To allow Oracle Data Safe to connect to your DB system, a database administrator needs to add an ingress security rule to your database's virtual cloud network (VCN). In the rule, specify Oracle Data Safe's Network Address Translation (NAT) gateway IP address that corresponds to the region in which Oracle Data Safe is enabled. For more information, see Security Lists in the Oracle Cloud Infrastructure documentation.

• NAT Gateway IP Addresses for Oracle Data Safe
  

1. Log in to your target database with an account that lets you create a user.
2. Create a user account with minimal privileges, for example:

   CREATE USER DATASAFE_ADMIN identified by password
   DEFAULT TABLESPACE "DATA"
   TEMPORARY TABLESPACE "TEMP";
   GRANT CONNECT, RESOURCE TO DATASAFE_ADMIN;

   • Replace DATASAFE_ADMIN and password with your own values.
   • Do not use SYSTEM or SYSAUX as the default tablespace. You cannot mask data if you use these tablespaces.

1. Download the SQL privileges script from the Oracle Data Safe Console:
   1. Sign in to the Oracle Data Safe Console, and click the Targets tab.
   2. Click Register.
      The Register Target dialog box is displayed.
   3. Click Download Privilege Script and save the datasafe_privileges.sql script to your computer.
   4. Click Cancel.
2. With SQL Developer or SQL*Plus, connect to your database as the SYS user, and then run the SQL privileges script with the following statement:

   @datasafe_privileges.sql <DATASAFE_ADMIN> <GRANT/REVOKE> <AUDIT_COLLECTION/AUDIT_SETTING/DATA_DISCOVERY/MASKING/ASSESSMENT/ALL> [-VERBOSE]

   • <DATASAFE_ADMIN> is the name of the Oracle Data Safe service account that you created on your database. It is case-sensitive and must match the account name in the dba_users data dictionary view in your database.
   • Specify GRANT or REVOKE depending on whether you want to add privileges to or remove privileges from the Oracle Data Safe service account.
   • Specify one or more Oracle Data Safe features, separated by a forward slash: AUDIT_COLLECTION/AUDIT_SETTING/DATA_DISCOVERY/MASKING/ASSESSMENT/ALL. ALL grants or revokes all the features.
   • -VERBOSE shows only the actual GRANT/REVOKE commands. This parameter is optional.

• When Client Authentication is Enabled on Your Target Database
  
• When Client Authentication is Disabled on Your Target Database
  
• Keep in Mind
  

1. Sign in to the Oracle Data Safe Console.
2. Click the Targets tab.
3. Click Register.
   The Register Target dialog box is displayed.
4. Enter a name for your target database.
   This name can be any name you want, and all characters are accepted. The maximum number of characters is 512.
   This name appears in all of the Oracle Data Safe reports that pertain to your target database.
5. Leave Oracle Cloud Database selected as the target type.
6. (Optional) Enter a description for your target database.
7. Select the compartment to which you want the target database to belong.

   You can register a target database to only one compartment and you cannot change the compartment after the target database is registered.

8. For Database with Private IP, leave No selected.
9. In the OCID field, enter the Oracle Cloud Identifier (OCID) for your target database; for example, ocid1.dbsystem.oc1.iad.abcd1eef2bcd1xxyabcd12...
   The OCID is used to validate whether you have the inspect, use, or manage privilege on the target database in Oracle Cloud Infrastructure Identity and Access Management (IAM).
   The OCID for the target database is available in the database's console in Oracle Cloud Infrastructure.
10. For connection type, select TCP or TLS.

    The default selection is TCP.

11. In the IP Address field, enter the public IP address for the target database.
    The public IP address should match the public IP address for the database in Oracle Cloud Infrastructure Console.
12. Enter the port number for the database.
13. Enter the long version of the database service name, for example, abc_prod.subnetad3.tttvcn.companyvcn.com.
    You can find the database service name in the database's Console in Oracle Cloud Infrastructure. You can also find the database service name the following way:
    1. Connect to your database.
    2. Switch to the PDB that you want to register with Oracle Data Safe.
    3. Run the following command:

       SQL> select sys_context('userenv','service_name') from dual;

14. If you are configuring a TLS connection, enter the Target Distinguished Name.
    This name is the distinguished name used while creating the certificate on target database.
    An example name is CN=abcd.uscom-east-1.example.com,OU=Oracle BMCS US,O=Oracle Corporation,L=Redwood City,ST=California,C=US.
15. If you are configuring a TLS connection and client authentication is enabled on your target database, then follow the steps below to upload a JKS wallet.
    1. From the Certificate/Wallet Type drop-down list, select JKS Wallet.
    2. For Certificate/Wallet, click Browse, and then select a truststore JKS file.
    3. For Keystore Wallet, click Browse, and then select a keystore JKS file.
    4. Enter the wallet password.
16. If you are configuring a TLS connection and client authentication is disabled on your target database, select a certificate or wallet type, and then follow the corresponding steps listed in the table below. You can choose to upload a JKS wallet, Privacy Enhanced Mail (PEM) certificate, Distinguished Encoding Rules (DER) certificate, or nothing.

    Wallet or Certificate Type	Steps
    JKS Wallet	Click Choose File. Select a truststore JKS file. Enter the wallet password.
    DER Certificate	Click Choose File Select a CRT or DER file. Supported file extensions are CER, CERT, CRT, and DER.
    PEM Certificate	Click Choose File. Select a PEM or DER file. Supported file extensions are PEM and DER.
    NONE	You do not need to upload any files.

17. Enter the database user name and password that you created on the target database specifically for Oracle Data Safe.
    If you created the user on the target database without quotation marks, you need to enter the user name in uppercase here. For example, if the user name on the target database is called test, then you need to enter TEST.
    You cannot specify database roles, such as SYSDBA or SYSKM, and you cannot specify SYS as the user.
18. (Optional) To verify that Oracle Data Safe can successfully connect to the target database, click Test Connection.
19. Click Register Target.
    You cannot register the target database if the connection test fails or if the target database does not exist.

1. Sign in to the Oracle Data Safe Console.
2. At the top of the page, click Security.
3. (Optional) To filter the list of compartments to show only those that have grants to users and user groups in Oracle Data Safe, select the Show compartments with grants only check box.
4. Select the compartment for which you want to configure the authorization policy.
   A list of users and user groups is displayed.
5. To grant a user or user group a privilege for a feature, select View or Manage from the Assessment, Discovery and Masking, and/or Activity Auditing drop-down lists.
   You can still select Manage for a user or user group even if that user or user group cannot inspect user groups in the tenancy. In this case, the user group can read, create, update, and delete resources for the feature, but cannot configure authorization policies.
6. To grant a user or user group the same privilege for all features, select –- (none), View, or Manage from the All Features drop-down list.
7. To revoke a privilege from a user or user group, select -- in a feature drop-down list.
8. To filter the list of user and user groups to only those that have privileges, move the Hide IAM user groups without any access rights to the right.
9. Click Save.