About Access Control to Oracle Wallets

Encrypting communication between a remote web service and the Oracle database, acting as a client to this service, is an established industry best practice.

Oracle Database supports network encryption using Transport Layer Security (TLS) when invoking remote services. It also supports authentication methods that may be required. The Oracle database must be aware of the remote site’s server certificate before it can securely establish the connection.

There are two ways to handle this configuration:

• Using the system certificate store. This method can be used for common TLS-protected web services (that is, HTTPS calls). To configure the system certificate store, you can use the UTL_HTTP PL/SQL package.

• Storing the certificate in an Oracle wallet. The use of Oracle wallets is beneficial because it provides secure storage of passwords and client certificates necessary to access protected Web pages. The Oracle wallet provides secure storage of user passwords and client certificates. To configure access control to a wallet, you must have the following components:

  • An Oracle wallet, which you can create by using the Oracle Database orapki or mkstore utility. The HTTP request will use the external password store or the client certificate in the wallet to authenticate the user.

  • An access control list, which you use to grant privileges to the user to use the wallet. To configure the access control list, you use the DBMS_NETWORK_ACL_ADMIN PL/SQL package.

Related Topics

• Configuring Access Control to an Oracle Wallet