Creating a Network Proxy for the Database to Connect with the Internet

This network proxy will enable the Oracle database to reach the Entra ID endpoint.

About Creating a Network Proxy for the Database to Connect with the Internet

The Oracle database must connect to Entra ID endpoints and it may require network configuration and default trust store access.

You can configure the database when HTTP network proxy is in place in an enterprise, for a default Oracle Database environment and for an Oracle Real Applications Clusters environment. The database establishes a Transport Layer Security (TLS) link to Entra ID, so it also needs access to the default trust store on the database server. To enable this, ensure that the database server has access to the system default certificate store.

Related Topics

Testing the Accessibility of the Entra ID Endpoint

You must ensure that your Oracle Database can access the Entra ID endpoint.

If your database client is configured to get Microsoft Entra ID OAuth2 tokens, then the database client must be able to access the Entra ID endpoint. Run the following command to check if you have internet access:

curl https://login.windows.net/common/discovery/keys

A status code of 200 indicates success.

Check with your IT help desk for the proxy information if you weren’t successful running this command.

For an Oracle database to accept Entra ID OAuth2 tokens, the database must request the public key from the Microsoft Entra ID endpoint.

Run the following test to determine if the database can connect with the Microsoft Entra ID endpoint:

SET SERVEROUTPUT ON SIZE 40000
DECLARE
  req UTL_HTTP.REQ;
  resp UTL_HTTP.RESP;
BEGIN
  UTL_HTTP.SET_WALLET(path => 'system:');
  req := UTL_HTTP.BEGIN_REQUEST('https://login.windows.net/common/discovery/keys');
  resp := UTL_HTTP.GET_RESPONSE(req);
  DBMS_OUTPUT.PUT_LINE('HTTP response status code: ' || resp.status_code);
  UTL_HTTP.END_RESPONSE(resp);
END;
/

If this test is successful, then a PL/SQL procedure successfully completed message appears.

If the following messages appear, then it means that a database network access control list (ACL) policy blocked your test and you will need to temporarily set an access control list policy to allow you to test this:

ORA-29273: HTTP request failed
ORA-24247: network access denied by access control list (ACL)

  1. Set the ACL as follows:

    BEGIN
DBMS_NETWORK_ACL_ADMIN.APPEND_HOST_ACE(
  host => '*',
  ace  =>  xs$ace_type(privilege_list => xs$name_list('connect'),
                       principal_name => 'username_placeholder',
                       principal_type => xs_acl.ptype_db));
END;
/

    Replace username_placeholder with the user name of the database user who is running the test. For example:

    BEGIN
DBMS_NETWORK_ACL_ADMIN.APPEND_HOST_ACE(
  host => '*',
  ace  =>  xs$ace_type(privilege_list => xs$name_list('connect'),
                       principal_name => 'DBA_DEBRA',
                       principal_type => xs_acl.ptype_db));
END;
/

  2. Try running the test again.

  3. Remove the ACL, because you now no longer need it. For example, assuming your user name is dba_debra:

    BEGIN
DBMS_NETWORK_ACL_ADMIN.REMOVE_HOST_ACE(
  host => '*',
  ace  =>  xs$ace_type(privilege_list => xs$name_list('connect'),
                       principal_name => 'DBA_DEBRA',
                       principal_type => xs_acl.ptype_db));
END;
/

If the database cannot connect with the Microsoft Entra ID endpoint, even after you set the ACL policy, you will most likely need to set the HTTP_PROXY package for your database. Review the topics listed in Related Topics, depending if you are using a default Oracle Database environment or an Oracle Real Application Clusters RAC environment. Your network administrator should be able to tell you what the correct HTTP_PROXY setting should be.

Related Topics

Creating the Network Proxy for the Default Oracle Database Environment

To create the network proxy, you must set environment variables and then restart the listener.

You do not need to restart the database.

  1. In the server where the Oracle database is installed, set the http_proxy environment variable.

    For example:

    export http_proxy=http://www-proxy-example.com:80/

  2. Restart the listener.

    lsnrctl stop
lsnrctl start

    Note: Thehttp_proxy environment variable must be set. If the https_proxy environment variable is set, but not the http_proxy variable, then set the http_proxy environment variable to the same value set for the https_proxy environment variable.

Creating the Network Proxy for an Oracle Real Application Clusters Environment

To create the network proxy, you must set an environment variable and then restart the database.

  1. In the server where the Oracle database is installed, set the http_proxy environment variable.

    Use this syntax to set the network proxies. the proxy command that you enter must have http:// preceding the proxy name and must have the port number at the end of the proxy:

    http_proxy=http://....:80/

    For example:

    srvctl setenv database -db db_name -env "http_proxy=http://www-proxy.example.com:80/"

  2. Stop the database.

    $srvctl stop database -db db_name

  3. Display the environment variable values to ensure that they are correctly set.

    $ srvctl getenv database -db db_name

    Output similar to the following should appear:

    db_name:
http_proxy=http://www-proxy.example.com:80/
https_proxy=http://www-proxy.example.com:80/

  4. Restart the database.

    $ srvctl start database -db db_name

Creating the Network Proxy in the Windows Registry Editor

To create the network proxy in a Windows environment, you must update the Registry Editor (regedit).

  1. Start the Registry Editor (regedit).

  2. Locate the \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OracleServicerversion key.

  3. Select this key, and then in the right panel, locate Environment.

  4. Edit Environment to add a new multi-string value to it.

    The following example uses the domain of example.com:

    Description of the illustration regedit_env.png

  5. Click OK.

  6. Restart the database server.

    For example:

    net start Oracle_service_name
sqlplus "/as sysdba"
startup;

  7. Open the PDBs.

    ALTER PLUGGABLE DATABASE ALL OPEN;

Using Centralized Entra ID Services for Net Naming and Secrets

You can use the Azure app configuration and Azure Vault to centrally store net names and secrets.

This functionality is currently supported with the JDBC-thin and .NET-thin drivers.

See the following guides: