Configuring the Database Client Connection

Configuring the IAM client connection controls the authentication of IAM users to the Oracle DBaaS instance.

• About Connecting to an Oracle AI Database Instance Using IAM
  IAM users can connect to the Oracle AI Database instance by using either an IAM database password verifier or an IAM token.

• Supported Client Drivers for IAM Connections
  Oracle DBaaS supports several types of client drivers for IAM connections.

• Using Centralized Oracle Cloud Infrastructure Services for Net Naming and Secrets
  You can use the Oracle Cloud Infrastructure (OCI) object store and vault to centrally store net names and secrets.

• Client Connections That Use an IAM Database Password Verifier
  After you have configured the authorization needed for the IAM user, this user can log in using existing client application, such as SQL*Plus or SQLcl without additional configuration.

• Client Connections That Use a Token Requested by an IAM User Name and Database Password
  You can create a client connection that uses a token requested by an IAM user name and database password.

• Client Connections That Use a Token Requested by a Client Application or Tool
  For IAM token access to the Oracle AI Database, the client application or tool requests a database token from IAM for the IAM user.

• TLS Connections without Client Wallets
  The use of Transport Layer Security (TLS) connections without client wallets is supported for IAM connections.

• Enabling Clients to Directly Retrieve IAM Tokens
  You can set parameters to enable clients to directly retrieve IAM tokens on their own.

• Common Database Client Configurations
  IAM users can connect to the Oracle DBaaS instance using client tools such as SQLcl on a laptop.

• Using OCI Object Store for Network Service Configuration Information
  You can store connect string and other network configuration information in the OCI Object Store.

About Connecting to an Oracle AI Database Instance Using IAM

IAM users can connect to the Oracle AI Database instance by using either an IAM database password verifier or an IAM token.

Using the IAM database password verifier is similar to the Oracle Database password authentication process. However, instead of the password verifier (encrypted hash of the password) being stored in the Oracle database, the verifier is instead stored as part of the Oracle Cloud Infrastructure (OCI) IAM user profile.

The second connection method, the use of an IAM token for the database, is more modern. The use of token-based access is a better fit for Cloud resources such as Oracle AI Database. The token is based on the strength that the IAM endpoint can enforce. This can be multi-factor authentication, which is stronger than the use of passwords alone. Another benefit of using tokens is that the password verifier (which is considered sensitive) is never stored or available in memory. A TCPS (TLS) connection is required when using tokens for database access.

Note: You cannot configure native network encryption when passing an IAM token. Only Transport Layer Security (TLS) by itself is supported, not native network encryption or native network encryption with TLS.

Supported Client Drivers for IAM Connections

Oracle DBaaS supports several types of client drivers for IAM connections.

IAM database password verifiers work with any supported database client. Using IAM tokens requires the latest Oracle Database client 19c (at least 19.16). Some earlier clients (19c and 21c) provide a limited set of capabilities for token access. Oracle Database client 21c does not fully support the IAM token access feature. Oracle Database Client 26ai supports the IAM token access feature.