html

• Title and Copyright Information
• Preface
  • Audience
  • Documentation Accessibility
  • Related Documents
  • Conventions
• Changes in This Release for Oracle Database Security Guide
  • Changes in Oracle Database Security 19c
    • Preparing for FIPS 140-3 Compliance
    • Constrained Kerberos Configuration
    • Multi-Factor Authentication Now Available
    • Signature-Based Security for LOB Locators
    • Default User Accounts Now Schema Only
    • Privilege Analysis Documentation Moved to Oracle Database Security Guide
    • Ability to Grant or Revoke Administrative Privileges to and from Schema-Only Accounts
    • Automatic Support for Both SASL and Non-SASL Active Directory Connections
    • Support for Oracle Native Encryption and TLS Authentication for Different Users Concurrently
    • Support for Host Name-Based Partial DN Matching for Matching for Server Certificates
    • Ability to Audit Only Top-Level SQL Statements
    • Improved Read Performance for the Unified Audit Trial
    • SYSLOG Destination for Common Unified Audit Policies
    • PDB_GUID as Audit Record Field Name for SYSLOG and the Windows Event Viewer
  • Updates to Oracle Database Security 19c
    • Authenticating and Authorizing IAM Users to Oracle Autonomous Database on Dedicated Exadata Infrastructure
    • Enhancements for Identity and Access Management Integration with Oracle Database Environments
    • Identity and Access Management Integration with Oracle Autonomous Cloud Databases
    • Database Integration Support for Non-Default Domains for Identity and Access Management with Identity Domains
    • Microsoft Azure Active Directory Integration with Additional Oracle Database Environments Including On-Premises
    • Microsoft Azure Active Directory Integration with Oracle Cloud Infrastructure Autonomous Databases
    • Gradual Database Password Rollover for Applications
    • Ability to Use Multiple Kerberos Principals with a Single Database Client
    • Updated Support for Micro Edition Suite (MES) for FIPS 140.2
    • Support for DBMS_CRYPTO Asymmetric Key Operations
    • SYSLOG Destination for Common Unified Audit Policies
    • Security Update for Native Encryption
    • Ability to Configure Transport Layer Security Connections without Client Wallets
    • SSL_ALLOW_WEAK_DN_MATCH Parameter to Control the Behavior of SSL_SERVER_DN_MATCH
• Introduction to Oracle Database Security
  • About Oracle Database Security
  • Additional Oracle Database Security Products
• Part I Managing User Authentication and Authorization
  • Managing Security for Oracle Database Users
    • About User Security
    • Creating User Accounts
      • About Common Users and Local Users
        • About Common Users
        • How Plugging in PDBs Affects CDB Common Users
        • About Local Users
      • Who Can Create User Accounts?
      • Creating a New User Account That Has Minimum Database Privileges
      • Restrictions on Creating the User Name for a New Account
        • Uniqueness of User Names
        • User Names in a Multitenant Environment
        • Case Sensitivity for User Names
      • Assignment of User Passwords
      • Default Tablespace for the User
        • About Assigning a Default Tablespace for a User
        • DEFAULT TABLESPACE Clause for Assigning a Default Tablespace
      • Tablespace Quotas for a User
        • About Assigning a Tablespace Quota for a User
        • CREATE USER Statement for Assigning a Tablespace Quota
        • Restriction of the Quota Limits for User Objects in a Tablespace
        • Grants to Users for the UNLIMITED TABLESPACE System Privilege
      • Temporary Tablespaces for the User
        • About Assigning a Temporary Tablespace for a User
        • TEMPORARY TABLESPACE Clause for Assigning a Temporary Tablespace
      • Profiles for the User
      • Creation of a Common User or a Local User
        • About Creating Common User Accounts
        • CREATE USER Statement for Creating a Common User Account
        • About Creating Local User Accounts
        • CREATE USER Statement for Creating a Local User Account
      • Creating a Default Role for the User
    • Altering User Accounts
      • About Altering User Accounts
      • Methods of Altering Common or Local User Accounts
      • Changing Non-SYS User Passwords
        • About Changing Non-SYS User Passwords
        • Using the PASSWORD Command or ALTER USER Statement to Change a Password
      • Changing the SYS User Password
        • About Changing the SYS User Password
        • ORAPWD Utility for Changing the SYS User Password
    • Configuring User Resource Limits
      • About User Resource Limits
      • Types of System Resources and Limits
        • Limits to the User Session Level
        • Limits to Database Call Levels
        • Limits to CPU Time
        • Limits to Logical Reads
        • Limits to Other Resources
      • Values for Resource Limits of Profiles
      • Managing Resources with Profiles
        • About Profiles
        • ora_stig_profile User Profile
        • Creating a Profile
        • Creating a CDB Profile or an Application Profile
        • Assigning a Profile to a User
        • Dropping Profiles
    • Dropping User Accounts
      • About Dropping User Accounts
      • Terminating a User Session
      • About Dropping a User After the User Is No Longer Connected to the Database
      • Dropping a User Whose Schema Contains Objects
    • Predefined Schema User Accounts Provided by Oracle Database
      • About the Predefined Schema User Accounts
      • Predefined Administrative Accounts
      • Predefined Non-Administrative User Accounts
      • Predefined Sample Schema User Accounts
    • Database User and Profile Data Dictionary Views
      • Data Dictionary Views That List Information About Users and Profiles
      • Query to Find All Users and Associated Information
      • Query to List All Tablespace Quotas
      • Query to List All Profiles and Assigned Limits
      • Query to View Memory Use for Each User Session
  • Configuring Authentication
    • About Authentication
    • Configuring Password Protection
      • What Are the Oracle Database Built-in Password Protections?
      • Minimum Requirements for Passwords
      • Creating a Password by Using the IDENTIFIED BY Clause
      • Using a Password Management Policy
        • About Managing Passwords
        • Finding User Accounts That Have Default Passwords
        • Password Settings in the Default Profile
        • Using the ALTER PROFILE Statement to Set Profile Limits
        • Disabling and Enabling the Default Password Security Settings
        • Automatically Locking Inactive Database User Accounts
        • Automatically Locking User Accounts After a Specified Number of Failed Log-in Attempts
        • Example: Locking an Account with the CREATE PROFILE Statement
        • Explicitly Locking a User Account
        • Controlling the User Ability to Reuse Previous Passwords
        • About Controlling Password Aging and Expiration
        • Using the CREATE PROFILE or ALTER PROFILE Statement to Set a Password Lifetime
        • Checking the Status of a User Account
        • Password Change Life Cycle
        • PASSWORD_LIFE_TIME Profile Parameter Low Value
      • Managing Gradual Database Password Rollover for Applications
        • About Managing Gradual Database Password Rollover for Applications
        • Password Change Life Cycle During a Gradual Database Password Rollover
        • Enabling the Gradual Database Password Rollover
        • Changing a Password to Begin the Gradual Database Password Rollover Period
        • Changing a Password During the Gradual Database Password Rollover Period
        • Ending the Password Rollover Period
        • Database Behavior During the Gradual Password Rollover Period
        • Database Server Behavior After the Password Rollover Period Ends
        • Guideline for Handling Compromised Passwords
        • How Gradual Database Password Rollover Works During Oracle Data Pump Exports
        • Using Gradual Database Password Rollover in an Oracle Data Guard Environment
        • Finding Users Who Still Use Their Old Passwords
      • Managing the Complexity of Passwords
        • About Password Complexity Verification
        • How Oracle Database Checks the Complexity of Passwords
        • Who Can Use the Password Complexity Functions?
        • verify_function_11G Function Password Requirements
        • ora12c_verify_function Password Requirements
        • ora12c_strong_verify_function Function Password Requirements
        • ora12c_stig_verify_function Password Requirements
        • About Customizing Password Complexity Verification
        • Enabling Password Complexity Verification
      • Managing Password Case Sensitivity
        • SEC_CASE_SENSITIVE_LOGON Parameter and Password Case Sensitivity
        • Using the ALTER SYSTEM Statement to Enable Password Case Sensitivity
        • Management of Case Sensitivity for Secure Role Passwords
        • Management of Password Versions of Users
        • Finding and Resetting User Passwords That Use the 10G Password Version
        • How Case Sensitivity Affects Password Files
        • How Case Sensitivity Affects Passwords Used in Database Link Connections
      • Ensuring Against Password Security Threats by Using the 12C Password Version
        • About the 12C Version of the Password Hash
        • Oracle Database 12C Password Version Configuration Guidelines
        • Configuring Oracle Database to Use the 12C Password Version Exclusively
        • How Server and Client Logon Versions Affect Database Links
        • Configuring Oracle Database Clients to Use the 12C Password Version Exclusively
      • Managing the Secure External Password Store for Password Credentials
        • About the Secure External Password Store
        • How Does the Secure External Password Store Work?
        • About Configuring Clients to Use the Secure External Password Store
        • Configuring a Client to Use the Secure External Password Store
        • Example: Sample sqlnet.ora File with Wallet Parameters Set
        • Managing External Password Store Credentials
          • Listing External Password Store Contents
          • Adding Credentials to an External Password Store
          • Modifying Credentials in an External Password Store
          • Deleting Credentials from an External Password Store
      • Managing Passwords for Administrative Users
        • About Managing Passwords for Administrative Users
        • Setting the LOCK and EXPIRED Status of Administrative Users
        • Password Profile Settings for Administrative Users
        • Last Successful Login Time for Administrative Users
        • Management of the Password File of Administrative Users
        • Migration of the Password File of Administrative Users
        • How the Multitenant Option Affects Password Files for Administrative Users
        • Password Complexity Verification Functions for Administrative Users
    • Authentication of Database Administrators
      • About Authentication of Database Administrators
      • Strong Authentication, Centralized Management for Administrators
        • About Strong Authentication for Database Administrators
        • Configuring Directory Authentication for Administrative Users
        • Configuring Kerberos Authentication for Administrative Users
        • Configuring User Authentication with Transport Layer Security
      • Authentication of Database Administrators by Using the Operating System
      • Authentication of Database Administrators by Using Their Passwords
      • Risks of Using Password Files for Database Administrator Authentication
    • Database Authentication of Users
      • About Database Authentication of Users
      • Advantages of Database Authentication
      • Creating Users Who Are Authenticated by the Database
    • Configuring Multi-Factor Authentication
      • MFA Push Notifications
        • Cisco Duo
        • Oracle Mobile Authenticator (OMA)
        • MFA External Account Updates and Cleanup
      • MFA Certificate-based Authentication
      • Auditing Multi-factor Authentication Failures
      • Database Links and Multi-factor Authentication
    • Schema-Only Accounts
      • About Schema-Only Accounts
      • Creating a Schema-Only Account
      • Altering a Schema-Only Account
    • Operating System Authentication of Users
    • Network Authentication of Users
      • Authentication with Transport Layer Security
      • Authentication with Third-Party Services
        • About Authentication Using Third-Party Services
        • Authentication with Kerberos
        • Authentication with RADIUS
        • Authentication with Directory-Based Services
        • Authentication with Public Key Infrastructure
    • Configuring Operating System Users for a PDB
      • About Configuring Operating System Users for a PDB
      • Configuring an Operating System User for a PDB
    • Global User Authentication and Authorization
      • About Configuring Global User Authentication and Authorization
      • Configuration of Users Who Are Authorized by a Directory Service
        • Creating a Global User Who Has a Private Schema
        • Creating Multiple Enterprise Users Who Share Schemas
      • Advantages of Global Authentication and Global Authorization
    • Configuring an External Service to Authenticate Users and Passwords
      • About External Authentication
      • Advantages of External Authentication
      • Enabling External Authentication
      • Creating a User Who Is Authenticated Externally
      • Authentication of User Logins By Using the Operating System
      • Authentication of User Logins Using Network Authentication
    • Multitier Authentication and Authorization
    • Administration and Security in Clients, Application Servers, and Database Servers
    • Preserving User Identity in Multitiered Environments
      • Middle Tier Server Use for Proxy Authentication
        • About Proxy Authentication
        • Advantages of Proxy Authentication
        • Who Can Create Proxy User Accounts?
        • Guidelines for Creating Proxy User Accounts
        • Creating Proxy User Accounts and Authorizing Users to Connect Through Them
        • Proxy User Accounts and the Authorization of Users to Connect Through Them
        • Using Proxy Authentication with the Secure External Password Store
        • How the Identity of the Real User Is Passed with Proxy Authentication
        • Limits to the Privileges of the Middle Tier
        • Authorizing a Middle Tier to Proxy and Authenticate a User
        • Authorizing a Middle Tier to Proxy a User Authenticated by Other Means
        • Reauthenticating a User Through the Middle Tier to the Database
        • Using Password-Based Proxy Authentication
        • Using Proxy Authentication with Enterprise Users
      • Using Client Identifiers to Identify Application Users Unknown to the Database
        • About Client Identifiers
        • How Client Identifiers Work in Middle Tier Systems
        • Use of the CLIENT_IDENTIFIER Attribute to Preserve User Identity
        • Use of the CLIENT_IDENTIFIER Independent of Global Application Context
        • Setting the CLIENT_IDENTIFIER Independent of Global Application Context
        • Use of the DBMS_SESSION PL/SQL Package to Set and Clear the Client Identifier
        • Enabling the CLIENTID_OVERWRITE Event System-Wide
        • Enabling the CLIENTID_OVERWRITE Event for the Current Session
        • Disabling the CLIENTID_OVERWRITE Event
    • User Authentication Data Dictionary Views
  • Configuring Privilege and Role Authorization
    • About Privileges and Roles
    • Who Should Be Granted Privileges?
    • How the Oracle Multitenant Option Affects Privileges
    • Managing Administrative Privileges
      • About Administrative Privileges
      • Grants of Administrative Privileges to Users
      • SYSDBA and SYSOPER Privileges for Standard Database Operations
      • Forcing oracle Users to Enter a Password When Logging in as SYSDBA
      • SYSBACKUP Administrative Privilege for Backup and Recovery Operations
      • SYSDG Administrative Privilege for Oracle Data Guard Operations
      • SYSKM Administrative Privilege for Transparent Data Encryption
      • SYSRAC Administrative Privilege for Oracle Real Application Clusters
    • Managing System Privileges
      • About System Privileges
      • Why Is It Important to Restrict System Privileges?
        • About the Importance of Restricting System Privileges
        • User Access to Objects in the SYS Schema
      • Grants and Revokes of System Privileges
      • Who Can Grant or Revoke System Privileges?
      • About ANY Privileges and the PUBLIC Role
    • Managing Commonly and Locally Granted Privileges
      • About Commonly and Locally Granted Privileges
      • How Commonly Granted System Privileges Work
      • How Commonly Granted Object Privileges Work
      • Granting or Revoking Privileges to Access a PDB
      • Example: Granting a Privilege in a Multitenant Environment
      • Enabling Common Users to View CONTAINER_DATA Object Information
        • Viewing Data About the Root, CDB, and PDBs While Connected to the Root
        • Enabling Common Users to Query Data in Specific PDBs
    • Managing Common Roles and Local Roles
      • About Common Roles and Local Roles
      • How Common Roles Work
      • How the PUBLIC Role Works in a Multitenant Environment
      • Privileges Required to Create, Modify, or Drop a Common Role
      • Rules for Creating Common Roles
      • Creating a Common Role
      • Rules for Creating Local Roles
      • Creating a Local Role
      • Role Grants and Revokes for Common Users and Local Users
    • Managing User Roles
      • About User Roles
        • What Are User Roles?
        • The Functionality of Roles
        • Properties of Roles and Why They Are Advantageous
        • Typical Uses of Roles
        • Common Uses of Application Roles
        • Common Uses of User Roles
        • How Roles Affect the Scope of a User’s Privileges
        • How Roles Work in PL/SQL Blocks
          • Roles Used in Named Blocks with Definer’s Rights
          • Roles Used in Named Blocks with Invoker’s Rights and Anonymous PL/SQL Blocks
        • How Roles Aid or Restrict DDL Usage
        • How Operating Systems Can Aid Roles
        • How Roles Work in a Distributed Environment
      • Predefined Roles in an Oracle Database Installation
      • Creating a Role
        • About the Creation of Roles
        • Creating a Role That Is Authenticated With a Password
        • Creating a Role That Has No Password Authentication
        • Creating a Role That Is External or Global
        • Altering a Role
      • Specifying the Type of Role Authorization
        • Authorizing a Role by Using the Database
        • Authorizing a Role by Using an Application
        • Authorizing a Role by Using an External Source
        • Authorizing a Role by Using the Operating System
        • Authorizing a Role by Using a Network Client
        • Authorizing a Global Role by an Enterprise Directory Service
      • Granting and Revoking Roles
        • About Granting and Revoking Roles
        • Who Can Grant or Revoke Roles?
        • Granting and Revoking Roles to and from Program Units
      • Dropping Roles
      • Restricting SQL*Plus Users from Using Database Roles
        • Potential Security Problems of Using Ad Hoc Tools
        • How the PRODUCT_USER_PROFILE System Table Can Limit Roles
        • How Stored Procedures Can Encapsulate Business Logic
      • Role Privileges and Secure Application Roles
    • Restricting Operations on PDBs Using PDB Lockdown Profiles
      • About PDB Lockdown Profiles
      • PDB Lockdown Profile Inheritance
      • Default PDB Lockdown Profiles
      • Creating a PDB Lockdown Profile
      • Enabling or Disabling a PDB Lockdown Profile
      • Dropping a PDB Lockdown Profile
    • Managing Object Privileges
      • About Object Privileges
      • Who Can Grant Object Privileges?
      • Grants and Revokes of Object Privileges
        • About Granting and Revoking Object Privileges
        • How the ALL Clause Grants or Revokes All Available Object Privileges
      • READ and SELECT Object Privileges
        • About Managing READ and SELECT Object Privileges
        • Enabling Users to Use the READ Object Privilege to Query Any Table in the Database
        • Restrictions on the READ and READ ANY TABLE Privileges
      • Object Privilege Use with Synonyms
      • Sharing Application Common Objects
        • Metadata-Linked Application Common Objects
        • Data-Linked Application Common Objects
        • Extended Data-Linked Application Common Objects
    • Table Privileges
      • How Table Privileges Affect Data Manipulation Language Operations
      • How Table Privileges Affect Data Definition Language Operations
    • View Privileges
      • Privileges Required to Create Views
      • Privileges to Query Views in Other Schemas
      • The Use of Views to Increase Table Security
    • Procedure Privileges
      • The Use of the EXECUTE Privilege for Procedure Privileges
      • Procedure Execution and Security Domains
      • System Privileges Required to Create or Replace a Procedure
      • System Privileges Required to Compile a Procedure
      • How Procedure Privileges Affect Packages and Package Objects
        • About the Effect of Procedure Privileges on Packages and Package Objects
        • Example: Procedure Privileges Used in One Package
        • Example: Procedure Privileges and Package Objects
    • Type Privileges
      • System Privileges for Named Types
      • Object Privileges for Named Types
      • Method Execution Model for Named Types
      • Privileges Required to Create Types and Tables Using Types
      • Example: Privileges for Creating Types and Tables Using Types
      • Privileges on Type Access and Object Access
      • Type Dependencies
    • Grants of User Privileges and Roles
      • Granting System Privileges and Roles to Users and Roles
        • Privileges for Grants of System Privileges and Roles to Users and Roles
        • Example: Granting a System Privilege and a Role to a User
        • Example: Granting the EXECUTE Privilege on a Directory Object
        • Use of the ADMIN Option to Enable Grantee Users to Grant the Privilege
        • Creating a New User with the GRANT Statement
      • Granting Object Privileges to Users and Roles
        • About Granting Object Privileges to Users and Roles
        • How the WITH GRANT OPTION Clause Works
        • Grants of Object Privileges on Behalf of the Object Owner
        • Grants of Privileges on Columns
        • Row-Level Access Control
    • Revokes of Privileges and Roles from a User
      • Revokes of System Privileges and Roles
      • Revokes of Object Privileges
        • About Revokes of Object Privileges
        • Revokes of Multiple Object Privileges
        • Revokes of Object Privileges on Behalf of the Object Owner
        • Revokes of Column-Selective Object Privileges
        • Revokes of the REFERENCES Object Privilege
      • Cascading Effects of Revoking Privileges
        • Cascading Effects When Revoking System Privileges
        • Cascading Effects When Revoking Object Privileges
    • Grants and Revokes of Privileges to and from the PUBLIC Role
    • Grants of Roles Using the Operating System or Network
      • About Granting Roles Using the Operating System or Network
      • Operating System Role Identification
      • Operating System Role Management
      • Role Grants and Revokes When OS_ROLES Is Set to TRUE
      • Role Enablements and Disablements When OS_ROLES Is Set to TRUE
      • Network Connections with Operating System Role Management
    • How Grants and Revokes Work with SET ROLE and Default Role Settings
      • When Grants and Revokes Take Effect
      • How the SET ROLE Statement Affects Grants and Revokes
      • Specifying the Default Role for a User
      • The Maximum Number of Roles That a User Can Have Enabled
    • User Privilege and Role Data Dictionary Views
      • Data Dictionary Views to Find Information about Privilege and Role Grants
      • Query to List All System Privilege Grants
      • Query to List All Role Grants
      • Query to List Object Privileges Granted to a User
      • Query to List the Current Privilege Domain of Your Session
      • Query to List Roles of the Database
      • Query to List Information About the Privilege Domains of Roles
  • Performing Privilege Analysis to Identify Privilege Use
    • What Is Privilege Analysis?
      • About Privilege Analysis
      • Benefits and Use Cases of Privilege Analysis
        • Least Privileges Best Practice
        • Development of Secure Applications
      • Who Can Perform Privilege Analysis?
      • Types of Privilege Analysis
      • How Does a Multitenant Environment Affect Privilege Analysis?
      • How Privilege Analysis Works with Pre-Compiled Database Objects
    • Creating and Managing Privilege Analysis Policies
      • About Creating and Managing Privilege Analysis Policies
      • General Steps for Managing Privilege Analysis
      • Creating a Privilege Analysis Policy
      • Examples of Creating Privilege Analysis Policies
        • Example: Privilege Analysis of Database-Wide Privileges
        • Example: Privilege Analysis of Privilege Usage of Two Roles
        • Example: Privilege Analysis of Privileges During SQL*Plus Use
        • Example: Privilege Analysis of PSMITH Privileges During SQL*Plus Access
      • Enabling a Privilege Analysis Policy
      • Disabling a Privilege Analysis Policy
      • Generating a Privilege Analysis Report
        • About Generating a Privilege Analysis Report
        • General Process for Managing Multiple Named Capture Runs
        • Generating a Privilege Analysis Report Using DBMS_PRIVILEGE_CAPTURE
        • Generating a Privilege Analysis Report Using Cloud Control
        • Accessing Privilege Analysis Reports Using Cloud Control
      • Dropping a Privilege Analysis Policy
    • Creating Roles and Managing Privileges Using Cloud Control
      • Creating a Role from a Privilege Analysis Report in Cloud Control
      • Revoking and Regranting Roles and Privileges Using Cloud Control
      • Generating a Revoke or Regrant Script Using Cloud Control
        • About Generating Revoke and Regrant Scripts
        • Generating a Revoke Script
        • Generating a Regrant Script
    • Tutorial: Using Capture Runs to Analyze ANY Privilege Use
      • Step 1: Create User Accounts
      • Step 2: Create and Enable a Privilege Analysis Policy
      • Step 3: Use the READ ANY TABLE System Privilege
      • Step 4: Disable the Privilege Analysis Policy
      • Step 5: Generate and View a Privilege Analysis Report
      • Step 6: Create a Second Capture Run
      • Step 7: Remove the Components for This Tutorial
    • Tutorial: Analyzing Privilege Use by a User Who Has the DBA Role
      • Step 1: Create User Accounts
      • Step 2: Create and Enable a Privilege Analysis Policy
      • Step 3: Perform the Database Tuning Operations
      • Step 4: Disable the Privilege Analysis Policy
      • Step 5: Generate and View Privilege Analysis Reports
      • Step 6: Remove the Components for This Tutorial
    • Privilege Analysis Policy and Report Data Dictionary Views
  • Configuring Centrally Managed Users with Microsoft Active Directory
    • Introduction to Centrally Managed Users with Microsoft Active Directory
      • About the Oracle Database-Microsoft Active Directory Integration
      • How Centrally Managed Users with Microsoft Active Directory Works
      • Centrally Managed User-Microsoft Active Directory Architecture
      • Supported Authentication Methods
      • Users Supported by Centrally Managed Users with Microsoft Active Directory
      • How the Oracle Multitenant Option Affects Centrally Managed Users
      • Centrally Managed Users with Database Links
    • Configuring the Oracle Database-Microsoft Active Directory Integration
      • About Configuring the Oracle Database-Microsoft Active Directory Connection
      • Connecting to Microsoft Active Directory
        • Step 1: Create an Oracle Service Directory User Account on Microsoft Active Directory and Grant Permissions
        • Step 2: For Password Authentication, Install the Password Filter and Extend the Microsoft Active Directory Schema
        • Step 3: If Necessary, Install the Oracle Database Software
        • Step 4: Create the dsi.ora or ldap.ora File
          • Comparison of the dsi.ora and ldap.ora Files
          • About Using a dsi.ora File
          • Creating the dsi.ora File
          • About Using an ldap.ora File
          • Creating the ldap.ora File
        • Step 5: Request an Active Directory Certificate for a Secure Connection
        • Step 6: Create the Wallet for a Secure Connection
        • Step 7: Configure the Microsoft Active Directory Connection
          • About Configuring the Microsoft Active Directory Connection
          • Configuring the Access Manually Using Database System Parameters
          • Configuring the Access Using the Database Configuration Assistant GUI
          • Configuring the Access Using Database Configuration Assistant Silent Mode
        • Step 8: Verify the Oracle Wallet
        • Step 9: Test the Integration
    • Configuring Authentication for Centrally Managed Users
      • Configuring Password Authentication for Centrally Managed Users
        • About Configuring Password Authentication for Centrally Managed Users
        • Configuring Password Authentication for a Centrally Managed User
        • Logging in to an Oracle Database Using Password Authentication
      • Configuring Kerberos Authentication for Centrally Managed Users
      • Configuring Authentication Using PKI Certificates for Centrally Managed Users
    • Configuring Authorization for Centrally Managed Users
      • About Configuring Authorization for Centrally Managed Users
      • Mapping a Directory Group to a Shared Database Global User
      • Mapping a Directory Group to a Global Role
      • Exclusively Mapping a Directory User to a Database Global User
      • Altering or Migrating a User Mapping Definition
      • Configuring Administrative Users
        • Configuring Database Administrative Users with Shared Access Accounts
        • Configuring Database Administrative Users Using Exclusive Mapping
      • Verifying the Centrally Managed User Logon Information
    • Troubleshooting Centrally Managed Users
      • ORA-28276 Connection Errors
      • ORA-01017 Connection Errors
      • ORA-28274 Connection Errors
      • ORA-28300 Connection Errors
      • Using Trace Files to Diagnose CMU Connection Errors
    • Integration of Oracle Database with Microsoft Active Directory Account Policies
    • Configuring Centrally Managed Users with Oracle Autonomous Database
      • ORA-28276 Connection Errors
      • ORA-01017 Connection Errors
      • ORA-28274 Connection Errors
      • ORA-28300 Connection Errors
      • Using Trace Files to Diagnose CMU Connection Errors
  • Authenticating and Authorizing IAM Users for Oracle DBaaS Databases
    • Introduction to Authenticating and Authorizing IAM Users for Oracle DBaaS
      • About Authenticating and Authorizing IAM Users for Oracle DBaaS
      • Architecture of the IAM Integration with Oracle DBaaS
      • IAM Users and Groups to Map with Oracle DBaaS
    • Configuring Oracle DBaaS for IAM
      • Enabling External Authentication for Oracle DBaaS
      • Configuring Authorization for IAM Users and Oracle Cloud Infrastructure Applications
        • About Configuring Authorization for IAM Users and Oracle Cloud Infrastructure Applications
        • Mapping an IAM Group to a Shared Oracle Database Global User
        • Mapping an IAM Group to an Oracle Database Global Role
        • Exclusively Mapping an IAM User to an Oracle Database Global User
        • Altering or Migrating an IAM User Mapping Definition
        • Mapping Instance and Resource Principals
        • Verifying the IAM User Logon Information
      • Configuring IAM Proxy Authentication
        • About Configuring IAM Proxy Authentication
        • Configuring Proxy Authentication for the IAM User
        • Validating the IAM User Proxy Authentication
    • Configuring IAM for Oracle DBaaS
      • Creating an IAM Policy to Authorize Users Authenticating with Tokens
      • Creating an IAM Database Password
    • Accessing the Database Using an Instance Principal or a Resource Principal
    • Configuring the Database Client Connection
      • About Connecting to an Autonomous Database Instance Using IAM
      • Supported Client Drivers for IAM Connections
      • Using Centralized Oracle Cloud Infrastructure Services for Net Naming and Secrets
      • Client Connections That Use an IAM Database Password Verifier
      • Client Connections That Use a Token Requested by an IAM User Name and Database Password
        • About Client Connections That Use a Token Requested by an IAM User Name and Database Password
        • Parameters to Set for Client Connections That Use a Token Requested by an IAM User Name and Database Password
        • Configuring the Database Client to Retrieve a Token Using an IAM User Name and Database Password
        • Configuring a Secure External Password Store Wallet to Retrieve an IAM Token
      • Client Connections That Use a Token Requested by a Client Application or Tool
      • TLS Connections without Client Wallets
      • Common Database Client Configurations
        • Configuring a Client Connection for SQL*Plus That Uses an IAM Database Password
        • Configuring a Client Connection for SQL*Plus That Uses an IAM Token
    • Accessing a Database Cross-Tenancy Using an IAM Integration
      • About Cross-Tenancy Access for IAM Users to DBaaS Instances
      • Configuring Policies
        • Configuring the Source User Tenancy
        • Configuring the Target Database Resource Tenancy
        • Policy Examples for Cross-Tenancy Access
      • Mapping Database Schemas and Roles to Users and Groups in Another Tenancy
      • Configuring Database Clients for Cross-Tenancy Access
      • Requesting Cross-Tenancy Tokens Using the OCI Command-Line Interface
    • Database Links in an Oracle DBaaS-to-IAM Integration
    • Troubleshooting IAM Connections
      • Areas to Check on the Client-Side for ORA-01017 Errors
      • Database Client Trace Files
      • Check in the Oracle Cloud Infrastructure IAM and the Oracle Database for ORA-01017 Errors
      • ORA-01017 Errors Caused by Improperly Configured IAM Users
      • ORA-12599 and ORA-03114 Errors Caused When Trying to Access a Database Using a Token
      • Actions IAM Administrators Can Take to Address ORA-01017 Errors
  • Authenticating and Authorizing Microsoft Azure Active Directory Users for Oracle Databases
    • Introduction to Oracle Database Integration with Microsoft Azure AD
      • About Integrating Oracle Database with Microsoft Azure AD
      • Architecture of Oracle Database Integration with Microsoft Azure AD
      • Azure AD Users Mapping to an Oracle Database Schema and Roles
      • Use Cases for Connecting to an Oracle Database Using Azure AD
      • General Process of Authenticating Microsoft Azure AD Identities with Oracle Database
    • Configuring the Oracle Database for Microsoft Azure AD Integration
      • Oracle Database Requirements for the Microsoft Azure AD Integration
      • Registering the Oracle Database Instance with a Microsoft Azure AD Tenancy
      • Enabling Microsoft Azure AD v2 Access Tokens
      • Managing App Roles in Microsoft Azure AD
        • Creating a Microsoft Azure AD App Role
        • Assigning Users and Groups to the Microsoft Azure AD App Role
        • Assigning an Application to an App Role
      • Enabling Azure AD External Authentication for Oracle Database
      • Disabling Azure AD External Authentication for Oracle Database
    • Mapping Oracle Database Schemas and Roles
      • Exclusively Mapping an Oracle Database Schema to a Microsoft Azure AD User
      • Mapping a Shared Oracle Schema to an App Role
      • Mapping an Oracle Database Global Role to an App Role
    • Configuring Azure AD Client Connections to the Oracle Database
      • About Configuring Client Connections to Azure ADs
      • Supported Client Drivers for Azure AD Connections
      • Using Centralized Oracle Cloud Infrastructure Services for Net Naming and Secrets
      • Operational Flow for SQL*Plus Client Connection in PowerShell to Oracle Database
      • Registering a Client with Azure AD Application Registration
        • Confidential and Public Client Registration
        • Registering a Database Client App with Entra ID
      • Examples of Retrieving Azure AD OAuth2 Tokens
        • Example: Using PowerShell to Get a Token Using Resource Owner Password Credentials
        • Example: Using Python with Microsoft Authentication Library Using an Authorization Flow
        • Example: Using Curl with a Resource Owner Password Credential Flow
        • Example: Azure CLI Using Authorization Flow
      • Configuring SQL*Plus for Azure AD Access Tokens
      • Creating a Network Proxy for the Database to Connect with the Internet
        • About Creating a Network Proxy for the Database to Connect with the Internet
        • Testing the Accessibility of the Azure Endpoint
        • Creating the Network Proxy for the Default Oracle Database Environment
        • Creating the Network Proxy for an Oracle Real Application Clusters Environment
        • Creating the Network Proxy in the Windows Registry Editor
      • Enabling Clients to Directly Retrieve Azure Tokens
    • Configuring Microsoft Azure AD Proxy Authentication
      • About Configuring Microsoft Azure AD Proxy Authentication
      • Configuring Proxy Authentication for the Azure AD User
      • Validating the Azure AD User Proxy Authentication
    • Troubleshooting Microsoft Azure AD Connections
      • Trace Files for Troubleshooting Oracle Database Client Connections with Azure AD
        • About Trace Files Used for Troubleshooting Connections
        • Setting Client Tracing for Token Authentication
      • ORA-12599 and ORA-03114 Errors Caused When Trying to Access a Database Using a Token
      • Checking the Azure AD Access Token Version
  • Managing Security for Definer’s Rights and Invoker’s Rights
    • About Definer’s Rights and Invoker’s Rights
    • How Procedure Privileges Affect Definer’s Rights
    • How Procedure Privileges Affect Invoker’s Rights
    • When You Should Create Invoker’s Rights Procedures
    • Controlling Invoker’s Rights Privileges for Procedure Calls and View Access
      • How the Privileges of a Schema Affect the Use of Invoker’s Rights Procedures
      • How the INHERIT [ANY] PRIVILEGES Privileges Control Privilege Access
      • Grants of the INHERIT PRIVILEGES Privilege to Other Users
      • Example: Granting INHERIT PRIVILEGES on an Invoking User
      • Example: Revoking INHERIT PRIVILEGES
      • Grants of the INHERIT ANY PRIVILEGES Privilege to Other Users
      • Example: Granting INHERIT ANY PRIVILEGES to a Trusted Procedure Owner
      • Managing INHERIT PRIVILEGES and INHERIT ANY PRIVILEGES
    • Definer’s Rights and Invoker’s Rights in Views
      • About Controlling Definer’s Rights and Invoker’s Rights in Views
      • Using the BEQUEATH Clause in the CREATE VIEW Statement
      • Finding the User Name or User ID of the Invoking User
      • Finding BEQUEATH DEFINER and BEQUEATH_CURRENT_USER Views
    • Using Code Based Access Control for Definer’s Rights and Invoker’s Rights
      • About Using Code Based Access Control for Applications
      • Who Can Grant Code Based Access Control Roles to a Program Unit?
      • How Code Based Access Control Works with Invoker’s Rights Program Units
      • How Code Based Access Control Works with Definer’s Rights Program Units
      • Grants of Database Roles to Users for Their CBAC Grants
      • Grants and Revokes of Database Roles to a Program Unit
      • Tutorial: Controlling Access to Sensitive Data Using Code Based Access Control
        • About This Tutorial
        • Step 1: Create the User and Grant HR the CREATE ROLE Privilege
        • Step 2: Create the print_employees Invoker’s Rights Procedure
        • Step 3: Create the hr_clerk Role and Grant Privileges for It
        • Step 4: Test the Code Based Access Control HR.print_employees Procedure
        • Step 5: Create the view_emp_role Role and Grant Privileges for It
        • Step 6: Test the HR.print_employees Procedure Again
        • Step 7: Remove the Components of This Tutorial
    • Controlling Definer’s Rights Privileges for Database Links
      • About Controlling Definer’s Rights Privileges for Database Links
      • Grants of the INHERIT REMOTE PRIVILEGES Privilege to Other Users
      • Example: Granting INHERIT REMOTE PRIVILEGES on a Connected User
      • Grants of the INHERIT ANY REMOTE PRIVILEGES Privilege to Other Users
      • Revokes of the INHERIT [ANY] REMOTE PRIVILEGES Privilege
      • Example: Revoking the INHERIT REMOTE PRIVILEGES Privilege
      • Example: Revoking the INHERIT REMOTE PRIVILEGES Privilege from PUBLIC
      • Tutorial: Using a Database Link in a Definer’s Rights Procedure
        • About This Tutorial
        • Step 1: Create User Accounts
        • Step 2: As User dbuser2, Create a Table to Store User IDs
        • Step 3: As User dbuser1, Create a Database Link and Definer’s Rights Procedure
        • Step 4: Test the Definer’s Rights Procedure
        • Step 5: Remove the Components of This Tutorial
  • Managing Fine-Grained Access in PL/SQL Packages and Types
    • About Managing Fine-Grained Access in PL/SQL Packages and Types
    • About Fine-Grained Access Control to External Network Services
    • About Access Control to Oracle Wallets
    • Upgraded Applications That Depend on Packages That Use External Network Services
    • Configuring Access Control for External Network Services
      • Syntax for Configuring Access Control for External Network Services
      • Enabling the Listener to Recognize Access Control for External Network Services
      • Example: Configuring Access Control for External Network Services
      • Revoking Access Control Privileges for External Network Services
      • Example: Revoking External Network Services Privileges
    • Configuring Access Control to an Oracle Wallet
      • About Configuring Access Control to an Oracle Wallet
      • Step 1: Create an Oracle Wallet
      • Step 2: Configure Access Control Privileges for the Oracle Wallet
      • Step 3: Make the HTTP Request with the Passwords and Client Certificates
        • Making the HTTPS Request with the Passwords and Client Certificates
        • Using a Request Context to Hold the Wallet When Sharing the Session with Other Applications
        • Use of Only a Client Certificate to Authenticate
        • Use of a Password to Authenticate
      • Revoking Access Control Privileges for Oracle Wallets
      • Troubleshooting ORA-29024 Errors
    • Examples of Configuring Access Control for External Network Services
      • Example: Configuring Access Control for a Single Role and Network Connection
      • Example: Configuring Access Control for a User and Role
      • Example: Using the DBA_HOST_ACES View to Show Granted Privileges
      • Example: Configuring ACL Access Using Passwords in a Non-Shared Wallet
      • Example: Configuring ACL Access for a Wallet in a Shared Database Session
    • Specifying a Group of Network Host Computers
    • Precedence Order for a Host Computer in Multiple Access Control List Assignments
    • Precedence Order for a Host in Access Control List Assignments with Port Ranges
    • Checking Privilege Assignments That Affect User Access to Network Hosts
      • About Privilege Assignments that Affect User Access to Network Hosts
      • How to Check User Network Connection and Domain Privileges
      • Example: Administrator Checking User Network Access Control Permissions
      • How Users Can Check Their Network Connection and Domain Privileges
      • Example: User Checking Network Access Control Permissions
    • Configuring Network Access for Java Debug Wire Protocol Operations
    • Data Dictionary Views for Access Control Lists Configured for User Access
  • Managing Security for a Multitenant Environment in Enterprise Manager
    • About Managing Security for a Multitenant Environment in Enterprise Manager
    • Logging into a Multitenant Environment in Enterprise Manager
      • Logging into a CDB or a PDB
      • Switching to a Different PDB or to the Root
    • Managing Common and Local Users in Enterprise Manager
      • Creating a Common User Account in Enterprise Manager
      • Editing a Common User Account in Enterprise Manager
      • Dropping a Common User Account in Enterprise Manager
      • Creating a Local User Account in Enterprise Manager
      • Editing a Local User Account in Enterprise Manager
      • Dropping a Local User Account in Enterprise Manager
    • Managing Common and Local Roles and Privileges in Enterprise Manager
      • Creating a Common Role in Enterprise Manager
      • Editing a Common Role in Enterprise Manager
      • Dropping a Common Role in Enterprise Manager
      • Revoking Common Privilege Grants in Enterprise Manager
      • Creating a Local Role in Enterprise Manager
      • Editing a Local Role in Enterprise Manager
      • Dropping a Local Role in Enterprise Manager
      • Revoking Local Privilege Grants in Enterprise Manager
• Part II Application Development Security
  • Managing Security for Application Developers
    • About Application Security Policies
    • Considerations for Using Application-Based Security
      • Are Application Users Also Database Users?
      • Is Security Better Enforced in the Application or in the Database?
    • Securing Passwords in Application Design
      • General Guidelines for Securing Passwords in Applications
        • Platform-Specific Security Threats
        • Guidelines for Designing Applications to Handle Password Input
        • Guidelines for Configuring Password Formats and Behavior
        • Guidelines for Handling Passwords in SQL Scripts
      • Use of an External Password Store to Secure Passwords
      • Securing Passwords Using the ORAPWD Utility
      • Example: Java Code for Reading Passwords
    • Securing External Procedures
      • About Securing External Procedures
      • General Process for Configuring extproc for a Credential Authentication
      • extproc Process Authentication and Impersonation Expected Behaviors
      • Configuring Authentication for External Procedures
      • External Procedures for Legacy Applications
    • Securing LOBs with LOB Locator Signatures
      • About Securing LOBs with LOB Locator Signatures
      • Managing the Encryption of a LOB Locator Signature Key
    • Managing Application Privileges
    • Advantages of Using Roles to Manage Application Privileges
    • Creating Secure Application Roles to Control Access to Applications
      • Step 1: Create the Secure Application Role
      • Step 2: Create a PL/SQL Package to Define the Access Policy for the Application
        • About Creating a PL/SQL Package to Define the Access Policy for an Application
        • Creating a PL/SQL Package or Procedure to Define the Access Policy for an Application
        • Testing the Secure Application Role
    • Association of Privileges with User Database Roles
      • Why Users Should Only Have the Privileges of the Current Database Role
      • Use of the SET ROLE Statement to Automatically Enable or Disable Roles
    • Protecting Database Objects by Using Schemas
      • Protecting Database Objects in a Unique Schema
      • Protection of Database Objects in a Shared Schema
    • Object Privileges in an Application
      • What Application Developers Must Know About Object Privileges
      • SQL Statements Permitted by Object Privileges
    • Parameters for Enhanced Security of Database Communication
      • Bad Packets Received on the Database from Protocol Errors
      • Controlling Server Execution After Receiving a Bad Packet
      • Configuration of the Maximum Number of Authentication Attempts
      • Configuring the Display of the Database Version Banner
      • Configuring Banners for Unauthorized Access and Auditing User Actions
• Part III Controlling Access to Data
  • Using Application Contexts to Retrieve User Information
    • About Application Contexts
      • What Is an Application Context?
      • Components of the Application Context
      • Where Are the Application Context Values Stored?
      • Benefits of Using Application Contexts
      • How Editions Affects Application Context Values
      • Application Contexts in a Multitenant Environment
    • Types of Application Contexts
    • Using Database Session-Based Application Contexts
      • About Database Session-Based Application Contexts
      • Components of a Database Session-Based Application Context
      • Creating Database Session-Based Application Contexts
        • About Creating Database Session-Based Application Contexts
        • Creating a Database Session-Based Application Context
        • Database Session-Based Application Contexts for Multiple Applications
      • Creating a Package to Set a Database Session-Based Application Context
        • About the Package That Manages the Database Session-Based Application Context
        • Using the SYS_CONTEXT Function to Retrieve Session Information
        • Checking the SYS_CONTEXT Settings
        • Dynamic SQL with SYS_CONTEXT
        • SYS_CONTEXT in a Parallel Query
        • SYS_CONTEXT with Database Links
        • DBMS_SESSION.SET_CONTEXT for Setting Session Information
        • Example: Simple Procedure to Create an Application Context Value
      • Logon Triggers to Run a Database Session Application Context Package
      • Example: Creating a Simple Logon Trigger
      • Example: Creating a Logon Trigger for a Production Environment
      • Example: Creating a Logon Trigger for a Development Environment
      • Tutorial: Creating and Using a Database Session-Based Application Context
        • Step 1: Create User Accounts and Ensure the User SCOTT Is Active
        • Step 2: Create the Database Session-Based Application Context
        • Step 3: Create a Package to Retrieve Session Data and Set the Application Context
        • Step 4: Create a Logon Trigger for the Package
        • Step 5: Test the Application Context
        • Step 6: Remove the Components of This Tutorial
      • Initializing Database Session-Based Application Contexts Externally
        • About Initializing Database Session-Based Application Contexts Externally
        • Default Values from Users
        • Values from Other External Resources
        • Example: Creating an Externalized Database Session-based Application Context
        • Initialization of Application Context Values from a Middle-Tier Server
      • Initializing Database Session-Based Application Contexts Globally
        • About Initializing Database Session-Based Application Contexts Globally
        • Database Session-Based Application Contexts with LDAP
        • How Globally Initialized Database Session-Based Application Contexts Work
        • Initializing a Database Session-Based Application Context Globally
      • Externalized Database Session-Based Application Contexts
    • Global Application Contexts
      • About Global Application Contexts
      • Uses for Global Application Contexts
      • Components of a Global Application Context
      • Global Application Contexts in an Oracle Real Application Clusters Environment
      • Creating Global Application Contexts
        • Ownership of the Global Application Context
        • Creating a Global Application Context
      • PL/SQL Package to Manage a Global Application Context
        • About the Package That Manages the Global Application Context
        • How Editions Affects the Results of a Global Application Context PL/SQL Package
        • DBMS_SESSION.SET_CONTEXT username and client_id Parameters
        • Sharing Global Application Context Values for All Database Users
        • Example: Package to Manage Global Application Values for All Database Users
        • Global Contexts for Database Users Who Move Between Applications
        • Global Application Context for Nondatabase Users
        • Example: Package to Manage Global Application Context Values for Nondatabase Users
        • Clearing Session Data When the Session Closes
      • Embedding Calls in Middle-Tier Applications to Manage the Client Session ID
        • About Managing Client Session IDs Using a Middle-Tier Application
        • Step 1: Retrieve the Client Session ID Using a Middle-Tier Application
        • Step 2: Set the Client Session ID Using a Middle-Tier Application
          • About Setting the Client Session ID Using a Middle-Tier Application
          • Setting the Client Session ID Using a Middle-Tier Application
          • Checking the Value of the Client Identifier
        • Step 3: Clear the Session Data Using a Middle-Tier Application
      • Tutorial: Creating a Global Application Context That Uses a Client Session ID
        • About This Tutorial
        • Step 1: Create User Accounts
        • Step 2: Create the Global Application Context
        • Step 3: Create a Package for the Global Application Context
        • Step 4: Test the Newly Created Global Application Context
        • Step 5: Modify the Session ID and Test the Global Application Context Again
        • Step 6: Remove the Components of This Tutorial
      • Global Application Context Processes
        • Simple Global Application Context Process
        • Global Application Context Process for Lightweight Users
    • Using Client Session-Based Application Contexts
      • About Client Session-Based Application Contexts
      • Setting a Value in the CLIENTCONTEXT Namespace
      • Retrieving the CLIENTCONTEXT Namespace
      • Example: Retrieving a Client Session ID Value for Client Session-Based Contexts
      • Clearing a Setting in the CLIENTCONTEXT Namespace
      • Clearing All Settings in the CLIENTCONTEXT Namespace
    • Application Context Data Dictionary Views
  • Using Oracle Virtual Private Database to Control Data Access
    • About Oracle Virtual Private Database
      • What Is Oracle Virtual Private Database?
      • Benefits of Using Oracle Virtual Private Database Policies
        • Security Policies Based on Database Objects Rather Than Applications
        • Control Over How Oracle Database Evaluates Policy Functions
      • Who Can Create Oracle Virtual Private Database Policies?
      • Privileges to Run Oracle Virtual Private Database Policy Functions
      • Oracle Virtual Private Database Use with an Application Context
      • Oracle Virtual Private Database in a Multitenant Environment
    • Components of an Oracle Virtual Private Database Policy
      • Function to Generate the Dynamic WHERE Clause
      • Policies to Attach the Function to the Objects You Want to Protect
    • Configuration of Oracle Virtual Private Database Policies
      • About Oracle Virtual Private Database Policies
      • Attaching a Policy to a Database Table, View, or Synonym
      • Example: Attaching a Simple Oracle Virtual Private Database Policy to a Table
      • Enforcing Policies on Specific SQL Statement Types
      • Example: Specifying SQL Statement Types with DBMS_RLS.ADD_POLICY
      • Control of the Display of Column Data with Policies
        • Policies for Column-Level Oracle Virtual Private Database
        • Example: Creating a Column-Level Oracle Virtual Private Database Policy
        • Display of Only the Column Rows Relevant to the Query
        • Column Masking to Display Sensitive Columns as NULL Values
        • Example: Adding Column Masking to an Oracle Virtual Private Database Policy
      • Oracle Virtual Private Database Policy Groups
        • About Oracle Virtual Private Database Policy Groups
        • Creation of a New Oracle Virtual Private Database Policy Group
        • Default Policy Group with the SYS_DEFAULT Policy Group
        • Multiple Policies for Each Table, View, or Synonym
        • Validation of the Application Used to Connect to the Database
      • Optimizing Performance by Using Oracle Virtual Private Database Policy Types
        • About Oracle Virtual Private Database Policy Types
        • Dynamic Policy Type to Automatically Rerun Policy Functions
        • Example: Creating a DYNAMIC Policy with DBMS_RLS.ADD_POLICY
        • Static Policy to Prevent Policy Functions from Rerunning for Each Query
        • Example: Creating a Static Policy with DBMS_RLS.ADD_POLICY
        • Example: Shared Static Policy to Share a Policy with Multiple Objects
        • When to Use Static and Shared Static Policies
        • Context-Sensitive Policy for Application Context Attributes That Change
        • Example: Creating a Context-Sensitive Policy with DBMS_RLS.ADD_POLICY
        • Example: Refreshing Cached Statements for a VPD Context-Sensitive Policy
        • Example: Altering an Existing Context-Sensitive Policy
        • Example: Using a Shared Context Sensitive Policy to Share a Policy with Multiple Objects
        • When to Use Context-Sensitive and Shared Context-Sensitive Policies
        • Summary of the Five Oracle Virtual Private Database Policy Types
    • Tutorials: Creating Oracle Virtual Private Database Policies
      • Tutorial: Creating a Simple Oracle Virtual Private Database Policy
        • About This Tutorial
        • Step 1: Ensure That the OE User Account Is Active
        • Step 2: Create a Policy Function
        • Step 3: Create the Oracle Virtual Private Database Policy
        • Step 4: Test the Policy
        • Step 5: Remove the Components of This Tutorial
      • Tutorial: Implementing a Session-Based Application Context Policy
        • About This Tutorial
        • Step 1: Create User Accounts and Sample Tables
        • Step 2: Create a Database Session-Based Application Context
        • Step 3: Create a PL/SQL Package to Set the Application Context
        • Step 4: Create a Logon Trigger to Run the Application Context PL/SQL Package
        • Step 5: Test the Logon Trigger
        • Step 6: Create a PL/SQL Policy Function to Limit User Access to Their Orders
        • Step 7: Create the New Security Policy
        • Step 8: Test the New Policy
        • Step 9: Remove the Components of This Tutorial
      • Tutorial: Implementing an Oracle Virtual Private Database Policy Group
        • About This Tutorial
        • Step 1: Create User Accounts and Other Components for This Tutorial
        • Step 2: Create the Two Policy Groups
        • Step 3: Create PL/SQL Functions to Control the Policy Groups
        • Step 4: Create the Driving Application Context
        • Step 5: Add the PL/SQL Functions to the Policy Groups
        • Step 6: Test the Policy Groups
        • Step 7: Remove the Components of This Tutorial
    • How Oracle Virtual Private Database Works with Other Oracle Features
      • Oracle Virtual Private Database Policies with Editions
      • SELECT FOR UPDATE Statement in User Queries on VPD-Protected Tables
      • Oracle Virtual Private Database Policies and Outer or ANSI Joins
      • Oracle Virtual Private Database Security Policies and Applications
      • Automatic Reparsing for Fine-Grained Access Control Policies Functions
      • Oracle Virtual Private Database Policies and Flashback Queries
      • Oracle Virtual Private Database and Oracle Label Security
        • Using Oracle Virtual Private Database to Enforce Oracle Label Security Policies
        • Oracle Virtual Private Database and Oracle Label Security Exceptions
      • Export of Data Using the EXPDP Utility access_method Parameter
      • User Models and Oracle Virtual Private Database
    • Oracle Virtual Private Database Data Dictionary Views
  • Using Transparent Sensitive Data Protection
    • About Transparent Sensitive Data Protection
    • General Steps for Using Transparent Sensitive Data Protection
    • Use Cases for Transparent Sensitive Data Protection Policies
    • Privileges Required for Using Transparent Sensitive Data Protection
    • How a Multitenant Environment Affects Transparent Sensitive Data Protection
    • Creating Transparent Sensitive Data Protection Policies
      • Step 1: Create a Sensitive Type
      • Step 2: Identify the Sensitive Columns to Protect
      • Step 3: Import the Sensitive Columns List from ADM into Your Database
      • Step 4: Create the Transparent Sensitive Data Protection Policy
        • About Creating the Transparent Sensitive Data Protection Policy
        • Creating the Transparent Sensitive Data Protection Policy
        • Setting the Oracle Data Redaction or Virtual Private Database Feature Options
        • Setting Conditions for the Transparent Sensitive Data Protection Policy
        • Specifying the DBMS_TSDP_PROTECT.ADD_POLICY Procedure
      • Step 5: Associate the Policy with a Sensitive Type
      • Step 6: Enable the Transparent Sensitive Data Protection Policy
        • Enabling Protection for the Current Database in a Protected Source
        • Enabling Protection for a Specific Table Column
        • Enabling Protection for a Specific Column Type
      • Step 7: Optionally, Export the Policy to Other Databases
    • Altering Transparent Sensitive Data Protection Policies
    • Disabling Transparent Sensitive Data Protection Policies
    • Dropping Transparent Sensitive Data Protection Policies
    • Using the Predefined REDACT_AUDIT Policy to Mask Bind Values
      • About the REDACT_AUDIT Policy
      • Variables Associated with Sensitive Columns
        • About Variables Associated with Sensitive Columns
        • Bind Variables and Sensitive Columns in the Expressions of Conditions
        • A Bind Variable and a Sensitive Column Appearing in the Same SELECT Item
        • Bind Variables in Expressions Assigned to Sensitive Columns in INSERT or UPDATE Operations
      • How Bind Variables on Sensitive Columns Behave with Views
      • Disabling the REDACT_AUDIT Policy
      • Enabling the REDACT_AUDIT Policy
    • Transparent Sensitive Data Protection Policies with Data Redaction
    • Using Transparent Sensitive Data Protection Policies with Oracle VPD Policies
      • About Using TSDP Policies with Oracle Virtual Private Database Policies
      • DBMS_RLS.ADD_POLICY Parameters That Are Used for TSDP Policies
      • Tutorial: Creating a TSDP Policy That Uses Virtual Private Database Protection
        • Step 1: Create the hr_appuser User Account
        • Step 2: Identify the Sensitive Columns
        • Step 3: Create an Oracle Virtual Private Database Function
        • Step 4: Create and Enable a Transparent Sensitive Data Protection Policy
        • Step 5: Test the Transparent Sensitive Data Protection Policy
        • Step 6: Remove the Components of This Tutorial
    • Using Transparent Sensitive Data Protection Policies with Unified Auditing
      • About Using TSDP Policies with Unified Audit Policies
      • Unified Audit Policy Settings That Are Used with TSDP Policies
    • Using Transparent Sensitive Data Protection Policies with Fine-Grained Auditing
      • About Using TSDP Policies with Fine-Grained Auditing
      • Fine-Grained Auditing Parameters That Are Used with TSDP Policies
    • Using Transparent Sensitive Data Protection Policies with TDE Column Encryption
      • About Using TSDP Policies with TDE Column Encryption
      • TDE Column Encryption ENCRYPT Clause Settings Used with TSDP Policies
    • Transparent Sensitive Data Protection Data Dictionary Views
  • Encryption of Sensitive Credential Data in the Data Dictionary
    • About Encrypting Sensitive Credential Data in the Data Dictionary
    • How the Multitenant Option Affects the Encryption of Sensitive Data
    • Encrypting Sensitive Credential Data in System Tables
    • Rekeying Sensitive Credential Data in the SYS.LINK$ System Table
    • Deleting Sensitive Credential Data in System Tables
    • Restoring the Functioning of Database Links After a Lost Keystore
    • Data Dictionary Views for Encrypted Data Dictionary Credentials
  • Manually Encrypting Data
    • Security Problems That Encryption Does Not Solve
      • Principle 1: Encryption Does Not Solve Access Control Problems
      • Principle 2: Encryption Does Not Protect Against a Malicious Administrator
      • Principle 3: Encrypting Everything Does Not Make Data Secure
    • Data Encryption Challenges
      • Encrypted Indexed Data
      • Generated Encryption Keys
      • Transmitted Encryption Keys
      • Storing Encryption Keys
        • About Storing Encryption Keys
        • Storage of Encryption Keys in the Database
        • Storage of Encryption Keys in the Operating System
        • Users Managing Their Own Encryption Keys
        • Manual Encryption with Transparent Database Encryption and Tablespace Encryption
      • Importance of Changing Encryption Keys
      • Encryption of Binary Large Objects
    • Data Encryption Storage with the DBMS_CRYPTO Package
    • Asymmetric Key Operations with the DBMS_CRYPTO Package
    • Using Ciphertexts Encrypted in OFB Mode in Oracle Database Release 11g
    • Examples of Using the Data Encryption API
      • Example: Data Encryption Procedure
      • Example: AES 256-Bit Data Encryption and Decryption Procedures
      • Example: Encryption and Decryption Procedures for BLOB Data
    • Data Dictionary Views for Encrypted Data
• Part IV Securing Data on the Network
  • Configuring Oracle Database Native Network Encryption and Data Integrity
    • About Oracle Database Native Network Encryption and Data Integrity
      • How Oracle Database Native Network Encryption and Integrity Works
      • Advanced Encryption Standard
      • Triple-DES Encryption
      • Choosing Between Native Network Encryption and Transport Layer Security
    • Oracle Database Native Network Encryption Data Integrity
    • Improving Native Network Encryption Security
      • About Improving Native Network Encryption Security
      • Applying Security Improvement Updates to Native Network Encryption
    • Data Integrity Algorithms Support
    • Diffie-Hellman Based Key Negotiation
    • Configuration of Data Encryption and Integrity
      • About Activating Encryption and Integrity
      • About Negotiating Encryption and Integrity
        • About the Values for Negotiating Encryption and Integrity
        • REJECTED Configuration Parameter
        • ACCEPTED Configuration Parameter
        • REQUESTED Configuration Parameter
        • REQUIRED Configuration Parameter
      • Configuring Encryption and Integrity Parameters Using Oracle Net Manager
        • Configuring Encryption on the Client and the Server
        • Configuring Integrity on the Client and the Server
        • Enabling Both Oracle Native Encryption and SSL Authentication for Different Users Concurrently
          • About Enabling Both Oracle Native Encryption and SSL Authentication for Different Users Concurrently
          • Configuring Both Oracle Native Encryption and SSL Authentication for Different Users Concurrently
  • Configuring the Thin JDBC Client Network
    • About the Java Implementation
    • Java Database Connectivity Support
    • Thin JDBC Features
    • Implementation Overview
    • Obfuscation of the Java Cryptography Code
    • Configuration Parameters for the Thin JDBC Network Implementation
      • About the Thin JDBC Network Implementation Configuration Parameters
      • Client Encryption Level Parameter
      • Client Encryption Selected List Parameter
      • Client Integrity Level Parameter
      • Client Integrity Selected List Parameter
      • Client Authentication Service Parameter
      • AnoServices Constants
• Part V Managing Strong Authentication
  • Introduction to Strong Authentication
    • What Is Strong Authentication?
    • Centralized Authentication and Single Sign-On
    • How Centralized Network Authentication Works
    • Supported Strong Authentication Methods
      • About Kerberos
      • About Remote Authentication Dial-In User Service (RADIUS)
      • About Transport Layer Security
    • Oracle Database Native Network Encryption/Strong Authentication Architecture
    • System Requirements for Strong Authentication
    • Oracle Database Native Network Encryption and Strong Authentication Restrictions
  • Strong Authentication Administration Tools
    • About the Configuration and Administration Tools
    • Native Network Encryption and Strong Authentication Configuration Tools
      • About Oracle Net Manager
      • Kerberos Adapter Command-Line Utilities
    • Public Key Infrastructure Credentials Management Tools
      • About Oracle Wallet Manager
      • About the orapki Utility
    • Duties of Strong Authentication Administrators
  • Configuring Kerberos Authentication
    • Enabling Kerberos Authentication
      • Step 1: Install Kerberos
      • Step 2: Configure a Service Principal for an Oracle Database Server
      • Step 3: Extract a Service Key Table from Kerberos
      • Step 4: Install an Oracle Database Server and an Oracle Client
      • Step 5: Configure Oracle Net Services and Oracle Database
      • Step 6: Configure Kerberos Authentication
        • Step 6A: Configure Kerberos on the Client and on the Database Server
        • Step 6B: Set the Initialization Parameters
        • Step 6C: Set sqlnet.ora Parameters (Optional)
      • Step 7: Create a Kerberos User
      • Step 8: Create an Externally Authenticated Oracle User
      • Step 9: Get an Initial Ticket for the Kerberos/Oracle User
    • Utilities for the Kerberos Authentication Adapter
      • okinit Utility Options for Obtaining the Initial Ticket
      • oklist Utility Options for Displaying Credentials
      • okdstry Utility Options for Removing Credentials from the Cache File
      • okcreate Utility Options for Automatic Keytab Creation
    • Connecting to an Oracle Database Server Authenticated by Kerberos
    • Configuring Interoperability with a Windows 2008 Domain Controller KDC
      • About Configuring Interoperability with a Microsoft Windows Server Domain Controller KDC
      • Step 1: Configure Oracle Kerberos Client for Windows 2008 Domain Controller
        • Step 1A: Create the Client Kerberos Configuration Files
        • Step 1B: Specify the Oracle Configuration Parameters in the sqlnet.ora File
        • Step 1C: Optionally, Specify Additional Kerberos Principals Using tnsnames.ora
        • Step 1D: Specify the Listening Port Number
      • Step 2: Configure a Microsoft Windows Server Domain Controller KDC for the Oracle Client
        • Step 2A: Create the User Account
        • Step 2B: Create the Oracle Database Principal User Account and Keytab
      • Step 3: Configure Oracle Database for a Microsoft Windows Server Domain Controller KDC
        • Step 3A: Set Configuration Parameters in the sqlnet.ora File
        • Step 3B: Create an Externally Authenticated Oracle User
      • Step 4: Obtain an Initial Ticket for the Kerberos/Oracle User
    • Configuring Kerberos Authentication Fallback Behavior
    • How to Securely Use Database Links with Kerberos and Microsoft Active Directory
    • Troubleshooting the Oracle Kerberos Authentication Configuration
      • Common Kerberos Configuration Problems
      • ORA-12631 Errors in the Kerberos Configuration
      • ORA-28575 Errors in the Kerberos Configuration
      • ORA-01017 Errors in the Kerberos Configuration
      • Enabling Tracing for Kerberos okinit Operations
  • Configuring Transport Layer Security Authentication
    • Transport Layer Security and Secure Sockets Layer
      • The Difference Between Transport Layer Security and Secure Sockets Layer
      • Using Transport Layer Security in a Multitenant Environment
    • How Oracle Database Uses Transport Layer Security for Authentication
    • How Transport Layer Security Works in an Oracle Environment: The TLS Handshake
    • Public Key Infrastructure in an Oracle Environment
      • About Public Key Cryptography
      • Public Key Infrastructure Components in an Oracle Environment
        • Certificate Authority
        • Certificates
        • Certificate Revocation Lists
        • Wallets
        • Hardware Security Modules
    • Transport Layer Security Combined with Other Authentication Methods
      • Architecture: Oracle Database and Transport Layer Security
      • How Transport Layer Security Works with Other Authentication Methods
    • Transport Layer Security and Firewalls
    • Transport Layer Security Usage Issues
    • Transport Layer Security Connection without a Client Wallet
      • About Transport Layer Security Connections without a Client Wallet
      • Configuring a Transport Layer Security Connection without a Client Wallet
    • Transport Layer Security Connection with a Client Wallet
      • Step 1: Configure Transport Layer Security on the Server
        • Step 1A: Confirm Wallet Creation on the Server
        • Step 1B: Specify the Database Wallet Location on the Server
        • Step 1C: Set the Transport Layer Security Cipher Suites on the Server (Optional)
          • About the Transport Layer Security Cipher Suites
          • TLS Cipher Suite Authentication, Encryption, Integrity, and TLS Versions
          • Specifying Transport Layer Security Cipher Suites for the Database Server
        • Step 1D: Set the Required Transport Layer Security Version on the Server (Optional)
        • Step 1E: Set Transport Layer Security Client Authentication on the Server (Optional)
        • Step 1F: Set Transport Layer Security as an Authentication Service on the Server (Optional)
        • Step 1G: Disable SSLv3 on the Server and Client (Optional)
        • Step 1H: Create a Listening Endpoint that Uses TCP/IP with Transport Layer Security on the Server
        • Step 1H: Restart the Database
      • Step 2: Configure Transport Layer Security on the Client
        • Step 2A: Confirm Client Wallet Creation
        • Step 2B: Configure Server DN Matching and Use TCP/IP with TLS on the Client
          • About Configuring the Server DN Matching and Using TCP/IP with TLS on the Client
          • Configuring the Server DN Matching and Using TCP/IP with TLS on the Client
          • Use of the SSL_ALLOW_WEAK_DN_MATCH Parameter to Control SSL_SERVER_DN_MATCH
        • Step 2C: Specify Required Client TLS Configuration (Wallet Location)
        • Step 2D: Set the Client Transport Layer Security Cipher Suites (Optional)
          • About Setting the Client Transport Layer Security Cipher Suites
          • Setting the Client Transport Layer Security Cipher Suites
        • Step 2E: Set the Required TLS Version on the Client (Optional)
        • Step 2F: Set TLS as an Authentication Service on the Client (Optional)
          • About the SQLNET.AUTHENTICATION_SERVICES Parameter
          • Setting the SQLNET.AUTHENTICATION_SERVICES Parameter
        • Step 2G: Specify the Certificate to Use for Authentication on the Client (Optional)
          • About the SQLNET.SSL_EXTENDED_KEY_USAGE Parameter
          • Setting the SQLNET.SSL_EXTENDED_KEY_USAGE Parameter
        • Step 2H: Check That the Connections Are Using Transport Layer Security
        • Step 2I: Restart the Database
      • Step 3: Log in to the Database Instance
    • Oracle Wallet Search Order
    • Transport Layer Security Connections in an Oracle Real Application Clusters Environment
      • Step 1: Configure TCPS Protocol Endpoints
      • Step 2: Ensure That the LOCAL_LISTENER Parameter Is Correctly Set on Each Node
      • Step 3: Create Transport Layer Security Wallets and Certificates
        • Oracle Real Application Clusters Components That Need Certificates
        • Creating Transport Layer Security Wallets and Certificates
      • Step 4: Create a Wallet in Each Node of the Oracle RAC Cluster
      • Step 5: Define Wallet Locations in the listener.ora and sqlnet.ora Files
      • Step 6: Restart the Database Instances and Listeners
      • Step 7: Test the Cluster Node Configuration
      • Step 8: Test the Remote Client Configuration
    • Configuring Transport Layer Security for Client Authentication and Encryption Using Microsoft Certificate Store
      • About Configuring Transport Layer Security for Client Authentication and Encryption Using Microsoft Certificate Store
      • Step 1: Create and Configure the Server Wallet
      • Step 2: Create and Configure the Client Wallet
      • Step 3: Create an External User in the Oracle Database
      • Step 4: Configure the Server listener.ora File
      • Step 5: Configure the Server sqlnet.ora File
      • Step 6: Import the Client Wallet into the Microsoft Certificate Store
      • Step 7: Configure the Client sqlnet.ora File
      • Step 8: Configure the Oracle Database
      • Step 9: Test the Client and Server Connection
    • Troubleshooting the Transport Layer Security Configuration
    • Certificate Validation with Certificate Revocation Lists
      • About Certificate Validation with Certificate Revocation Lists
      • What CRLs Should You Use?
      • How CRL Checking Works
      • Configuring Certificate Validation with Certificate Revocation Lists
        • About Configuring Certificate Validation with Certificate Revocation Lists
        • Enabling Certificate Revocation Status Checking for the Client or Server
        • Disabling Certificate Revocation Status Checking
      • Certificate Revocation List Management
        • About Certificate Revocation List Management
        • Displaying orapki Help for Commands That Manage CRLs
        • Renaming CRLs with a Hash Value for Certificate Validation
        • Uploading CRLs to Oracle Internet Directory
        • Listing CRLs Stored in Oracle Internet Directory
        • Viewing CRLs in Oracle Internet Directory
        • Deleting CRLs from Oracle Internet Directory
      • Troubleshooting CRL Certificate Validation
      • Oracle Net Tracing File Error Messages Associated with Certificate Validation
    • Configuring Your System to Use Hardware Security Modules
      • General Guidelines for Using Hardware Security Modules for TLS
      • Configuring Your System to Use nCipher Hardware Security Modules
        • About Configuring Your System to Use nCipher Hardware Security Modules
        • Oracle Components Required To Use an nCipher Hardware Security Module
        • Directory Path Requirements for Installing an nCipher Hardware Security Module
      • Configuring Your System to Use SafeNET Hardware Security Modules
        • About Configuring Your System to Use SafeNET Hardware Security Modules
        • Oracle Components Required for SafeNET Luna SA Hardware Security Modules
        • Directory Path Requirements for Installing a SafeNET Hardware Security Module
      • Troubleshooting Using Hardware Security Modules
        • Errors in the Oracle Net Trace Files
        • Error Messages Associated with Using Hardware Security Modules
  • About Configuring RADIUS Authentication
    • About Configuring RADIUS Authentication
    • RADIUS Components
    • RADIUS Authentication Modes
      • Synchronous Authentication Mode
        • Sequence for Synchronous Authentication Mode
        • Example: Synchronous Authentication with Tokens
      • Challenge-Response (Asynchronous) Authentication Mode
        • Sequence for Challenge-Response (Asynchronous) Authentication Mode
        • Example: Asynchronous Authentication with Smart Cards
        • Example: Asynchronous Authentication with Tokens
    • RADIUS Parameters
      • RADIUS Parameters for Clients and Servers
      • Minimum RADIUS Parameters
      • Initialization File Parameter for RADIUS
    • Enabling RADIUS Authentication, Authorization, and Accounting
      • Modern Configuration
        • Step 1: Configure RADIUS Authentication
          • Step 1A: Configure RADIUS on the Oracle Client
          • Step 1B: Configure RADIUS on the Oracle Database Server
            • Step 1B (1): Create the RADIUS Secret Key File on the Oracle Database Server
            • Step 1B (2): Configure RADIUS Parameters on the Server (sqlnet.ora file)
            • Step 1B (3): Set Oracle Database Server Initialization Parameters
          • Step 1C: Configure Additional RADIUS Features
            • Step 1C(1): Change Default Settings
            • Step 1C(2): Configure Challenge-Response Mode
            • Step 1C(3): Set Parameters for an Alternate RADIUS Server
        • Step 2: Create a User and Grant Access
        • Step 3: Configure External RADIUS Authorization (Optional)
          • Step 3A: Configure the Oracle Server (RADIUS Client)
          • Step 3B: Configure the Oracle Client Where Users Log In
          • Step 3C: Configure the RADIUS Server
        • Step 4: Configure RADIUS Accounting
          • Step 4A: Set RADIUS Accounting on the Oracle Database Server
          • Step 4B: Configure the RADIUS Accounting Server
        • Step 5: Add the RADIUS Client Name to the RADIUS Server Database
        • Step 6: Configure the Authentication Server for Use with RADIUS
        • Step 7: Configure the RADIUS Server for Use with the Authentication Server
        • Step 8: Configure Mapping Roles
      • Legacy Configuration
        • Step 1: Configure RADIUS Authentication
          • Step 1A: Configure RADIUS on the Oracle Client
          • Step 1B: Configure RADIUS on the Oracle Database Server
            • Step 1B (1): Create the RADIUS Secret Key File on the Oracle Database Server
            • Step 1B (2): Configure RADIUS Parameters on the Server (sqlnet.ora file)
            • Step 1B (3): Set Oracle Database Server Initialization Parameters
          • Step 1C: Configure Additional RADIUS Features
            • Step 1C(1): Change Default Settings
            • Step 1C(2): Configure Challenge-Response Mode
            • Step 1C(3): Set Parameters for an Alternate RADIUS Server
        • Step 2: Create a User and Grant Access
        • Step 3: Configure External RADIUS Authorization (Optional)
          • Step 3A: Configure the Oracle Server (RADIUS Client)
          • Step 3B: Configure the Oracle Client Where Users Log In
          • Step 3C: Configure the RADIUS Server
        • Step 4: Configure RADIUS Accounting
          • Step 4A: Set RADIUS Accounting on the Oracle Database Server
          • Step 4B: Configure the RADIUS Accounting Server
        • Step 5: Add the RADIUS Client Name to the RADIUS Server Database
        • Step 6: Configure the Authentication Server for Use with RADIUS
        • Step 7: Configure the RADIUS Server for Use with the Authentication Server
        • Step 8: Configure Mapping Roles
    • Using RADIUS to Log in to a Database
  • Customizing the Use of Strong Authentication
    • Connecting to a Database Using Strong Authentication
    • Disabling Strong Authentication and Native Network Encryption
    • Configuring Multiple Authentication Methods
    • Configuring Oracle Database for External Authentication
      • Setting the SQLNET.AUTHENTICATION_SERVICES Parameter in sqlnet.ora
      • Setting OS_AUTHENT_PREFIX to a Null Value
• Part VI Monitoring Database Activity with Auditing
  • Introduction to Auditing
    • What Is Auditing?
    • Why Is Auditing Used?
    • Best Practices for Auditing
    • What Is Unified Auditing?
    • Benefits of the Unified Audit Trail
    • Checking if Your Database Has Migrated to Pure Unified Auditing
    • Mixed Mode Auditing
      • About Mixed Mode Auditing
      • Enablement of Unified Auditing
      • How Database Creation Determines the Type of Auditing You Have Enabled
      • Capabilities of Mixed Mode Auditing
    • Who Can Perform Auditing?
    • Unified Auditing in a Multitenant Environment
    • Auditing in a Distributed Database
  • Configuring Audit Policies
    • Selecting an Auditing Type
      • Auditing SQL Statements, Privileges, and Other General Activities
      • Auditing Commonly Used Security-Relevant Activities
      • Auditing Specific, Fine-Grained Activities
    • Auditing Activities with Unified Audit Policies and the AUDIT Statement
      • About Auditing Activities with Unified Audit Policies and AUDIT
      • Best Practices for Creating Custom Unified Audit Policies
      • Syntax for Creating a Unified Audit Policy
      • Auditing Roles
        • About Role Auditing
        • Configuring Role Unified Audit Policies
        • Example: Auditing the DBA Role in a Multitenant Environment
      • Auditing System Privileges
        • About System Privilege Auditing
        • System Privileges That Can Be Audited
        • System Privileges That Cannot Be Audited
        • Configuring a Unified Audit Policy to Capture System Privilege Use
        • Example: Auditing a User Who Has ANY Privileges
        • Example: Using a Condition to Audit a System Privilege
        • How System Privilege Unified Audit Policies Appear in the Audit Trail
      • Auditing Administrative Users
        • Administrative User Accounts That Can Be Audited
        • Configuring a Unified Audit Policy to Capture Administrator Activities
        • Example: Auditing the SYS User
      • Auditing Object Actions
        • About Auditing Object Actions
        • Object Actions That Can Be Audited
        • Configuring an Object Action Unified Audit Policy
        • Example: Auditing Actions on SYS Objects
        • Example: Auditing Multiple Actions on One Object
        • Example: Auditing GRANT and REVOKE Operations on an Object
        • Example: Auditing Both Actions and Privileges on an Object
        • Example: Auditing All Actions on a Table
        • Example: Auditing All Actions in the Database
        • How Object Action Unified Audit Policies Appear in the Audit Trail
        • Auditing Functions, Procedures, Packages, and Triggers
        • Auditing of Oracle Virtual Private Database Predicates
        • Audit Policies for Oracle Virtual Private Database Policy Functions
        • Unified Auditing with Editioned Objects
      • Auditing the READ ANY TABLE and SELECT ANY TABLE Privileges
        • About Auditing the READ ANY TABLE and SELECT ANY TABLE Privileges
        • Creating a Unified Audit Policy to Capture READ Object Privilege Operations
        • How the Unified Audit Trail Captures READ ANY TABLE and SELECT ANY TABLE
      • Auditing SQL Statements and Privileges in a Multitier Environment
      • Creating a Condition for a Unified Audit Policy
        • About Conditions in Unified Audit Policies
        • Configuring a Unified Audit Policy with a Condition
        • Example: Auditing Access to SQL*Plus
        • Example: Auditing Actions Not in Specific Hosts
        • Example: Auditing Both a System-Wide and a Schema-Specific Action
        • Example: Auditing a Condition Per Statement Occurrence
        • Example: Unified Audit Session ID of a Current Administrative User Session
        • Example: Unified Audit Session ID of a Current Non-Administrative User Session
        • How Audit Records from Conditions Appear in the Audit Trail
      • Auditing Application Context Values
        • About Auditing Application Context Values
        • Configuring Application Context Audit Settings
        • Disabling Application Context Audit Settings
        • Example: Auditing Application Context Values in a Default Database
        • Example: Auditing Application Context Values from Oracle Label Security
        • How Audited Application Contexts Appear in the Audit Trail
      • Auditing Oracle Database Real Application Security Events
        • About Auditing Oracle Database Real Application Security Events
        • Oracle Database Real Application Security Auditable Events
        • Oracle Database Real Application Security User, Privilege, and Role Audit Events
        • Oracle Database Real Application Security Security Class and ACL Audit Events
        • Oracle Database Real Application Security Session Audit Events
        • Oracle Database Real Application Security ALL Events
        • Configuring a Unified Audit Policy for Oracle Database Real Application Security
        • Example: Auditing Real Application Security User Account Modifications
        • Example: Using a Condition in a Real Application Security Unified Audit Policy
        • How Oracle Database Real Application Security Events Appear in the Audit Trail
      • Auditing Oracle Recovery Manager Events
        • About Auditing Oracle Recovery Manager Events
        • Oracle Recovery Manager Unified Audit Trail Events
        • How Oracle Recovery Manager Audited Events Appear in the Audit Trail
      • Auditing Oracle Database Vault Events
        • About Auditing Oracle Database Vault Events
        • Who Is Audited in Oracle Database Vault?
        • About Oracle Database Vault Unified Audit Trail Events
        • Oracle Database Vault Realm Audit Events
        • Oracle Database Vault Rule Set and Rule Audit Events
        • Oracle Database Vault Command Rule Audit Events
        • Oracle Database Vault Factor Audit Events
        • Oracle Database Vault Secure Application Role Audit Events
        • Oracle Database Vault Oracle Label Security Audit Events
        • Oracle Database Vault Oracle Data Pump Audit Events
        • Oracle Database Vault Enable and Disable Audit Events
        • Configuring a Unified Audit Policy for Oracle Database Vault
        • Example: Auditing an Oracle Database Vault Realm
        • Example: Auditing an Oracle Database Vault Rule Set
        • Example: Auditing Two Oracle Database Vault Events
        • Example: Auditing Oracle Database Vault Factors
        • How Oracle Database Vault Audited Events Appear in the Audit Trail
      • Auditing Oracle Label Security Events
        • About Auditing Oracle Label Security Events
        • Oracle Label Security Unified Audit Trail Events
        • Oracle Label Security Auditable User Session Labels
        • Configuring a Unified Audit Policy for Oracle Label Security
        • Example: Auditing Oracle Label Security Session Label Attributes
        • Example: Excluding a User from an Oracle Label Security Policy
        • Example: Auditing Oracle Label Security Policy Actions
        • Example: Querying for Audited OLS Session Labels
        • How Oracle Label Security Audit Events Appear in the Audit Trail
      • Auditing Oracle Data Mining Events
        • About Auditing Oracle Data Mining Events
        • Oracle Data Mining Unified Audit Trail Events
        • Configuring a Unified Audit Policy for Oracle Data Mining
        • Example: Auditing Multiple Oracle Data Mining Operations by a User
        • Example: Auditing All Failed Oracle Data Mining Operations by a User
        • How Oracle Data Mining Events Appear in the Audit Trail
      • Auditing Oracle Data Pump Events
        • About Auditing Oracle Data Pump Events
        • Oracle Data Pump Unified Audit Trail Events
        • Configuring a Unified Audit Policy for Oracle Data Pump
        • Example: Auditing Oracle Data Pump Import Operations
        • Example: Auditing All Oracle Data Pump Operations
        • How Oracle Data Pump Audited Events Appear in the Audit Trail
      • Auditing Oracle SQL*Loader Direct Load Path Events
        • About Auditing in Oracle SQL*Loader Direct Path Load Events
        • Oracle SQL*Loader Direct Load Path Unified Audit Trail Events
        • Configuring a Unified Audit Trail Policy for Oracle SQL*Loader Direct Path Events
        • Example: Auditing Oracle SQL*Loader Direct Path Load Operations
        • How SQL*Loader Direct Path Load Audited Events Appear in the Audit Trail
      • Auditing Only Top-Level Statements
        • About Auditing Only Top-Level SQL Statements
        • Configuring a Unified Audit Policy to Capture Only Top-Level Statements
        • Example: Auditing Top-Level Statements
        • Example: Comparison of Top-Level SQL Statement Audits
        • How the Unified Audit Trail Captures Top-Level SQL Statements
      • Unified Audit Policies or AUDIT Settings in a Multitenant Environment
        • About Local, CDB Common, and Application Common Audit Policies
        • Traditional Auditing in a Multitenant Environment
        • Configuring a Local Unified Audit Policy or Common Unified Audit Policy
        • Example: Local Unified Audit Policy
        • Example: CDB Common Unified Audit Policy
        • Example: Application Common Unified Audit Policy
        • How Local or Common Audit Policies or Settings Appear in the Audit Trail
      • Altering Unified Audit Policies
        • About Altering Unified Audit Policies
        • Altering a Unified Audit Policy
        • Example: Altering a Condition in a Unified Audit Policy
        • Example: Altering an Oracle Label Security Component in a Unified Audit Policy
        • Example: Altering Roles in a Unified Audit Policy
        • Example: Dropping a Condition from a Unified Audit Policy
        • Example: Altering an Existing Unified Audit Policy Top-Level Statement Audits
      • Enabling and Applying Unified Audit Policies to Users and Roles
        • About Enabling Unified Audit Policies
        • Enabling a Unified Audit Policy
        • Example: Enabling a Unified Audit Policy
      • Disabling Unified Audit Policies
        • About Disabling Unified Audit Policies
        • Disabling a Unified Audit Policy
        • Example: Disabling a Unified Audit Policy
      • Dropping Unified Audit Policies
        • About Dropping Unified Audit Policies
        • Dropping a Unified Audit Policy
        • Example: Disabling and Dropping a Unified Audit Policy
      • Tutorial: Auditing Nondatabase Users
        • Step 1: Create the User Accounts and Ensure the User OE Is Active
        • Step 2: Create the Unified Audit Policy
        • Step 3: Test the Policy
        • Step 4: Remove the Components of This Tutorial
    • Auditing Activities with the Predefined Unified Audit Policies
      • Logon Failures Predefined Unified Audit Policy
      • Secure Options Predefined Unified Audit Policy
      • Oracle Database Parameter Changes Predefined Unified Audit Policy
      • User Account and Privilege Management Predefined Unified Audit Policy
      • Center for Internet Security Recommendations Predefined Unified Audit Policy
      • Oracle Database Real Application Security Predefined Audit Policies
        • System Administrator Operations Predefined Unified Audit Policy
        • Session Operations Predefined Unified Audit Policy
      • Oracle Database Vault Predefined Unified Audit Policy for DVSYS and LBACSYS Schemas
      • Oracle Database Vault Predefined Unified Audit Policy for Default Realms and Command Rules
    • Auditing Specific Activities with Fine-Grained Auditing
      • About Fine-Grained Auditing
      • Where Are Fine-Grained Audit Records Stored?
      • Who Can Perform Fine-Grained Auditing?
      • Fine-Grained Auditing on Tables or Views That Have Oracle VPD Policies
      • Fine-Grained Auditing in a Multitenant Environment
      • Fine-Grained Audit Policies with Editions
      • Using the DBMS_FGA PL/SQL Package to Manage Fine-Grained Audit Policies
        • About the DBMS_FGA PL/SQL PL/SQL Package
        • The DBMS_FGA PL/SQL Package with Editions
        • The DBMS_FGA PL/SQL Package in a Multitenant Environment
        • Creating a Fine-Grained Audit Policy
          • About Creating a Fine-Grained Audit Policy
          • Syntax for Creating a Fine-Grained Audit Policy
          • Audits of Specific Columns and Rows
        • Example: Using DBMS_FGA.ADD_POLICY to Create a Fine-Grained Audit Policy
        • Disabling a Fine-Grained Audit Policy
        • Enabling a Fine-Grained Audit Policy
        • Dropping a Fine-Grained Audit Policy
      • Tutorial: Adding an Email Alert to a Fine-Grained Audit Policy
        • About This Tutorial
        • Step 1: Install and Configure the UTL_MAIL PL/SQL Package
        • Step 2: Create User Accounts
        • Step 3: Configure an Access Control List File for Network Services
        • Step 4: Create the Email Security Alert PL/SQL Procedure
        • Step 5: Create and Test the Fine-Grained Audit Policy Settings
        • Step 6: Test the Alert
        • Step 7: Remove the Components of This Tutorial
    • Audit Policy Data Dictionary Views
  • Administering the Audit Trail
    • Managing the Unified Audit Trail
      • When and Where Are Audit Records Created?
      • Activities That Are Mandatorily Audited
      • How Do Cursors Affect Auditing?
      • Writing the Unified Audit Trail Records to the AUDSYS Schema
      • Writing the Unified Audit Trail Records to SYSLOG or the Windows Event Viewer
        • About Writing the Unified Audit Trail Records to SYSLOG or the Windows Event Viewer
        • Enabling SYSLOG and Windows Event Viewer Captures for the Unified Audit Trail
      • When Audit Records Are Written to the Operating System
      • Moving Operating System Audit Records into the Unified Audit Trail
      • Exporting and Importing the Unified Audit Trail Using Oracle Data Pump
      • Disabling Unified Auditing
    • Archiving the Audit Trail
      • Archiving the Traditional Operating System Audit Trail
      • Archiving the Unified and Traditional Database Audit Trails
    • Purging Audit Trail Records
      • About Purging Audit Trail Records
      • Selecting an Audit Trail Purge Method
        • Purging the Audit Trail on a Regularly Scheduled Basis
        • Manually Purging the Audit Trail at a Specific Time
      • Scheduling an Automatic Purge Job for the Audit Trail
        • About Scheduling an Automatic Purge Job
        • Step 1: If Necessary, Tune Online and Archive Redo Log Sizes
        • Step 2: Plan a Timestamp and Archive Strategy
        • Step 3: Optionally, Set an Archive Timestamp for Audit Records
        • Step 4: Create and Schedule the Purge Job
      • Manually Purging the Audit Trail
        • About Manually Purging the Audit Trail
        • Using DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL to Manually Purge the Audit Trail
      • Other Audit Trail Purge Operations
        • Enabling or Disabling an Audit Trail Purge Job
        • Setting the Default Audit Trail Purge Job Interval for a Specified Purge Job
        • Deleting an Audit Trail Purge Job
        • Clearing the Archive Timestamp Setting
      • Example: Directly Calling a Unified Audit Trail Purge Operation
      • Purge CLI Records in Databases Upgraded from Oracle Database 12.1 or Earlier
    • Audit Trail Management Data Dictionary Views
• Appendixes
  • Keeping Your Oracle Database Secure
    • About the Oracle Database Security Guidelines
    • Downloading Security Patches and Contacting Oracle Regarding Vulnerabilities
      • Downloading Security Patches and Workaround Solutions
      • Contacting Oracle Security Regarding Vulnerabilities in Oracle Database
    • Guidelines for Securing User Accounts and Privileges
    • Guidelines for Securing Roles
    • Guidelines for Securing Passwords
    • Guidelines for Securing Data
    • Guidelines for Securing the ORACLE_LOADER Access Driver
    • Guidelines for Securing a Database Installation and Configuration
    • Guidelines for Securing the Network
      • Client Connection Security
      • Network Connection Security
      • Transport Layer Security Connection Security
    • Guideline for Securing External Procedures
    • Guidelines for Auditing
      • Manageability of Audited Information
      • Audits of Typical Database Activity
      • Audits of Suspicious Database Activity
      • Audits of Sensitive Data
      • Recommended Audit Settings
      • Best Practices for Querying the UNIFIED_AUDIT_TRAIL Data Dictionary View
    • Addressing the CONNECT Role Change
      • Why Was the CONNECT Role Changed?
      • How the CONNNECT Role Change Affects Applications
        • How the CONNECT Role Change Affects Database Upgrades
        • How the CONNECT Role Change Affects Account Provisioning
        • How the CONNECT Role Change Affects Applications Using New Databases
      • How the CONNECT Role Change Affects Users
        • How the CONNECT Role Change Affects General Users
        • How the CONNECT Role Change Affects Application Developers
        • How the CONNECT Role Change Affects Client Server Applications
      • Approaches to Addressing the CONNECT Role Change
        • Creating a New Database Role
        • Restoring the CONNECT Privilege
        • Data Dictionary View to Show CONNECT Grantees
        • Least Privilege Analysis Studies
  • Data Encryption and Integrity Parameters
    • About Using sqlnet.ora for Data Encryption and Integrity
    • Sample sqlnet.ora File
    • Data Encryption and Integrity Parameters
      • About the Data Encryption and Integrity Parameters
      • SQLNET.ENCRYPTION_SERVER
      • SQLNET.ENCRYPTION_CLIENT
      • SQLNET.CRYPTO_CHECKSUM_SERVER
      • SQLNET.CRYPTO_CHECKSUM_CLIENT
      • SQLNET.ENCRYPTION_TYPES_SERVER
      • SQLNET.ENCRYPTION_TYPES_CLIENT
      • SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER
      • SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT
  • Kerberos, TLS, and RADIUS Authentication Parameters
    • Parameters for Clients and Servers Using Kerberos Authentication
    • Parameters for Clients and Servers Using Transport Layer Security
      • Ways to Configure a Parameter for Transport Layer Security
      • Transport Layer Security Authentication Parameters for Clients and Servers
      • Cipher Suite Parameters for Transport Layer Security
      • Supported Transport Layer Security Cipher Suites
      • Transport Layer Security Version Parameters
        • TLS_DISABLE_VERSION Parameter
      • Transport Layer Security Client Authentication Parameters
      • Transport Layer Security X.509 Server Match Parameters
        • SSL_SERVER_DN_MATCH
        • SSL_SERVER_CERT_DN
      • Oracle Wallet Location
    • Parameters for Clients and Servers Using RADIUS Authentication
      • sqlnet.ora File Parameters
        • SQLNET.AUTHENTICATION_SERVICES
        • SQLNET.RADIUS_ALTERNATE
        • SQLNET.RADIUS_ALTERNATE_PORT
        • SQLNET.RADIUS_ALTERNATE_TIMEOUT
        • SQLNET.RADIUS_ALTERNATE_RETRIES
        • SQLNET.RADIUS_AUTHENTICATION
        • SQLNET.RADIUS_AUTHENTICATION_INTERFACE
        • SQLNET.RADIUS_AUTHENTICATION_PORT
        • SQLNET.RADIUS_AUTHENTICATION_TIMEOUT
        • SQLNET.RADIUS_AUTHENTICATION_RETRIES
        • SQLNET.RADIUS_CHALLENGE_RESPONSE
        • SQLNET.RADIUS_CHALLENGE_KEYWORD
        • SQLNET.RADIUS_CLASSPATH
        • SQLNET.RADIUS_SECRET
        • SQLNET.RADIUS_SEND_ACCOUNTING
      • Minimum RADIUS Parameters
      • Initialization File Parameter for RADIUS
  • Integrating Authentication Devices Using RADIUS
    • About the RADIUS Challenge-Response User Interface
    • Customizing the RADIUS Challenge-Response User Interface
    • Example: Using the OracleRadiusInterface Interface
  • Oracle Database FIPS 140-2 Settings
    • About the Oracle Database FIPS 140-2 Settings
    • Configuring FIPS 140-2 for Transparent Data Encryption and DBMS_CRYPTO
    • Configuration of FIPS 140-2 for Transport Layer Security
      • Configuring the SSLFIPS_140 and SSLFIPS_LIB Parameters for Transport Layer Security
      • Approved TLS Cipher Suites for FIPS 140-2
    • Configuration of FIPS 140-2 for Native Network Encryption
      • About Configuration of FIPS 140-2 for Native Network Encryption
      • Configuring the FIPS_140 Parameter for Native Network Encryption
    • Postinstallation Checks for FIPS 140-2
    • Verifying FIPS 140-2 Connections
      • Verifying FIPS 140-2 Connections for Transport Layer Security
      • Verifying FIPS 140-2 Connections for Network Native Encryption
      • Verifying FIPS 140-2 Connections for Transparent Data Encryption and DBMS_CRYPTO
    • Ensuring Encryption Algorithms are FIPS 140-3 Compliant
  • Managing Public Key Infrastructure (PKI) Elements
    • Uses of the orapki Utility
    • orapki Utility Syntax
    • Creating Signed Certificates for Testing Purposes
    • Viewing a Certificate
    • Importing a User-Supplied or Trusted Certificate into an Oracle Wallet
    • Controlling MD5 and SHA-1 Certificate Use
    • Managing Oracle Wallets with orapki Utility
      • About Managing Wallets with orapki
      • Creating, Viewing, and Modifying Wallets with orapki
        • Creating a PKCS#12 Wallet
        • Using OpenSSL to Create a PKCS#12 Wallet That Has a Certificate Chain
        • Creating an Auto-Login Wallet
        • Creating an Auto-Login Wallet That Is Associated with a PKCS#12 Wallet
        • Creating an Auto-Login Wallet That Is Local to the Computer and User Who Created It
        • Viewing a Wallet
        • Modifying the Password for a Wallet
        • Converting an Oracle Wallet to Use the AES256 Algorithm
      • Adding Certificates and Certificate Requests to Oracle Wallets with orapki
        • Adding a Certificate Request to an Oracle Wallet
        • Adding a Trusted Certificate to an Oracle Wallet
        • Adding a Root Certificate to an Oracle Wallet
        • Adding a User Certificate to an Oracle Wallet
        • Verifying Credentials on the Hardware Device That Uses a PKCS#11 Wallet
        • Adding PKCS#11 Information to an Oracle Wallet
      • Exporting Certificates and Certificate Requests from Oracle Wallets with orapki
    • Management of Certificate Revocation Lists (CRLs) with orapki Utility
    • orapki Usage
      • Example: Wallet with a Self-Signed Certificate and Export of the Certificate
      • Example: Creating a Wallet and a User Certificate
    • orapki Utility Commands Summary
      • orapki cert create
      • orapki cert display
      • orapki crl delete Command
      • orapki crl display
      • orapki crl hash
      • orapki crl list
      • orapki crl upload
      • orapki wallet add
      • orapki wallet convert
      • orapki wallet create
      • orapki wallet display
      • orapki wallet export
  • How the Unified Auditing Migration Affects Individual Audit Features