Connect Autonomous Database Using a Client Application

Autonomous Database is preconfigured to support Oracle Net Services (a TNS listener is installed and configured to use secure TCPS and client credentials).

The client computer must be prepared to use Oracle Net Services to connect to Autonomous Database.

Topics

• About Connecting to Autonomous Database Using a Client Application

• Prepare for Oracle Call Interface (OCI), ODBC, and JDBC OCI Connections

• Prepare for JDBC Thin Connections

• Using Applications with Support for Wallets

About Connecting to Autonomous Database Using a Client Application

Applications can connect to Autonomous Database using any of the connection types supported by Oracle Net Services.

Consult your application documentation for details about how your application connects to Oracle. The following steps describe the process of connecting to Autonomous Database using a client application:

1. Determine what connection type your application uses, (for example OCI, ODBC, JDBC Thin, and so on).

2. Prepare your client computer for the type of connection used by your application. See the following sections.

3. Within your application, set up the connection.

The steps required to prepare the client computer depend on the type of connection used by the client application. In all cases, client credentials in the form of the wallet file must be downloaded to the client.

Prepare for Oracle Call Interface (OCI), ODBC, and JDBC OCI Connections

Preparing for any type of Oracle Call Interface(OCI) connection requires the installation of client software, downloading client credentials, and configuring certain files and environment variables.

New Oracle Client Installation

The following steps assume Oracle client software has not already been installed on the client computer. If Oracle client software has already been installed and there are working copies of sqlnet.ora and tnsnames.ora, see Updating an Existing Oracle Client Installation.

Before making an Oracle Call Interface(OCI), ODBC, or JDBC OCI connection, do the following:

1. Install Oracle Client software on your computer. Use either the full Oracle Database Client 11.2.0.4 (or higher) or the Oracle Instant Client 12.1.0.2 (or higher). The Instant Client contains the minimal software needed to make an Oracle Call Interface connection. The Instant Client 12.1.0.2 (or higher) is sufficient for most applications.

2. Download client credentials and store the file in a secure folder on your client computer. See Download Client Credentials (Wallets).

3. Unzip/uncompress the credentials file into a secure folder on your client computer.

4. Edit the sqlnet.ora file in the folder where you unzip the credentials file, replacing "?/network/admin" with the name of the folder containing the client credentials.

   For example, edit sqlnet.ora as follows:

   WALLET_LOCATION = (SOURCE = (METHOD = file) (METHOD_DATA = (DIRECTORY="?/network/admin")))
   SSL_SERVER_DN_MATCH=yes

   To (UNIX/Linux example):

   WALLET_LOCATION = (SOURCE = (METHOD = file) (METHOD_DATA = (DIRECTORY="/home/adb_credentials")))
   SSL_SERVER_DN_MATCH=yes
   

   To (Windows example):

   WALLET_LOCATION = (SOURCE = (METHOD = file) (METHOD_DATA = (DIRECTORY="D:\\myapp\\adb_credentials")))
   SSL_SERVER_DN_MATCH=yes
   

5. Create the TNS_ADMIN environment variable and set it to the location of the credentials file.

   Use this environment variable to change the directory path of Oracle Net Services configuration files from the default location of ORACLE_HOME\network\admin to the location of the secure folder containing the credentials file you saved in Step 2. Set the TNS_ADMIN environment variable to the directory where the unzipped credentials files are, not to the credentials file itself.

   For example, on UNIX/Linux set TNS_ADMIN to the full path of the directory where you unzipped the client credentials:

   export TNS_ADMIN=/home/adb_credentials

   For example on Windows:

   set TNS_ADMIN=d:\myapp\adb_credentials

Connections with an HTTP Proxy

If the client is behind a firewall and your network configuration requires an HTTP proxy to connect to the internet, then perform the following steps to update the sqlnet.ora and tnsnames.ora files.

Note:

Connections through an HTTP proxy are only available with Oracle Client software version 12.2.0.1 or later.

1. Add the following line to the sqlnet.ora file to enable connections through an HTTP proxy:

   SQLNET.USE_HTTPS_PROXY=on

2. Add the HTTP proxy hostname and port to the connection definitions in tnsnames.ora. You need to add the https_proxy and https_proxy_port parameters in the address section of connection definitions. For example, the following sets the HTTP proxy to proxyhostname and the HTTP proxy port to 80; replace these values with your HTTP proxy information:

   ADB1_high =
          (description=
                (address=
                      (https_proxy=proxyhostname)(https_proxy_port=80)(protocol=tcps)(port=1522)(host=adb.example.oraclecloud.com)
                )
                (connect_data=(service_name=adb1_high.adb.oraclecloud.com)
                )
                (security=(ssl_server_cert_dn="adb.example.oraclecloud.com,OU=Oracle BMCS US,O=Oracle Corporation,L=Redwood City,ST=California,C=US")
                )
          )

Note:

Configuring sqlnet.ora and tnsnames.ora for the HTTP proxy may not be enough depending on your organization's network configuration and security policies. For example, some networks require a username and password for the HTTP proxy. In such cases contact your network administrator to open outbound connections to hosts in the oraclecloud.com domain using port 1522 without going through an HTTP proxy.

For more information on SQLNET.USE_HTTPS_PROXY, see Net Services Reference.

For information on HTTPS_PROXY and HTTPS_PROXY_PORT, see Protocol Address Section.

Updating an Existing Oracle Client Installation

If you have an existing Oracle Client installation, you already have sqlnet.ora and tnsnames.ora files and the TNS_ADMIN environment variable. In this case, do the following:

1. Update your sqlnet.ora file by adding the following:

   WALLET_LOCATION = (SOURCE = (METHOD = file) (METHOD_DATA = (DIRECTORY="/home/adb_credentials")))

2. Copy the entries in the tnsnames.ora file provided in the Autonomous Database wallet to your existing tnsnames.ora file.

Prepare for JDBC Thin Connections

Applications that use JDBC Thin connections include the software necessary to make an Oracle Net Services connection. It is not necessary to download and install Oracle Client software.

Some applications use the JDK installed on your computer while others use a JDK that is embedded in the application installation. If your application uses the JDK installed on your computer and that JDK is version 8, 8u161 or later, no additional preparation is required. If your computer does not have JDK version 8, 8u161 or later, already installed then install the latest JDK first. You can download JDK version 8 from https://www.java.com/.

If your application is using a JDK version 8, prior to 8u161, then the JCE Policy Files must be updated within your application.

See JDBC Thin Connections and Wallets for the steps required to use JDBC Thin connections to connect to an Oracle Database server.

Set JVM Networking Properties

Autonomous Database uses DNS names that map to multiple IP addresses (multiple load balancers) for better availability and performance. Depending on your application, you may want to configure certain JVM networking properties.

For the Java Virtual Machine (JVM) address cache, any address resolution attempt caches the result whether it was successful or not, so that subsequent identical requests do not have to access the naming service. The address cache properties allow you to tune how the cache operates. In particular, the networkaddress.cache.ttl value specifies the number of seconds a successful name lookup is kept in the cache. A value of -1, the default value, indicates a “cache forever” policy, while a value of 0 (zero) means no caching.

If your Java Virtual Machine (JVM) is configured to cache DNS address lookups, your application may be using only one IP address to connect to your Autonomous Database, resulting in lower throughput. To prevent this you can change your JVM's networkaddress.cache.ttl value to 0, so that every connection request does a new DNS lookup. This ensures that different threads in your application are distributed over multiple load balancers.

To change the networkaddress.cache.ttl value for all applications or in your application, do one of the following:

• Configure the security policy to set the value for all applications:

  Set networkaddress.cache.ttl=0 in the file $JAVA_HOME/jre/lib/security/java.security

• Set the following property in your application code:

  java.security.Security.setProperty("networkaddress.cache.ttl" , "0");

Using Applications with Support for Wallets

Some applications allow you to choose a credentials file as part of the connection properties.

For example, in SQL Developer 18.3 and higher, in the Connection Type field select the value Cloud Wallet that allows you to enter a credentials file in the Configuration File field. SQL Developer then presents a list of the available connections in the Service field (the connections are included in the credentials files).

If your application provides support for wallets or provides specific support for an Autonomous Database connection, for example, Oracle SQL Developer, Oracle recommends that you use that type of connection.

Description of the illustration adb_connect_sqldev_db20.png