Managing the Secure External Password Store for Password Credentials

The secure external password store (SEPS) is a client-side wallet that is used to store password credentials.

About the Secure External Password Store

You can store password credentials database connections by using a client-side Oracle wallet.

An Oracle wallet is a secure software container that stores authentication and signing credentials. This wallet usage can simplify large-scale deployments that rely on password credentials for connecting to databases. When this feature is configured, application code, scripts no longer need embedded user names and passwords. This reduces risk because the passwords are no longer exposed, and password management policies are more easily enforced without changing application code whenever user names or passwords change.

Note: The external password store of the wallet is separate from the area where public key infrastructure (PKI) credentials are stored. Use the command-line utility mkstore (deprecated) to manage these credentials.

Related Topics

How Does the Secure External Password Store Work?

Users (and applications, batch jobs, and scripts) connect to databases by using a standard CONNECT statement that specifies a database connection string.

This string can include a user name and password, and an Oracle Net service name identifying the database on an Oracle Database network. If the password is omitted, the connection prompts the user for the password.

For example, the service name could be the URL that identifies that database, or a TNS alias you entered in the tnsnames.ora file in the database. Another possibility is a host:port:sid string.

The following examples are standard CONNECT statements that could be used for a client that is not configured to use the external password store:

CONNECT salesapp@sales_db.us.example.com
Enter password: password

CONNECT salesapp@orasales
Enter password: password

CONNECT salesapp@ourhost37:1527:DB17
Enter password: password

In these examples, salesapp is the user name, with the unique connection string for the database shown as specified in three different ways. You could use its URL sales_db.us.example.com, or its TNS alias orasales from the tnsnames.ora file, or its host:port:sid string.

However, when clients are configured to use the secure external password store, applications can connect to a database with the following CONNECT statement syntax, without specifying database login credentials:

CONNECT /@db_connect_string

CONNECT /@db_connect_string AS SYSDBA

CONNECT /@db_connect_string AS SYSOPER

In this specification, db_connect_string is a valid connection string to access the intended database, such as the service name, URL, or alias as shown in the earlier examples. Each user account must have its own unique connection string; you cannot create one connection string for multiple users.

In this case, the database credentials, user name and password, are securely stored in an Oracle wallet created for this purpose. The autologin feature of this wallet is turned on, so the system does not need a password to open the wallet. From the wallet, it gets the credentials to access the database for the user they represent.

Related Topics

About Configuring Clients to Use the Secure External Password Store

If your client is configured to use external authentication, such as Windows native authentication or SSL, then Oracle Database uses that authentication method.

The same credentials used for this type of authentication are typically also used to log in to the database. For clients not using such authentication methods or wanting to override them for database authentication, in the sqlnet.ora file you can either set the SEPS_WALLET_LOCATION parameter to the location of the wallet file or specify the location of the wallet file with the WALLET_LOCATION parameter and set the SQLNET.WALLET_OVERRIDE parameter to TRUE. The default value for SQLNET.WALLET_OVERRIDE is FALSE, allowing standard use of authentication credentials as before.

Configuring a Client to Use the Secure External Password Store

You can configure a client to use the secure external password store feature by using the mkstore command-line utility.

Starting in Oracle AI Database release 26ai, mkstore is deprecated. If possible, use orapki instead.

  1. Create a wallet on the client by using the following syntax at the command line:

    mkstore -wrl wallet_location -create

    For example:

    mkstore -wrl c:\oracle\product\20.1.0\db_1\wallets -create
Enter password: password

    wallet_location is the path to the directory where you want to create and store the wallet. This command creates an Oracle wallet with the autologin feature enabled at the location you specify. The autologin feature enables the client to access the wallet contents without supplying a password. If the connection is configured to use the TCPS protocol and the TLS certificate is stored in the wallet, then the database credential should be stored in the same wallet.

    The mkstore utility -create option uses password complexity verification. SeeAbout Password Complexity Verification for more information.

  2. Create database connection credentials in the wallet by using the following syntax at the command line:

    mkstore -wrl wallet_location -createCredential db_connect_string username
Enter password: password

    For example:

    mkstore -wrl c:\oracle\product\20.1.0\db_1\wallets -createCredential orcl system
Enter password: password

    In this specification:

    • wallet_location is the path to the directory where you created the wallet earlier in this procedure.

    • db_connect_string is the TNS alias you use to specify the database in the tnsnames.ora file or any service name you use to identify the database on an Oracle network. By default, tnsnames.ora is located in the $ORACLE_HOME/network/admin directory on UNIX systems and in ORACLE_HOME\network\admin on Windows.

    • username is the database login credential. When prompted, enter the password for this user.

    Repeat this step for each database you want accessible using the CONNECT /@db_connect_string syntax. The db_connect_string used in the CONNECT /@db_connect_string statement must be identical to the db_connect_string specified in the -createCredential command.

  3. Set the directory location of the wallet you created in Step 1 by setting the

  1. In the client sqlnet.ora file, enter the WALLET_LOCATION parameter and set it to the directory location of the wallet you created in Step 1.

    For example, if you created the wallet in $ORACLE_HOME/network/admin and your Oracle home is set to /private/ora_db, then you need to enter the following into your client sqlnet.ora file:

    WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
  (DIRECTORY = /private/ora_db/network/admin)
  )
 )

  2. In the client sqlnet.ora file, enter the SQLNET.WALLET_OVERRIDE parameter and set it to TRUE as follows:

    SQLNET.WALLET_OVERRIDE = TRUE

    This setting causes all CONNECT /@db_connect_string statements to use the information in the wallet at the specified location to authenticate to databases.

    When external authentication is in use, an authenticated user with such a wallet can use the CONNECT /@db_connect_string syntax to access the previously specified databases without providing a user name and password. However, if a user fails that external authentication, then these connect statements also fail.

In the client sqlnet.ora file, enter the SEPS_WALLET_LOCATION parameter and set it to the directory location of the wallet you created in Step 1.

For example, if you created the wallet in $ORACLE_HOME/network/admin and your Oracle home is set to /private/ora_db, then you need to enter the following into your client sqlnet.ora file:

SEPS_WALLET_LOCATION = /private/ora_db/network/admin<!--Draft comment: Anna Haikl <br/>Are these parameters from the WALLET_LOCATION included here as well? (SOURCE = (METHOD = FILE) (METHOD_DATA = (DIRECTORY =-->

This setting causes all CONNECT /@db_connect_string statements to use the information in the wallet at the specified location to authenticate to databases.

When external authentication is in use, an authenticated user with such a wallet can use the CONNECT /@db_connect_string syntax to access the previously specified databases without providing a user name and password. However, if a user fails that external authentication, then these connect statements also fail.

Note: If the SEPS_WALLET_LOCATION parameter is set, the SQLNET.WALLET_OVERRIDE parameter is ignored.

Related Topics

Example: Sample sqlnet.ora File with Wallet Parameters Set

You can set special parameters in the sqlnet.ora file to control how wallets are managed. The following example shows a sample sqlnet.ora file with the WALLET_LOCATION and the SQLNET.WALLET_OVERRIDE parameters.

WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
      (METHOD_DATA =
        (DIRECTORY = /private/ora_db/network/admin)
     )
   )

SQLNET.WALLET_OVERRIDE = TRUE
TLS_CLIENT_AUTHENTICATION = FALSE
TLS_VERSION = TLSv
1.3

The following example shows a sample sqlnet.ora file with the SEPS_WALLET_LOCATION parameter.

SEPS_WALLET_LOCATION = /private/ora_db/network/admin
TLS_CLIENT_AUTHENTICATION = FALSE
TLS_VERSION = TLSv1.3

Note: To bring Oracle parameters in accord with the actual encryption and authentication methods for network connections, Oracle is deprecating all connect parameters prefixed with SSL_ in favor of parameters prefixed with TLS_. During this deprecation period, if both the TLS_ and SSL_ versions of a parameter are configured, then the SSL_ version is ignored.

Managing External Password Store Credentials

The mkstore command-line utility manages credentials from an external password store. (Starting in Oracle AI Database 26ai, mkstore is deprecated in favor of orapki.)

Listing External Password Store Contents

You can view the contents, including specific credentials, of a client wallet external password store.

Listing the external password store contents provides information you can use to decide whether to add or delete credentials from the store.

To list the contents of the external password store, enter the following command at the command line:

mkstore -wrl wallet_location -listCredential

For example:

mkstore -wrl c:\oracle\product\20.1.0\db_1\wallets -listCredential

wallet_location specifies the path to the directory where the wallet, whose external password store contents you want to view, is located. This command lists all of the credential database service names (aliases) and the corresponding user name (schema) for that database. Passwords are not listed.

Adding Credentials to an External Password Store

You can store multiple credentials in one client wallet.

For example, if a client batch job connects to hr_database and a script connects to sales_database, then you can store the login credentials in the same client wallet. You cannot, however, store multiple credentials (for logging in to multiple schemas) for the same database in the same wallet. If you have multiple login credentials for the same database, then they must be stored in separate wallets.

To add database login credentials to an existing client wallet, enter the following command at the command line:

<pre class="copy"><code>mkstore -wrl wallet_location -createCredential db_alias username</code></pre>

For example:

mkstore -wrl c:\oracle\product\20.1.0\db_1\wallets -createCredential orcl system
Enter password: password

In this specification:

Modifying Credentials in an External Password Store

You can modify the database login credentials that are stored in the wallet if the database connection strings change.

To modify database login credentials in a wallet, enter the following command at the command line:

<pre class="copy"><code>mkstore -wrl wallet_location -modifyCredential db_alias username</code></pre>

For example:

mkstore -wrl c:\oracle\product\20.1.0\db_1\wallets -modifyCredential sales_db
Enter password: password

In this specification:

Deleting Credentials from an External Password Store

You can delete login credentials for a database from a wallet if the database no longer exists or to disable connections to a specific database.

To delete database login credentials from a wallet, enter the following command at the command line:

<pre class="copy"><code>mkstore -wrl wallet_location -deleteCredential db_alias</code></pre>

For example:

mkstore -wrl c:\oracle\product\20.1.0\db_1\wallets -deleteCredential orcl

In this specification:

Creating SQL*Loader Object Store Credentials

Before SQL*Loader can read data from files from object stores, you must create credentials that can be used to access the object store.

To create the credentials, you use the mkstore and orapki utilities.

  1. Log in to the client database that uses the SQL*Loader object store.

  2. Run the mkstore command to create the user name.

    For example, assuming that the wallet location is in the $ORACLE_HOME/wallet directory:

    mkstore -wrl $ORACLE_HOME/wallet -createEntry oracle.sqlldr.credential.obm_psmith.username PSMITH

  3. Run the mkstore command to create the user password.

    For example:

    mkstore -wrl $ORACLE_HOME/wallet -createEntry oracle.sqlldr.credential.obm_psmith.password psmith_password

  4. If necessary, run the orapki command to create a certificate for the object store in the wallet.

    For example, assuming that you want to create the certificate in $ORACLE_HOME/wallet:

    orapki cert create -wallet $ORACLE_HOME/wallet -request certificate_request_location -cert certificate_location -validity 5

  5. Run the orapki command to add the certificate for the object store to the wallet.

    For example, assuming that you want to add the certificate to $ORACLE_HOME/wallet/ewallet.p12:

    orapki wallet add -wallet $ORACLE_HOME/wallet/ewallet.p12 -trusted_cert -cert trusted_certificate_file_name  -pwd wallet_password

After you have created this credential the certificate for the object store, then users can begin to load data using SQL*Loader.