21 Managing Identities in a Credential Store

Oracle GoldenGate uses credential stores to maintain encrypted database passwords and user IDs and associate them with an alias.

It is the alias, not the actual user ID or password, that is specified in a command or parameter file, and no user input of an encryption key is required. The credential store is implemented as an autologin wallet within the Oracle Credential Store Framework (CSF).

Another benefit of using a credential store is that multiple installations of Oracle GoldenGate can use the same one, while retaining control over their local credentials. You can partition the credential store into logical containers known as domains, for example, one domain per installation of Oracle GoldenGate. Domains enable you to develop one set of aliases and then assign different local credentials to those aliases in each domain. For example, credentials for user ogg1 can be stored as ALIAS ext under DOMAIN system1, while credentials for user ogg2 can be stored as ALIAS ext under DOMAIN system2.

The credential store security feature is not supported on the Db2 for i, Db2 z/OS, and NonStop platforms. For those platforms and any other supported platforms, see Encrypting a Password in a Command or Parameter File.

Topics:

• Credential Store Tasks
  
• Specifying the Alias in a Parameter File or Command
  

21.1 Credential Store Tasks

1. (Optional) To store the credential store in a location other than the dircrd subdirectory of the Oracle GoldenGate installation directory, specify the desired location with the CREDENTIALSTORELOCATION parameter in the GLOBALS file.
2. From the Oracle GoldenGate installation directory, start the command line.
3. After using the CONNECT command to login to the deployment (when using the Admin Client), isssue the following commands to perform various tasks with the credential store.

   Command	Description
   ADD CREDENTIALSTORE	Adds a database credential store.
   ALTER CREDENTIALSTORE	Adds each set of credentials to the credential store.
   INFO CREDENTIALSTORE	Retrieves information about an Oracle GoldenGate credential store. This information includes the aliases that a credential store contains and the user IDs that correspond to them. The encrypted passwords in the credential store are not returned.
   DELETE CREDENTIALSTORE	Removes a credential store from the system. The credential store wallet and its contents are permanently deleted.

21.2 Specifying the Alias in a Parameter File or Command

The following commands and parameters accept an alias as substitution for a login credential.

Table 21-1 Specifying Credential Aliases in Parameters and Commands

Purpose of the Credential	Parameter or Command to Use
Oracle GoldenGate database login.	USERIDALIAS alias
Oracle GoldenGate database login for a downstream Oracle mining database.	TRANLOGOPTIONS MININGUSERALIAS alias
Password substitution for {CREATE | ALTER} USER name IDENTIFIED BY password.	DDLOPTIONS DEFAULTUSERPASSWORDALIAS alias
Oracle GoldenGate database login from GGSCI.	DBLOGIN USERIDALIAS alias
Oracle GoldenGate database login to a downstream Oracle mining database from GGSCI.	MININGDBLOGIN USERIDALIAS alias