Vault and a New TDE-Enabled Database

You can configure a connection between Oracle Key Vault and a database that has not yet been configured for Transparent Data Encryption.

1. Ensure that the ORACLE_BASE environment variable is set before you start the oracle process manually.
Alternatively, create a soft link from the $ORACLE_BASE/okv/$ORACLE_SID/okvclient.ora file to the key_vault_endpoint_installation_dir/conf/okvclient.ora file. In an Oracle Real Application Clusters environment, perform this step on all database instances.

2. Ensure that the COMPATIBILITY initialization parameter is set to 11.2.0.0 or later.
See "Endpoint Database Requirements" for more information.

3. Enroll and provision the endpoint for the TDE-enabled database that contains the TDE data.
When you initially enroll the endpoint, you must use Oracle Database for the endpoint type, for integration with TDE. See Step 4 in "Adding, Deleting, or Reenrolling Endpoints". See "Adding, Deleting, or Reenrolling Endpoints" for more information.

4. Ensure that the endpoint has access to the virtual wallet that you want to use.
The endpoint must have the Read, Modify, and Manage Wallet access.

See "Granting User and Endpoint Access to Virtual Wallets" for more information.

5. Configure the sqlnet.ora file on this database to point to Oracle Key Vault, as follows:

ENCRYPTION_WALLET_LOCATION=(SOURCE=(METHOD=HSM))

Transparent Data Encryption uses HSM as the parameter value for all external key management systems, including Oracle Key Vault.

By default, the sqlnet.ora file is located in the ORACLE_HOME/network/admin directory or in the location set by the TNS_ADMIN environment variable. Endpoints use PKCS#11 library support to manage TDE master encryption keys. So, the configuration settings and the administrative commands are similar to those used for an HSM.

Important: At this stage, Oracle Key Vault can use TDE and all the TDE-related SQL statements are available. For all TDE commands and statements, use the Key Vault endpoint password that was specified during the endpoint enrollment process, under "Task 2: Install the Oracle Key Vault Client Software on the Endpoint".

6. Reconnect to the database if you are in SQL*Plus.
The changes will appear after you log out of the current SQL*Plus session and then reconnect again.

7. Query the V$ENCRYPTION_WALLET dynamic view to ensure that the METHOD_DATA setting in the sqlnet.ora file changed.
The output of the query should now show HSM.

SELECT * FROM V$ENCRYPTION_WALLET;

8. Configure TDE to integrate with Key Vault so that Key Vault can directly manage the TDE master keys.
In brief, you must do the following:

1. Run the root.sh script as the root user to copy the liborapkcs.so file (located in the lib directory) to the /opt/oracle/extapi/64/hsm/oracle/1.0.0 directory.
See Step 6 under "Task 2: Install the Oracle Key Vault Client Software on the Endpoint" for more information.

2. For password-protected wallets on the database, open the wallet. (Auto-login wallets are automatically opened.)
For Oracle Database 11g Release 2, as a user who has been granted the ALTER SYSTEM system privilege:

ALTER SYSTEM SET ENCRYPTION WALLET OPEN IDENTIFIED BY "Key_Vault_endpoint_password";

For Oracle Database 12c, as a user who has been granted the SYSKM administrative privilege:

ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "Key_Vault_endpoint_password";

3. Set the master encryption key.
For Oracle Database 11g Release 2:

ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "Key_Vault_endpoint_password";

For Oracle Database 12c:

ADMINISTER KEY MANAGEMENT SET ENCRYPTION KEY IDENTIFIED BY "Key_Vault_endpoint_password";

At this stage the configuration is complete. If you have configured the sqlnet.ora file correctly and completed the other configuration required for TDE, then when you set the encryption key (using either ALTER SYSTEM SET ENCRYPTION KEY or ADMINISTER KEY MANAGEMENT SET ENCRYPTION KEY), a TDE master key is created in Oracle Key Vault. You can encrypt tables or create encrypted tablespaces in the database.

See Also:
Oracle Database Advanced Security Guide for detailed information about encrypting tables and tablespaces

Migrating Existing TDE Wallets to Oracle Key Vault

You can migrate an existing TDE wallet to Oracle Key Vault, and if necessary, restore the database contents that were previously encrypted by TDE by using an Oracle wallet.

Topics:

- About Migrating Existing TDE Wallets to Oracle Key Vault

- Migrating an Existing TDE Wallet to Oracle Key Vault

- Restoring Database Contents Previously Encrypted by TDE Using an Oracle Wallet

About Migrating Existing TDE Wallets to Oracle Key Vault

When the TDE wallets already exist, you must modify the sqlnet.ora file to recognize Oracle Key Vault before you can migrate the existing TDE wallets to Key Vault.

Along with the current TDE master key, Oracle wallets maintain historical TDE master keys that are replaced by each rekey operation that rotates the TDE master key. These historical TDE master keys help to restore Oracle Database backups that were previously made using one of the historical TDE master keys. During the TDE migration from an Oracle wallet file to Oracle Key Vault, Key Vault generates new master keys. After this master key generation, Oracle Key Vault maintains all new keys.

Oracle recommends that you upload the Oracle wallet to Key Vault before you perform the migration. This enables you to keep a backup of the wallet with all of the historical key information before you begin the migration. (If any of the previously encrypted data backups must be restored, see "Restoring Database Contents Previously Encrypted by TDE Using an Oracle Wallet"). When the migration is complete, manually delete the old wallet on the client system.

If you are operating in a shared server or an Oracle RAC configuration, then you must restart the database so that the new TDE master key is updated to all the endpoint database nodes in the shared server configuration.

Migrating an Existing TDE Wallet to Oracle Key Vault

You can use the okvutil upload command to migrate an existing TDE wallet to Oracle Key Vault. It is very important that you close the software wallet and open the HSM wallet before migrating the wallet in the same SQLPLUS session, as outlined in steps 7 and 8 below:

1. Back up the database that contains the data that you want to migrate.
See Oracle Database Backup and Recovery User's Guide for more information about backing up a database.

2. Complete the enrollment of the endpoint.
See "Overview of Endpoint Enrollment and Provisioning" for more information about enrolling endpoints.

3. If you have not done so already, then upload the existing Oracle wallet to Key Vault, by using the okvutil upload command.
This step ensures that Oracle Key Vault has a copy of the wallet that contains all of the historical TDE master keys.

See "okvutil upload Command" for more information about this command.

4. Configure the Oracle Database sqlnet.ora file for the HSM as follows:

ENCRYPTION_WALLET_LOCATION=(SOURCE=(METHOD=HSM)(METHOD_DATA=(DIRECTORY=wallet_location)))

By default, the sqlnet.ora file is located in the ORACLE_HOME/network/admin directory or in the location set by the TNS_ADMIN environment variable.

5. Reconnect to the database if you are in SQL*Plus.
The changes do not appear until you restart the database session.

6. Query the V$ENCRYPTION_WALLET dynamic view to ensure that the METHOD_DATA setting in the sqlnet.ora file changed. The output of the query should now show METHOD=HSM.

SELECT * FROM V$ENCRYPTION_WALLET;

7. If the endpoint is a Release 11gR2 Oracle database, then close the local Oracle wallet and open the HSM wallet.
Close the local Oracle wallet:

1. If the auto-login wallet is open, execute the following commands:

oracle$ cd <wallet location>
oracle$ mv cwallet.sso cwallet.sso.bak
sqlplus> alter system set wallet close;

2. If the password-protected wallet is open, execute the following command:

sqlplus> alter system set wallet close identified by "<wallet password>";

Open the HSM wallet:

sqlplus> alter system set wallet open identified by "<HSM connect string>";

8. Migrate from TDE wallets to Oracle Key Vault.

- For Oracle Database 11g Release 2:
If you entered a password for the wallet while installing the endpoint client software, then execute this command:

sqlplus> alter system set encryption key identified by "<endpoint password>" migrate using "<wallet password>";

If you chose the auto-login option while installing the endpoint client software, then execute this command:

sqlplus> alter system set encryption key identified by "null" migrate using  "<wallet password>";

- For Oracle Database 12c, as a user who has been granted the SYSKM administrative privilege:

sqlplus> administer key management set encryption key identified by "<endpoint password>" MIGRATE USING "<wallet password>" with backup;

Note:
While the with backup clause is required for the administer key management command, it is ignored by TDE in Oracle Key Vault.

9. Open the wallet. If the endpoint requires a password to connect to Oracle Key Vault, then enter the password.

- For Oracle Database 11g Release 2:

ALTER SYSTEM SET ENCRYPTION WALLET OPEN IDENTIFIED BY "Key_Vault_endpoint_password";

- For Oracle Database 12c:

ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "Key_Vault_endpoint_password";

10. After you complete the migration, if you are using an auto-login wallet, then re-enable it by renaming the cwallet.sso.bak file to cwallet.sso.

Restoring Database Contents Previously Encrypted by TDE Using an Oracle Wallet

When an Oracle database endpoint is converted from a local Oracle wallet file to using Oracle Key Vault, there may be a subsequent need to restore backups that were encrypted using a key from this local wallet file.

In this case, you must download the necessary key from Oracle Key Vault to a local wallet file to be used when you decrypt the backup during the restore process. For example, suppose that the Finance_DB database had recently migrated to use a TDE direct connection to Oracle Key Vault after you have uploaded the premigration wallet. If a system failure forces you to restore from a database backup taken before the migration to Oracle Key Vault, you can still restore the contents of the database by using an Oracle wallet downloaded from the Oracle virtual wallet that contains the Finance_DB wallet data that you had uploaded earlier.

To restore previously TDE-encrypted database contents using an Oracle wallet:

1. Download this Oracle wallet from Oracle Key Vault by using the okvutil download command.

See "okvutil download Command" for more information.

2. On the endpoint where you downloaded the Oracle wallet, add the following settings to the sqlnet.ora file.

METHOD_DATA=wallet_file_path

METHOD=FILE
ENCRYPTION_WALLET_LOCATION=(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=wallet_file_path)))

Put the ENCRYPTION_WALLET_LOCATION setting on one line.

3. If you created a password-protected wallet in Step 1, then open the wallet using the password you specified.

- For Oracle Database 11g Release 2, as a user who has been granted the ALTER SYSTEM system privilege:

ALTER SYSTEM SET ENCRYPTION WALLET OPEN IDENTIFIED BY "wallet_password";

- For Oracle Database 12c, as a user who has been granted the SYSKM administrative privilege:

ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "wallet_password";

Opening the wallet enables the server to read the contents of the updated sqlnet.ora file. At this point, the endpoint server has been restored to a state where it now can run with the original version of the wallet.

Using a TDE-Configured Oracle Database in an Oracle RAC Environment

In a TDE-configured Oracle database, if you upload Oracle wallets in an Oracle Real Application Clusters (Oracle RAC) environment, then the nodes within the cluster must share a virtual wallet.

You can enable the cluster to share the virtual wallet by using either of the following approaches:

- Define a virtual wallet as a shared default wallet for all of the nodes in the cluster.

- If each node in the cluster has a separate default wallet, then grant each node access to every other node's default wallet to have the same effect. An endpoint group may be used to simplify the process of granting each node access to the default wallets of the other nodes.
The advantage of this approach over the first is that if you had several nodes that already had default wallets and you wanted them to share wallets, then you would not have to reassign their default wallets. This is particularly important because in the first approach, in order to reassign an endpoint's default wallet, you must reenroll the endpoint. An endpoint group can be used to simplify the process of granting each node access to the default virtual wallets of the other nodes.

As with single-instance database environments, after you download a password-protected wallet, you must manually open it. If you have one wallet on the primary node and then download the wallet to the other nodes, you must explicitly open the wallets on each of these nodes.

Using a TDE-Configured Oracle Database in an Oracle GoldenGate Environment

You can migrate Oracle wallets that contain Oracle GoldenGate shared secrets and TDE master keys to the Oracle Key Vault server.

Topics:

- About Uploading Oracle Wallets in an Oracle GoldenGate Environment

- Using a TDE Direct Connection in an Oracle GoldenGate Deployment

- Migrating TDE Wallets on an Oracle GoldenGate Deployment to Oracle Key Vault

About Uploading Oracle Wallets in an Oracle GoldenGate Environment

In an environment where Oracle Key Vault is not used and an Oracle TDE-enabled database is configured with an Oracle wallet with Oracle GoldenGate, this database (called the source database) stores an Oracle GoldenGate shared secret in the same Oracle wallet where master keys are stored.

Hence, when you configure the source database as an Oracle Key Vault endpoint, the Oracle GoldenGate shared secret is stored in Oracle Key Vault in the same virtual wallet where the master keys are stored for the TDE-enabled source database.

When you migrate an Oracle wallet that contains an Oracle GoldenGate shared secret and TDE master keys to Oracle Key Vault using the okvutil command-line utility, the default wallet for the TDE-enabled source database now stores the entire Oracle wallet migrated with shared secret and master keys.

In addition, if the configured target database is an Oracle database, then you must ensure that this target database is TDE-enabled so that all the TDE commands can be replicated. Note that the two Oracle TDE-enabled databases, source and target, do not need to have the same master key in the Oracle wallet. If you configure this target database as a new Key Vault endpoint, then you can upload and download wallets to and from Oracle Key Vault as you normally would with any independent Key Vault endpoint. No additional configuration is necessary.

Using a TDE Direct Connection in an Oracle GoldenGate Deployment

To use a TDE direct connection in an Oracle GoldenGate deployment, you must perform two configuration steps.

1. Configure a connection between the source database in the GoldenGate deployment and Oracle Key Vault by following the steps in "Configuring a Connection Between Oracle Key Vault and a New TDE-Enabled Database".

2. Configure the storage of Oracle GoldenGate secrets in the Oracle wallet on the source database.
See Oracle Database Advanced Security Guide for more information.

At this stage, the configuration is complete. If you have configured the sqlnet.ora file correctly and completed the other configuration required for TDE on the source database, then when you set the encryption key (using either ALTER SYSTEM SET ENCRYPTION KEY or ADMINISTER KEY MANAGEMENT SET ENCRYPTION KEY), a TDE master key is created in Oracle Key Vault. You can encrypt tables or create encrypted tablespaces in the database. The encrypted data created in the source database continues to be replicated on the target database after this procedure is performed. The other Oracle GoldenGate shared secrets are stored in Oracle Key Vault.

Migrating TDE Wallets on an Oracle GoldenGate Deployment to Oracle Key Vault

In an Oracle GoldenGate environment with a TDE-configured database, an Oracle wallet contains both the TDE master keys and the Oracle GoldenGate shared secret.

The migration of this Oracle wallet to Oracle Key Vault is similar to the procedure that you follow for "Migrating Existing TDE Wallets to Oracle Key Vault"."

Note that target databases (if they are Oracle TDE-enabled databases) that are used in this Oracle GoldenGate environment can also be configured to use Oracle Key Vault or continue to use Oracle wallet. You should treat these databases as you would any standalone TDE database endpoint. Therefore, you should follow the procedure in "Migrating Existing TDE Wallets to Oracle Key Vault" to migrate this type of wallet.

After you complete this migration, the configuration is complete. If you have configured the sqlnet.ora file correctly and completed the other configuration required for TDE, then when you set the encryption key (using either ALTER SYSTEM SET ENCRYPTION KEY or ADMINISTER KEY MANAGEMENT SET ENCRYPTION KEY), a TDE master key is created in Oracle Key Vault. You can continue to create and use encrypted tables or tablespaces in the database. The encrypted data created in the source database continues to be replicated on the target database after this procedure is performed.

Using a TDE-Configured Oracle Database in an Oracle Active Data Guard Environment

You can perform the following activities in an Oracle Active Data Guard environment: upload Oracle wallets to an Oracle Key Vault server, use TDE direct connections, migrate wallets between endpoints, and migrate and check TDE wallets for a logical standby database.

Topics:

- About Uploading Oracle Wallets in an Oracle Active Data Guard Environment

- Uploading Oracle Wallets in an Oracle Active Data Guard Environment

- Performing a TDE Direct Connection in an Oracle Active Data Guard Environment

- Migrating Oracle Wallets in an Oracle Active Data Guard Environment

- Migrating an Oracle TDE Wallet to Oracle Key Vault for a Logical Standby Database

- Checking the Oracle TDE Wallet Migration for a Logical Standby Database

About Uploading Oracle Wallets in an Oracle Active Data Guard Environment

In an Oracle Active Data Guard environment with a TDE-enabled primary and a standby database using an Oracle wallet, you must physically copy the Oracle wallet file from the primary database to the standby after the initial TDE configuration and later, whenever you rekey the master key on the primary database.

Whereas, when using Oracle Key Vault with a TDE-enabled Active Data Guard database, the primary and standby databases must be registered in Oracle Key Vault as endpoints. You must ensure that the endpoints that are registered for both the primary and standby databases have same default virtual wallet in Oracle Key Vault.

This way, the two databases can achieve centralized key and wallet management without the need of a manual copy of the wallet file from the primary database to the standby database.

Uploading Oracle Wallets in an Oracle Active Data Guard Environment

You can upload an Oracle wallet to an Active Data Guard environment.

1. Register one endpoint each for the primary and standby databases.
See "Adding, Deleting, or Reenrolling Endpoints".

2. Download the okvclient.jar file for each endpoint on the respective databases.
See "Task 2: Install the Oracle Key Vault Client Software on the Endpoint".

3. Ensure that the endpoint password is the same as the TDE wallet password if you must perform a migration or a reverse migration.

4. Ensure that both the primary and standby database endpoints use the same default virtual wallet.

Performing a TDE Direct Connection in an Oracle Active Data Guard Environment

The procedure for performing a TDE direct connection in an Oracle Active Data Guard environment is the same as in a standard Oracle Database environment.

See "About Using a TDE Direct Connection with Oracle Key Vault" for more information.

Migrating Oracle Wallets in an Oracle Active Data Guard Environment

You can migrate an Oracle wallet in an Oracle Active Data Guard environment.

1. Use the okvutil upload command to upload the contents of the local Oracle wallet that is on the primary database to Oracle Key Vault.
See "okvutil upload Command".

2. Perform the migration steps as described in "Migrating Existing TDE Wallets to Oracle Key Vault".

3. Close the existing Oracle wallet on the standby database.

- For Oracle Database 11g Release 2, as a user who has been granted the ALTER SYSTEM system privilege:

ALTER SYSTEM SET ENCRYPTION WALLET CLOSE IDENTIFIED BY "Key_Vault_endpoint_password";

- For Oracle Database 12c, as a user who has been granted the SYSKM administrative privilege:

ADMINISTER KEY MANAGEMENT SET KEYSTORE CLOSE IDENTIFIED BY "Key_Vault_endpoint_password";

4. Shut down the standby database.
For example:

SHUTDOWN IMMEDIATE

5. Restart the standby database.
For example:

STARTUP

6. Open the Oracle wallet.

- For Oracle Database 11g Release 2, as a user who has been granted the ALTER SYSTEM system privilege:

ALTER SYSTEM SET ENCRYPTION WALLET OPEN IDENTIFIED BY "Key_Vault_endpoint_password";

- For Oracle Database 12c, as a user who has been granted the SYSKM administrative privilege:

ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "Key_Vault_endpoint_password";

7. Start the apply process on the standby database.
See Oracle Data Guard Concepts and Administration for information about starting the apply process on the standby database.

Migrating an Oracle TDE Wallet to Oracle Key Vault for a Logical Standby Database

If you have a logical standby database configured and are using Oracle Database Release 12c, then you can migrate a TDE wallet to Oracle Key Vault.

1. Register the primary and standby endpoints to have the same default virtual wallet.
See "Managing Endpoint Groups".

2. If necessary, download and install the okvclient.jar file to each endpoint.
See "Finalizing Enrollment and Provisioning".

3. Perform the migration on the primary database.
See "Migrating an Existing TDE Wallet to Oracle Key Vault".

4. Complete the SQL Apply process on the logical standby and then restart the standby database.
See Oracle Data Guard Concepts and Administration for more information about the SQL Apply process.

5. To check that the status the that migration was successful, query the V$ENCRYPTION_WALLET dynamic view.
See "Checking the Oracle TDE Wallet Migration for a Logical Standby Database".

Checking the Oracle TDE Wallet Migration for a Logical Standby Database

In an Oracle Database Release 12c environment, after you have migrated an Oracle TDE wallet in a logical standby configuration, you can check the configuration by querying the WRL_TYPE and WALLET_ORDER columns of the V$ENCRYPTION_WALLET dynamic view.

By querying the V$ENCRYPTION_WALLET view, you can track the primary keystore. If you have only a single wallet configured, then the WALLET_ORDER column is set to SINGLE. In a two-wallet or mixed configuration, the column is set to PRIMARY or SECONDARY, depending on where the active master key is located. Consider the following queries.

In the following query, only a single wallet is configured:

SELECT WRL_TYPE, WALLET_ORDER FROM V$ENCRYPTION_WALLET;

WRL_TYPE             WALLET_OR
-------------------- ---------
FILE                 SINGLE

In this query in a logical standby configuration, the active master key has been migrated to an Oracle Key Vault virtual wallet:

SELECT WRL_TYPE, WALLET_ORDER FROM V$ENCRYPTION_WALLET;

WRL_TYPE             WALLET_OR
-------------------- ---------
FILE                 SECONDARY
HSM                  PRIMARY

This query should show the HSM as the PRIMARY wallet in both the primary and standby database for the logical configuration.

10 General Oracle Key Vault Management

You can administer Oracle Key Vault by configuring the types of alerts, audits, and reports that users may view to check system status.

Topics:

- About General Management of Oracle Key Vault

- Oracle Key Vault Alert Configuration

- Oracle Key Vault Auditing

- Viewing Oracle Key Vault Reports

- Viewing Oracle Key Vault Status on the Dashboard

- Oracle Key Vault System Administration

About General Management of Oracle Key Vault

You must be an administrative user with the System Administrator or Audit Manager role to perform general management tasks on Key Vault.

See Also:

Related management topics:

Managing Oracle Key Vault Users

Managing Oracle Key Vault Endpoints

Managing Oracle Key Vault Virtual Wallets and Security Objects

Oracle Key Vault Alert Configuration

You can configure alerts to other administrators for activities such as key rotation, expiration dates for endpoint certifications, and so on.

Topics:

- About Configuring Alerts

- Configuring the Alerts That Appear in the Oracle Key Vault Dashboard

- Viewing Open Alerts

About Configuring Alerts

Administrators who have been granted the System Administrator role can configure alerts.

Oracle Key Vault provides alerts for key rotation, expiration dates for endpoint certifications and user passwords, maximum amount of allowed disk space, time in days for backup operations to be performed, and whether to be notified if system backup operations fail. Users with the System Administrator role can configure these alerts, but all users can view the open alerts.

See Also:
"Creating Oracle Key Vault Users" for information about how to configure users to receive alerts

Configuring the Alerts That Appear in the Oracle Key Vault Dashboard

You can customize the alerts that appear in the Oracle Key Vault Dashboard by alert type, and enable and disable them.

See "Viewing Oracle Key Vault Status on the Dashboard".

You can limit the alerts by various numerical criteria.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.

2. Select the Reports tab.

3. Select Configure Alerts.
The Configure Reports page appears.

4. Enable or disable individual alerts as needed and set the threshold values for when the alert is raised.

5. Click Save.

Viewing Open Alerts

All users can view open alerts that relate to objects they can access. Users with the System Administrator role also see alerts that relate to the Oracle Key Vault appliance, such as those about the status of backups.

- To access open alerts, from the Oracle Key Vault management console, select the Reports tab and then select Alerts. This table lists all alerts that have not been resolved.

Alerts are removed automatically when you resolve the issue, but they cannot be explicitly deleted.

Oracle Key Vault Auditing

Oracle Key Vault automatically audits activities that user perform in the Key Vault system. You can find audit reports of these activities, and if necessary, you can export and delete Key Vault audit records.

Topics:

- About Auditing in Oracle Key Vault

- How Oracle Key Vault Audit Record Export and Deletion Operations Work

- Exporting and Deleting Oracle Key Vault Audit Records

About Auditing in Oracle Key Vault

All operations relating to items, wallets, endpoints, endpoint groups, users, and user groups are audited in Oracle Key Vault. This includes the creation, modification, or deletion of any of these entities or their attributes. Oracle Key Vault also audits the creation and modification of SNMP credentials.

You can find reports that describe these activities by selecting Audit Report in the Audit tab of the Oracle Key Vault management console. If an action fails, then the Result column shows an error code.

You cannot explicitly disable auditing.

You can review the audit reports that pertain to the security objects you have access to, and the Audit Manager can see audit records for all objects. If you are logged in with the Audit Manager role, then you can export or delete a range of audit records, specified by a start and end time, from the audit report.

See Also:
"Overview of Administrative Roles" for details about the Audit Manager privileges

How Oracle Key Vault Audit Record Export and Deletion Operations Work

Only a user who has been granted the Audit Manager role can export or delete audit records.

Other users cannot export or delete audit records. Each time you perform an export operation, Oracle Key Vault creates a .csv file that contains the audit records. You can export a range of audit records and delete a range of audit records. Or, you may want to archive this information for use in audit screenings. After you export the audit records, you may want to delete them from the management console. When you export a set of audit records, the timestamp for the audit records within the .csv file is in the time zone of the management console where you exported the audit records.

Exporting and Deleting Oracle Key Vault Audit Records

You can export or delete Oracle Key Vault audit records.

1. Log in to the Oracle Key Vault management console as a user who has the Audit Manager role.
See "Logging In to the Oracle Key Vault Management Console."

2. Select the Reports tab.

3. Click Export/Delete.

4. Determine the date up to which you want to perform the action. Click the calendar icon and select the date.

5. Click Export, Delete, or Cancel.
A message appears, indicating success or failure.

Viewing Oracle Key Vault Reports

All users can access the Oracle Key Vault reports but only the Audit Manager can perform management tasks.

Topics:

- About Oracle Key Vault Reports

- Accessing the Oracle Key Vault Management Reports

About Oracle Key Vault Reports

Oracle Key Vault provides two types of reports, one for the audit trail and the other for management activities.

- Audit Trail report: This report indicates actions that users have performed. It covers the time the operation took place, who performed it, what the operation was, the object affected (such as a user group, single security object, or virtual wallet), and the result of the operation, which could be a check for success and an error code for failure. All users can view the audit reports, but only the Audit Manager can export and delete the audit records in this report.

- Management reports: These reports provide information about wallet access, key deactivation or expiration, endpoint certificate expiration, and the user password expiration date. The Key Administrator and the Audit Manager can view the management reports.

To access the reports, from the Oracle Key Vault management console, select the Reports tab.

The Reports page appears. By default, the Audit Trail report appears.

Figure 10-1 shows the Audit Trail reports page.

Figure 10-1 Oracle Key Vault Audit Trail Reports Page

See Also:
"Oracle Key Vault Auditing" for more information about the report

Accessing the Oracle Key Vault Management Reports

The Management Reports page provides detailed information about the expiration dates for keys, endpoint certificates, and user passwords. Only the Key Administrator and the Audit Manager can view the management reports.

- To access the Managements report, select the Reports tab, and then select Management Reports.

Figure 10-2 shows the Management Reports page.

Figure 10-2 Oracle Key Vault Management Reports Page

Viewing Oracle Key Vault Status on the Dashboard

With the dashboard on the Home tab, you can view the current status of the Oracle Key Vault appliance at a high level.

The Home tab is visible to all users. It is a complete scrollable page, displayed here in two screenshots, Figure 10-3 and Figure 10-4, followed by descriptions of the various status panes.

Figure 10-3 shows the Alerts and Managed Content panes of the Home page.

Figure 10-3 Alerts and Managed Content Panes

Figure 10-4 shows the Data Interval, Operations, Endpoint Activity, and User Activity panes of the Home page.

Figure 10-4 Data Interval, Operations, Endpoint Activity, and User Activity Panes

Status Panes in the Dashboard

Oracle Key Vault provides a set of status panes on the dashboard. These status panes provide useful information for alerts, managed content, data intervals, operations, endpoint activities, and user activities.

See Figure 10-3 and Figure 10-4 to see the status panes.

The status panes are as follows:

- Alert status
You can list all alerts generated. For any alert, you can click the link in the Details column, which takes you to a related details or information page.

Click All Alerts to go to the Alerts page of the Reports tab, described in "Viewing Open Alerts".

From the Reports tab, you can configure how details about alerts appear on the dashboard. See "Configuring the Alerts That Appear in the Oracle Key Vault Dashboard".

- Managed Content status
The Managed Content pane of the dashboard displays tables with aggregated information about all the security objects currently stored and managed in Oracle Key Vault.

This status pane categorizes the aggregate information based on the item type such as keys, certificates, opaque objects, private keys, and TDE master keys, as well as the item state such as pre-active, active, and deactivated.

See Also:
"Searching for Security Object Items" for details of Item Types and Item States

In the Managed Content pane, the item type and item state are displayed at the last time refreshed, which is set by the refresh interval described in the Data Interval status pane.

- Data Interval status
This pane shows the length of the time period.

This time period can be Last 24 hours, Last week, or Last Month, or a user-defined date range. It also shows the refresh interval for the Operations, Endpoint Activity, and User Activity sections described later.

- Operations status
The Operations pane contains a bar graph with bars for key-related operations such as locate, activate, add endpoint, and assign default wallet.

- Endpoint Activity status
The Endpoint Activity pane contains a bar graph for tracking the number of operations performed by each endpoint.

- User Activity status
The User Activity pane contains a three-dimensional bar graph for tracking the number of operations performed by each user.

Oracle Key Vault System Administration

Users who have been granted the System Administrator role can configure appliance settings and perform operational tasks such as initiating backup or recovery, and configuring high availability, network, and service settings.

Topics:

- Viewing Oracle Key Vault Status

- Setting the Oracle Key Vault Configurations

- System Recovery

- Changing the Recovery Passphrase

Viewing Oracle Key Vault Status

The Oracle Key Vault Status page displays status information, but does not allow for any activities or changes.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role. See "Logging In to the Oracle Key Vault Management Console."

2. Select System and then Status.

The status information is as follows:

- Version

- Uptime

- High Availability Status

- Backup Status

- Free and used disk space

Setting the Oracle Key Vault Configurations

By using the Settings menu, under the System tab, a user who has been granted the System Administrator role can reboot or turn off Oracle Key Vault and also set other aspects of the system.

Topics:

- Settings for Configurations Page

- Enabling SSH Access

Settings for Configurations Page

The Settings page shows configurations such as the system time, syslog settings, network (such as IP addresses), DNS server information, and network services locations.

Figure 10-5 shows the Settings page.

Figure 10-5 Settings Page for Oracle Key Vault Configurations

These panes are as follows:

- System Time pane
The System Time pane enables you to configure Oracle Key Vault to use an NTP server to remain synchronized with the current time. If an NTP server is not available, then you can set the current time manually. When you use a manual time setting, ensure that the primary and standby Key Vault servers are set to the same time.

- Syslog Configuration
In the Syslog Configuration pane, you set the destination computer for syslog files, and indicate whether they are sent to this computer using a Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) connection.

- Network pane
In the Network pane, you set the network address of the Oracle Key Vault installation.

- DNS pane
Use the DNS pane to configure the servers to use for Domain Name Service (DNS), converting host names to IP addresses.

- Network Services page
Your settings in the Network Services pane control whether each service (Web Access, SSH Access, and SNMP Access) is enabled for all clients, none, or specific IP addresses provided in a space-separated list. For example, if web access is enabled for only specific IP addresses, then only web browsers from those IP addresses can access the Oracle Key Vault management console.

Note:
Oracle strongly recommends that you enable SSH access for a short duration when command-line access is needed and disable SSH access as soon as the diagnostics function is completed.

If you are using the Bash shell, you may need to download patch sets or security fixes that work with SSH Access. Instructions on downloading and enabling patch sets or security fixes come with the patch set release notes.

Enabling SSH Access

You can enable SSH access to log in as a support user for diagnostics purposes.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
See "Logging In to the Oracle Key Vault Management Console."

2. In Network Services section, click SSH Access, and Save.

System Recovery

Oracle Key Vault provides system recovery functionality for emergencies.

This section contains:

- About System Recovery

- Performing System Recovery

About System Recovery

In an emergency when no administrators can log in to Oracle Key Vault, or if you need to change the passwords of an administrator who is unavailable, you can use the special recovery passphrase that was created during Oracle Key Vault installation and configuration.

When there are administrative roles that no user can access, the recovery passphrase enables a user to go to the System Recovery pane of the Post-Install Configuration page and assign each role to a new or existing user account.

See Also:
"Task 2: Perform Postinstallation Tasks"

Performing System Recovery

You can perform the system recovery procedure from the login page of the Oracle Key Vault management console.

1. Go to the login page, but do not log in.

2. In the lower-right corner of the login screen, click the System Recovery link shown in "Logging In to the Oracle Key Vault Management Console."

3. Enter the recovery passphrase in the field provided and press Enter.
The System Recovery pane of the Post-Install Configuration page appears. See Step 4, "Task 2: Perform Postinstallation Tasks".

4. Fill out the fields for the Key Administrator, System Administrator, and Audit Manager to assign these roles to new or existing user accounts.

5. Click Save.

Changing the Recovery Passphrase

Oracle highly recommends that a user with the System Administrator role perform a new backup whenever the recovery passphrase changes. It is important that there is always a copy of the backup that is protected by the current recovery passphrase.

1. Go to the login page, but do not log in.

2. Click the System Recovery link shown in "Logging In to the Oracle Key Vault Management Console."

3. Enter the recovery passphrase in the field provided and press Enter.
The System Recovery pane of the Post-Install Configuration page appears.

4. Fill out the fields for the recovery passphrase.

5. Click Save.

A Troubleshooting Oracle Key Vault

Oracle provides troubleshooting advice for common errors that may arise.

Topics:

- How Do I Find and Troubleshoot Errors?

- How Do I Handle the Error: Cannot Open Keystore Message?

- How Do I Handle General KMIP Errors?

- How Do I Handle WARNING: Could Not Store Private Key Errors?

- How Do I Handle Errors After Upgrading Oracle Key Vault?

See Also:
The following sections for additional advice on using Oracle Key Vault:

- "Recommendations for Uploading and Downloading Oracle Wallets"

- "Recommendations for Uploading and Downloading JKS and JCEKS Keystores"

- "Recommendations for Uploading and Downloading Credential Files"

How Do I Find and Troubleshoot Errors?

You can find and troubleshoot errors by referring to the Oracle Key Vault log files.

You can check the log files, which are located in the /var/log/messages file. These log files record information such as (items they record). To check for log file errors, as root, do the following:

root# vi /var/log/messages

How Do I Handle the Error: Cannot Open Keystore Message?

The Cannot Open Keystore error can appear when you try to upload a Java keystore to the Oracle Key Vault server.

You can try the following solutions:

- Ensure that the PATH environment variable has been correctly set.

- Check where the keytool and Java are pointing to, by entering the following commands in a shell:

which keytool
which java

Ensure that you are using Oracle Java.

How Do I Handle General KMIP Errors?

General KMIP errors can occur when you are trying to upload Oracle wallets to virtual wallets on multiple endpoints.

The General KMIP error occurs when you try the following sequence of actions:

1. You configure two or more endpoints (for example, Endpoint A and Endpoint B) to share a wallet (Oracle Wallet C), and hence also share the wallet keys.

2. You register Endpoints A and B with Oracle Key Vault.

3. You create a default wallet (Virtual Wallet A) for Endpoint A and then a default wallet (Virtual Wallet B) for Endpoint B. Each virtual wallet is accessible only to the corresponding endpoint. For example, Endpoint B has no access to Virtual Wallet A.

4. You upload Oracle Wallet C into Virtual Wallet A on Endpoint A.

5. You attempt to upload Oracle Wallet C from Endpoint B into Virtual Wallet B Endpoint B.

The KMIP error occurs because there are two copies of the same key being created and Endpoint B does not have visibility for both. If Endpoint A tries to upload the first key again, Oracle Key Vault detects this action and accounts for it. But because in Step 5, Endpoint B is not allowed to see the first key, Oracle Key Vault is unable to perform the necessary harmonization for the two Oracle wallets.

This is expected behavior. Instead, create an endpoint group so that you can share the wallet with multiple endpoints. See "Managing Endpoint Groups" for more information.

Note:
The KMIP error can occur for other scenarios, but this scenario is the most common.

How Do I Handle WARNING: Could Not Store Private Key Errors?

If you upload two keystores with the same file name but with different contents, a WARNING: Could not store private key error is generated.

This occurs if you use the same alias (-alias slserver) in each okvutil upload command. When you download two such keystores that have the same alias, the okvutil download process ignores the second one because the JKS aliases must be unique. Download the second keystore using a unique alias.

See Also:
"Downloading JKS or JCEKS Keystores"

How Do I Handle Errors After Upgrading Oracle Key Vault?

After you perform an upgrade of Oracle Key Vault on an standalone server, ORA-1109, ORA-00313, and ORA-00312 error messages may appear in the /var/log/messages log file.

You can safely ignore these messages. Error messages also appear in the /var/log/debug file.

Glossary

Audit Manager

An administrator role that enables a user to manage audit lifecycle and policies and to separate the role of auditing from managing the appliance.

auto-login wallet

A wallet that does not require a password. An auto-login wallet is stored in a cwallet.sso file. It is a type of Oracle wallet file.

credential file

A file containing security objects that is stored as a single opaque object within Oracle Key Vault.

default wallet

A wallet that automatically includes every key an endpoint creates.

endpoint

Databases and other systems that store security objects, such as keys, in Oracle Key Vault.

endpoint administrator

A user who is responsible for the server being configured as an endpoint. This user does not have privileges to log in to the Oracle Key Vault management console.

endpoint group

A group of endpoints that can share access to the same security objects.

Java keystore file

A file that can hold multiple security objects such as keys and certificates.

Key Administrator

An administrator role that enables a user to handle all key-related functions.

Management Information Base (MIB)

See MIB.

master encryption key

See TDE master encryption key.

MIB

In an SNMP configuration, a text file that describes the variables that contain the information that SNMP can access. The variables described in a MIB, which are also called MIB objects, are the items that can be monitored using SNMP. There is one MIB for each element being monitored.

opaque object

A security object that cannot be interpreted by Oracle Key Vault.

Oracle wallet file

A file that can hold multiple security objects such as keys and certificates. It uses the PKCS#12 cryptographic standard.

Oracle wallets, created for Oracle software, can be managed by Oracle Key Vault. You upload and download Oracle wallets to and from Key Vault by using the okvutil upload and okvutil download commands. Oracle wallet files can be protected by a password or they can be accessible without a password, in which case they are called auto-login wallets.

See also auto-login wallet, password-protected wallet.

password-protected wallet

An encrypted wallet that has a user-defined password. It is a type of an Oracle wallet file. A password-protected wallet is stored in an ewallet.p12 file.

PKCS#11 library

A library that allows an Oracle TDE database to connect to Oracle Key Vault to manage the master keys.

security objects

Objects managed by Oracle Key Vault for security, including passwords, keys, certificates, and credentials.

software appliance

A self-contained preconfigured product that can be installed on supported hardware dedicated for a specific purpose.

System Administrator

An administrator role that enables a user to manage Oracle Key Vault but not necessarily any of the keys stored there.

TDE master encryption key

A key that encrypts the data encryption keys for tables and tablespaces.

template

A collection of attributes for security objects. When a security object is created using a template, the attributes in the template are automatically assigned to the new object.

users

Within the context of this guide, users represent administrators, auditors, or users who have no roles that use the management console to manage the appliance and the security objects stored within.

virtual wallet

A container for security objects in Oracle Key Vault. These objects can be associated with each other, and typically include public and private keys, TDE master encryption keys, passwords, credentials, and certificates. You manage these objects within the Key Vault management console.

Index
A  B  C  D  E  F  G  H  I  J  K  L  M  N  O  P  R  S  T  U  V  W

A

access control configuration, 2.3

access control options, 2.3.1

access grants, 2.3.2

access settings

endpoint groups, 6.6.3

removing from virtual wallets, 7.6.4

accounts

users, 5.1

Actions menu, 3.5.1 administration

Oracle Key Vault, 2.5.1

administrative roles

overview, 2.5.3

alerts

about, 10.2

configuring, 10.2

configuring in Alerts menu, 10.2.2

viewing, 10.2, 10.5.1

archiving

credential files, 9.3.1

JKS and JCEKS keystores, 9.2.1

Audit Manager role

functions, 2.5.3

auditing

about, 10.3.1

Audit Manager role, 2.5.3

deleting audit records, 10.3.2

exporting audit records, 10.3.2

managing, 10.3

auto-login wallets

creating for accessing Oracle Key Vault credentials, 8.3.2

B

backing up and restoring data, 4.2

with Oracle Key Vault, 1.4.6

backup destinations

creating a remote backup destination, 4.2.2.2

editing, 4.2.2.3

LOCAL, 4.2.2.1

backup scheduling, 4.2.3

about, 4.2.3.1

deleting, 4.2.3.4

process, 4.2.3.1.1

schedule state, 4.2.3.1.2

types, 4.2.3.1.3

backup time

setting, 4.2.3.2

backups

and high availability, 4.2.3.5

and high availability failover, 4.2.3.5

and high availability switchover, 4.2.3.5

destinations, 4.2.2, 4.2.2.1

editing, 4.2.3.3

protecting with recovery passphrase, 4.2.3.6

scheduling, 4.2.3.2

types, 4.2.3.1.3

benefits

centralizing key lifecyle management, 1.2

centralizing key storage, 1.2

fighting security threats, 1.2

C

centralized storage

Java keystores, 2.2.1

Oracle wallet files, 2.2.1

changepwd command (okvutil), 8.6.6 changing passwords, 5.7.1 changing recovery passphrase, 10.6.4 configuration files

endpoint configuration file, 8.5

configuring

alerts, 10.2

configuring high availability, 4.1 creating a user group, 5.9.1 creating users, 5.2 credential files

about archiving and downloading, 9.3.1

best practices for archiving and downloading, 9.3.4

downloading, 9.3.3

storage, 2.2.3

uploading, 9.3.2

use case, 2.2.3

D

dashboard, 10.5

data

backing up, 4.2

restoring, 4.2

deactivating keys, 7.4.3.2 default wallet, 2.1 deleting audit records, 10.3.2 deleting user groups, 5.9.5 deleting users, 5.8 deployment architecture

Oracle Key Vault, 2.4

deployments

credential files, archiving and downloading, 9.3.1

Java keystores, archiving and downloading, 9.1.1

JKS and JCEKS keystores, archiving and downloading, 9.2.1

Oracle wallets, archiving and downloading, 9.1.1

TDE direction connection for TDE wallets, 9.4.1

DNS (Domain Name Service)

setting, 10.6.2.1

download command (okvutil), 8.6.5, 9.1.3

E

emergency system recovery, 2.5.4, 10.6.3

enabling SSH Access, 10.6.2.2

endpoint access to wallets, 6.5.1

endpoint administrators

about, 2.6

endpoint database requirements, 3.1.5 endpoint groups

about creating, 6.6.1.1

about removing, 6.6.5.1, 6.6.5.1

creating, 6.6.1.2

modifying, 6.6.2

removing, 6.6.5.2

removing a member from, 6.6.4

endpoint membership

adding, 6.4.3

endpoint platform, 3.1.4 endpoint self-enrollment, about, 6.3.1 endpoints

about, 8.1

about managing, 6.1

adding access to virtual wallet, 6.5.1

adding details

about, 6.4.1

adding to an endpoint group, 6.4.3 adding using administrator-initiated enrollment, 6.3.3 adding using self-enrollment, 6.3.4 administrators for, 6.1 configuration file, 8.5 deleting, 6.3.5.2

about, 6.3.5.1

procedure, 6.3.5.2

downloading software to endpointdownloading endpoint software to endpoint, 8.3.1 enrolling and provisioning, 8.3.1 enrollment, 6.3.1

about, 8.2

administrator initiated, about, 6.3.1

types of enrollment, 6.3.1

enrollment process

about, 8.2

enrollment status, 6.3.2 how Java home is determined during installation, 8.3.3 installing Key Vault client, 8.3.2 modifying details, 6.4.2 okvutil utility for provisioning, 8.6.1 Oracle Enterprise Manager, 8.1 password, changing, 8.6.6 provisioning, 8.2

about, 8.2

reenrolling, 6.3.5.1, 6.3.5.2

about, 6.3.5.1

procedure, 6.3.5.2

removing access to virtual wallet, 6.5.2 searching for, 6.2 TDE endpoint management, 8.4 See also endpoint groups enrolling endpoints

administrator initiated

about, 6.3.1

process, 8.2 self-initiated

about, 6.3.1

status, 6.3.2 Error

Object is Unstorable in Container error, 8.6.5

exporting audit records, 10.3.2

F

failover

and backup, 4.2.3.5

restoring high availability, 4.1.4

G

general maintenance, 10.1

general steps for using Oracle Key Vault, 1.6

granting access to objects or users, 2.3.2

granting roles, 5.3

H

high availability

and Active Data Guard, 1.4.5

and backup, 4.2.3.5

and restore, 4.2.4.4

clusters, 4.1.3

configuring, 4.1, 4.1.2

failover and backup, 4.2.3.5

switchover, backup, 4.2.3.5

unconfiguring, 4.1.5

with Oracle Key Vault, 1.4.5

I

installation passphrase, 3.2

entering, 3.2.1

interfaces, 1.5

J

Java keystores

downloading, 8.6.5, 9.2.3

uploading, 8.6.4, 9.2.2

JAVA_HOME environment variable

how determined during client installation, 8.3.3

JKS and JCEKS keystores

archiving

about, 9.2.1

best practices, 9.2.4

procedure, 9.2.2

downloading

best practices, 9.2.4

procedure, 9.2.3

K

Kerberos keytabs

downloading, 8.6.5

Key Administrator role

functions, 2.5.3

key lifecycle management, 1.4.2 key management, 1.1 key rotation, 2.2.2 keys

changing state of, 7.4.3.1

deactivating, 7.4.3.2

finding for Key Vault, 8.6.3

revoking, 7.4.3.3

KMIP Protocol, 1.4.8

L

liborapkcs.so file

about, 8.3.2

copying to endpoint, 8.3.2

list command (okvutil), 8.6.3 LOCAL

backup destinations, 4.2.2.1

log file locations, A.1

M

managed content

viewing, 10.5.1

management console, 3.3

about, 1.5

logging in to, 3.4

management of Oracle Key Vault, 10.1 management report

accessing, 10.4.2

managing users, 5.1 modifying a user group, 5.9.2

N

network address

setting, 10.6.2.1

network services

setting, 10.6.2

O

OASIS Key Management Interoperability Protocol (KMIP)

Oracle Key Vault implementation of, 1.4.8

okvclient.ora file

about, 8.5

location, 8.3.3

okvutil utility

about, 1.5

changepwd command, 8.6.6

download command, 8.6.5

list command, 8.6.3

syntax, 8.6.2

upload command, 8.6.4

used to manage endpoints, 8.6.1

options for access control, 2.3.1 Oracle Active Data Guard

migrating Oracle wallets, 9.7.4

TDE direct connections, 9.7.3

uploading Oracle wallets to Oracle Key Vault, 9.7.1

Oracle Enterprise Manager

endpoints, 8.1

TDE integration with Oracle Key Vault, 8.1

Oracle Key Vault

about, 1.1

administering, 10.6

benefits, 1.2

endpoint database requirements, 3.1.5

endpoint platform, 3.1.4

general steps for using, 1.6

installing, 3.2

other Oracle Database product support, 9.4.2

standards and protocols, 1.4.8

system requirements, 3.1.2

who should use, 1.3

Oracle Key Vault client software

auto-login wallet, 8.3.2

installing, 8.3.2

password-protected wallet, 8.3.2

setting credentials for accessing, 8.3.2

Oracle Key Vault configurations, 10.6.2 Oracle Key Vault endpoint utility

about, 1.5

See okvutil utility

Oracle Key Vault interfaces, 1.5 Oracle Key Vault keys

finding, 8.6.3

Oracle Key Vault management console, 3.3

about, 1.5

logging in to, 3.4

Oracle Key Vault restore, 4.2.4 Oracle Key Vault status

viewing, 10.5, 10.6.1

Oracle Key Vault use cases, 2.2 Oracle Real Application Clusters

archiving Oracle wallets, 9.5

Oracle wallets

archiving

about, 9.1.1

best practices, 9.1.4

archiving in Oracle Real Application Clusters environment, 9.5 downloading, 9.1.3

best practices, 9.1.4

restoring from Key Vault wallets, 9.4.4.3 uploading, 9.1.2

P

password-protected wallets

creating for accessing Oracle Key Vault credentials, 8.3.2

passwords

changing, 5.7.1

changing endpoint password, 8.6.6

Payment Card Industry Data Security Standard (PCI DSS), 1.4.2 power off, 10.6.2 power on, 10.6.2 provisioning endpoints

about, 8.2

R

reboot, 10.6.2

recovery passphrase

changing, 10.6.4

maintaining correct passphrase, 2.5.4

protecting the backup, 4.2.3.6

reenrolling

endpoints

about, 6.3.5.1

reenrolling endpoints

procedure, 6.3.5.2

rekey operation, 2.2.2, 9.1.4, 9.7.1 reports

viewing, 10.4

restore, 4.2.4 restore process, 4.2.4.2

about, 4.2.4.1

and high availability, 4.2.4.4

restoring Key Vault steps, 4.2.4.3

system state after, 4.2.4.5

restoring a system, 4.2.4.3 restoring high availability after a failover, 4.1.4 revoking keys, 7.4.3.3 revoking roles, 5.3 roles, 2.5.3

granting or revoking, 5.3

users without, 2.5, 5.1

rotation of encryption key, 9.1.4

S

scheduled backups, 4.2.3.2

deleting, 4.2.3.4

editing, 4.2.3.3

Search bars, 3.5.2 searches

how to perform searches in Oracle Key Vault, 3.5

searching for endpoints, 6.2 searching for items

all items section, 7.4.1

security objects

adding details, 7.4.2.1

advanced attributes of, 7.4.2.3

basic attributes of, 7.4.2.2

changing state of, 7.4.3.1

deactivating keys, 7.4.3.2

downloading to different types, 8.6.5

modifying details of, 7.4.2.1

revoking keys, 7.4.3.3

viewing details of, 7.4.2.1

separation of duties, 2.5.2 setting access to wallet, 6.6.3 SSH key files

downloading from Key Vault to a wallet, 8.6.5

switching primary and secondary nodes, 4.1.3 syslog configuration

setting, 10.6.2.1

System Administrator role

functions, 2.5.3

system recovery, 2.5.4 system requirements, 3.1.2 system state

after restore, 4.2.4.5

system time

setting, 10.6.2.1

T

TDE direct connections

about, 9.4.1

configuration for database with existing TDE data, 9.4.4.1

configuration for database with no TDE data, 9.4.3

use case, 2.2.2

TDE intetegration with Oracle Key Vault

Oracle Enterprise Manager, 8.1

TDE master keys

centralized management, 2.2.2

template, Glossary Transparent Data Encryption

endpoint management, 8.4

troubleshooting

finding log files, A.1

upgrade errors, A.5

uploading Java keystores, A.2

uploading keystores with same file name but different contents, A.4

uploading the same Oracle wallet multiple times, A.3

types of backups, 4.2.3.1.3

U

upgrades

error handling, A.5

upload command (okvutil), 8.6.4 uploading

Oracle wallets, 9.1.1

use cases, 2.2 user details page, 5.5 user group membership

adding, 5.6.1

managing, 5.6, 5.6.2

removing, 5.6.1

user groups

adding a user, 5.9.3

creating, 5.9.1

deleting, 5.9.5

modifying, 5.9.2

removing a user, 5.9.4

virtual wallet access, 5.9

users

accounts, 5.1

adding access to virtual wallets, 7.6.2.1

creating, 5.2

deleting, 5.8

list, 5.4

managing, 5.1

removing access to virtual wallets, 7.6.2.2

users without roles, 2.5, 5.1, 5.7.1

V

viewing

alerts status, 10.5.1

managed content status, 10.5.1

virtual wallets

about, 7.1

about creating, 7.3.1

access for user groups, 5.9

adding access for individual user, 7.6.2.1

adding endpoint access to, 6.5.1

adding items, 7.5

creating, 7.3.2

deleting, 7.7

endpoint details, 6.4.1

granting access to, 7.6.1

removing access settings from, 7.6.4

removing endpoint access to, 6.5.2

removing individual access to, 7.6.2.2

removing items, 7.5

restoring Oracle wallets from, 9.4.4.3

viewing, 7.2

W

wallets

downloading from Key Vault to a wallet, 8.6.5

uploading contents to Key Vault server, 8.6.4

See also Oracle wallets, virtual wallets

Web Access, SSH Access, SNMP Access, 10.6.2

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2016, Oracle and/or its affiliates. All rights reserved.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Alpha and Beta Draft Documentation Notice

If this document is in preproduction status:

This documentation is in preproduction status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

Private Alpha and Beta Draft Documentation Notice

If this document is in private preproduction status:

The information contained in this document is for informational sharing purposes only and should be considered in your capacity as a customer advisory board member or pursuant to your beta trial agreement only. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle.

This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. Your access to and use of this confidential material is subject to the terms and conditions of your Oracle Master Agreement, Oracle License and Services Agreement, Oracle PartnerNetwork Agreement, Oracle distribution agreement, or other license agreement which has been executed by you and Oracle and with which you agree to comply. This document and information contained herein may not be disclosed, copied, reproduced, or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.