Configure a SQL Client for End-User Direct Logon

If your IAM-managed users connect directly to the database using a SQL client, such as SQL*Plus, configure the client machine for token-based authentication.

After an end user successfully authenticates, the database automatically establishes an end-user security context for the user based on the identity provider configuration (see Set Up IAM Integration for End-User Direct Logon) and the roles or group claim present in the end-user token.

For sqlnet.ora authentication parameters and tnsnames.ora connection alias configuration, refer to the following sections in the Oracle documentation.

• For Microsoft Entra ID: The client retrieves the token directly. See Configure the Client for Interactive Sign-In or Enabling Clients to Directly Retrieve Entra ID Tokens.

• For OCI IAM OAuth 2.0 Token:

  There is no native browser sign-in for this token, so the client reads it from a file. Connect through a TCPS net service alias in tnsnames.ora that specifies the database server certificate DN (for Oracle Autonomous AI Database, use the alias from the downloaded wallet). In $TNS_ADMIN/sqlnet.ora, set TOKEN_AUTH=OAUTH and TOKEN_LOCATION=<token-directory>. Obtain the access token separately using the OAuth 2.0 authorization code grant with PKCE, requesting the database access scope (the resource server’s primary audience concatenated with its scope name), save the access_token to a file in TOKEN_LOCATION, and connect with /@<service-alias>. For more information, see:

  • LiveLab for configuring Oracle Deep Data Security for direct logon with end users in OCI IAM: Autonomous AI Database OCI IAM Deep Data Security Lab.

  • About the authorization code grant: Authorization Code Grant Type.

  • Client parameters (TOKEN_AUTH / TOKEN_LOCATION) reference: Local Naming Parameters in the tnsnames.ora File.

• For OCI IAM Auth Token: See Configuring a Client Connection for SQL*Plus That Uses an IAM Token.

• For Keycloak: Obtain an end-user token whose aud claim includes the configured database audience using the OAuth 2.0 authorization code grant with PKCE and the database access scope. SQL*Plus or SQLcl reads the token from a file; native browser-based sign-in is not supported for this flow. For TCPS connection parameters, including TOKEN_AUTH=OAUTH and TOKEN_LOCATION, see Local Naming Parameters in the tnsnames.ora File. Connect using /@<service-alias>.

Note: You must configure the database server for TLS before configuring the client. The client-side trust store requires the server certificate to establish trust. For TLS configuration, see Configuring Transport Layer Security Encryption in Oracle AI Database Security Guide.