1. Command Line Interface Reference
  2. Admin Client Command Line Interface Commands
  3. ALTER CREDENTIALSTORE

ALTER CREDENTIALSTORE

Use the ALTER CREDENTIALSTORE command to configure database connections for Oracle GoldenGate processes. Use this command to manage user ID and password pairs in the credential store. This command enables you to add database connection details to the credential store and specify different aliases for connecting to the database.

See Add and Alter Database Credentials to configure the database connections from the MA web interface.

The use of a credential store is not supported for the NonStop platforms.

Syntax

Syntax:

ALTER CREDENTIALSTORE {
ADD USER userid
[NOPASSWORD | PASSWORD password]
[ALIAS alias]
[DOMAIN domain]
ADD USER userid

Adds the specified user and its alias to the credential store. If the ALIAS option is not used, the alias uses the default domain name OracleGoldenGate. A database connection can only be entered once unless the ALIAS option is used to specify a different alias for each one. Unless the PASSWORD option is used, the command prompts for the password of the specified user.

Depending on the database platform, the USER value can be an actual user name, a SQL*Net connection string, a database connection string, or a database Data Source Name (DSN).

For multitenant databases with different users for the CDB and the PDB, you need to specify @TNS_Service_Name when adding a database user to the credential store.

REPLACE USER userid

Changes the password of the specified user. If the ALIAS option is not used, the alias defaults to the user name. You cannot change the alias or domain of a user with this option, but you can use the ADD USER option to add a new entry for the user under the desired ALIAS or DOMAIN. Unless the PASSWORD option is used, the command prompts for the new password for the specified user.

DELETE USER userid

Removes the credential for the specified user from the credential store. If the ALIAS option is not used, the alias defaults to the user name. If the user ID and alias are not the same, you must specify both user ID and alias. For example:

ALTER CREDENTIALSTORE DELETE USER c##ggadmin alias ggadmin

NOPASSWORD | PASSWORD password

Specify the user's password using the PASSWORD option. The password is echoed (not obfuscated) when this option is used. If this option is omitted, the command prompts for the password, which is obfuscated as it is typed (recommended as more secure).

Oracle GoldenGate 23ai supports a maximum password length of 1024 bytes.

The NOPASSWORD option is the alternative to the PASSWORD option when using external authentication because password is not required for external authentication such as using Kerberos authentication or IDCS. After the NOPASSWORD option is set, the DBLOGIN command can be used to access the database without a password.

Also see USERIDALIAS parameter in the Reference for Oracle GoldenGate.

ALIAS alias

Specifies an alias for the user name. Use this option if you do not want the user name to be in a parameter file or command. If ALIAS is not provided, the alias defaults to the USER name, which then must be used in parameter files and commands where a login is required. You can create multiple entries for a user, each with a different alias, by using the ADD USER option with ALIAS.

DOMAIN domain

Saves the credential user under the specified domain name. Enables the same alias to be used by multiple Oracle GoldenGate installations that use the same credential store. The default domain is OracleGoldenGate. For example, the administrators of system 1 might not want system 2 to have access to the same credentials that are used on system 1. Those credentials can be stored as ALIAS pdbeast, for example, under DOMAIN system1, while a different set of credentials can be stored for ALIAS pdbwest under DOMAIN system2.

Examples

The following example (Admin Client) adds a user named ggadmin but with external authentication and therefore uses the NOPASSWORD option. 

ALTER CREDENTIALSTORE ADD USER /ggadmin nopassword alias pdbeast

The output shows:

2020-06-22T21:08:33Z  INFO    OGG-15102  Credential store created.

Running the INFO CREDENTIALSTORE command, you can check the add user to the credential store: 

INFO CREDENTIALSTORE
Default domain: OracleGoldenGate
  Alias: pdbeast
  Userid: /@ggadmin

After you update the credentialstore to use the NOPASSWORD option, you can use the DBLOGIN command with Kerberos authentication for your database. 

DBLOGIN USERIDALIAS pdbeast

Output:

Successfully logged into database pdbeast.

This example adds a user named ggadmin but omits the PASSWORD specification, so the command prompts for pggeast's password. 

ALTER CREDENTIALSTORE ADD USER ggadmin
Password: ********

This example adds the user ggadmin with his password tiger and specifies the alias as pdbeast. 

ALTER CREDENTIALSTORE ADD USER ggadmin PASSWORD tiger ALIAS pdbeast

This example adds the user ggadmin under the domain of OracleGoldenGate. 

ALTER CREDENTIALSTORE ADD USER ggadmin ALIAS pdbeast DOMAIN OracleGoldenGate
Password: ********

This example issues two ALTER CREDENTIALSTORE commands, each of which adds a ggadmin entry, but with a different alias. 

ALTER CREDENTIALSTORE ADD USER ggadmin ALIAS pdbeast
Password: ********
ALTER CREDENTIALSTORE ADD USER ggadmin ALIAS pdbwest
Password: ********

The following shows how the DELETE USER option works with and without the ALIAS option.

The following command deletes the user1 entry for which the ALIAS is the same as the user name. 

ALTER CREDENTIALSTORE DELETE USER ggadmin
Alias: pdbeast
Userid: ggadmin

The following command deletes the entry for user ggadmin that is associated with the alias pdbeast. 

ALTER CREDENTIALSTORE DELETE USER ggadmin ALIAS pdbeast
Alias: pdbeast
Userid: ggadmin

This example uses a SQL*Net connect string as the user value. In this case, the PASSWORD option is omitted. The person issuing the command is prompted for the password, which is hidden. 

ALTER CREDENTIALSTORE ADD USER ggadmin@pdbeast ALIAS pdbeast
This example creates a domain name Oracle GoldenGate with user ID ggadmin and alias as pdbeast in the Admin Client.
ALTER CREDENTIALSTORE ADD USER ggadmin alias pdbeast
Password:
This example connects using a connection qualifier if using a BEQ-Bequeath Protocol adapter:
ALTER CREDENTIALSTORE ADD USER ggadmin@inst1_beq