Configure

Configure the Oracle Notification Server proxy based on your business and security needs.

Set Up the Oracle Notification Server Proxy

You can set up Oracle Notification Server proxy without Wallets and Certificates or with SSL Certificates and Wallets.
The following Oracle Notification Server proxy configuration file parameters are used in this solution:
ExtendedSecurityHeader=<header-name>

Notifications may now contain an access header provided by the publisher. A field on the certificates called CN (Common Name) gives the certificate owner a name. The client's CN part of DN (Distinguished Name) is saved with each client connection. When a notification arrives at the server the client will only be able to receive the notification if its CN is listed in the header name configured for ExtendedSecurityHeader. 

ExtendedSecurityMode=<mode>

none: Don't check anything. Clients will always receive all the notifications.

strict: Check the client against the notification access header if it exists, otherwise the client will not receive the notification. 

allowunsecuresubscriber=false

If secure connection is configured normally, any insecure connection attempt will be rejected. If this parameter is set to yes, a peer will still be allowed to connect even with no encryption but will not be allowed to publish in this case.

If secure connection is not configured, this parameter is ignored.

  1. Option 1: Configure the Oracle Notification Server proxy without SSL wallets and certificates to establish communication between the Oracle Notification Server proxy and the Oracle Notification Server on Oracle RAC nodes. Follow these steps to configure the Oracle Notification Server proxy without wallets and certificates:
    1. Set up the Oracle Notification Server proxy on the Connection Manager host.
    2. Create the $ORACLE_HOME/opmn/conf/onsproxy.properties file with the following contents:
      setConfigHome:/u01/app/oracle/product/23ai/client_1
debug:true
addConfig: localport=6100
addConfig: remoteport=6200
addConfig: allowunsecuresubscriber=true
addConfig: extendedsecuritymode=partial
addConfig: extendedsecurityheader=none
addNetwork: nodes.aaa=10.0.1.13:6200,10.0.1.95:6200
addSubscription: ("eventType=database/event/service")
addSubscription: ("eventType=database/event/host")
    3. Verify that the $ORACLE_HOME/opmn/conf/ons.config has following contents:
      # Generated by ONS Proxy
allowpublish=127.0.0.1,::1
extendedsecurityheader=none
allowunsecuresubscriber=true
localport=6100
remoteport=6200
extendedsecuritymode=partial
    4. Start the Oracle Notification Server proxy on CMAN host and check the status.
      [oracle@cman-host ~]$ onsctl proxy start
Dec 17, 2024 10:35:20 PM oracle.ons.proxy.Proxy$ProxyConfig <init>
INFO: Loading configuration: /u01/app/oracle/product/23ai/client_1/opmn/conf/onsproxy.properties
Dec 17, 2024 10:35:21 PM oracle.ons.proxy.Proxy setDefaultConfigHome
INFO: ORACLE_CONFIG_HOME set to /u01/app/oracle/product/23ai/client_1
Dec 17, 2024 10:35:21 PM oracle.ons.proxy.Proxy validateProxyConfig
INFO: Validating configuration
Dec 17, 2024 10:35:21 PM oracle.ons.proxy.Proxy updateProxyConfig
INFO: Updating configuration
Dec 17, 2024 10:35:21 PM oracle.ons.proxy.Proxy initProxy
INFO: Initializing
onsctl proxy: ons proxy started
    5. Check the connections established on the database when you start the Oracle Notification Server proxy on the cman-host. In the Client Connections section, verify that Oracle CMAN host is connected to the Oracle RAC database. The following example shows a trimmed output after the CMAN connection to the Oracle Notification Server running on Oracle Grid Infrastructure. You should see the connection from 10.0.0.90 on both the Oracle RAC machines. Because this connection was made without SSL certificates and wallets, you won't see a CN=cman-host entry in Oracle CMAN connection.
      [grid ~]$ onsctl debug 
Client connections: (8)     
ID            CONNECTION ADDRESS              PORT   FLAGS  SNDQ REF PHA SUB
-------- --------------------------------------- ----- ------- ---- --- --- ---
       0                                internal     0 000044a    0   1  IO   1
       2                               127.0.0.1 62766 000041a    0   1  IO   1
       1                               127.0.0.1 62770 000041a    0   1  IO   1
       3                               127.0.0.1 62768 000041a    0   1  IO   1
       4                               127.0.0.1 62796 000041a    0   1  IO   1
       7                               127.0.0.1 62838 000041a    0   1  IO   0
      26                        ::ffff:10.0.0.90 21876 008042a    0   1  IO   2 
request                               127.0.0.1 12334 0000e1a    0   1  IO   0
  2. Option 2: For security, set up Oracle Notification Server proxy with wallets and SSL certificates. SSL requires either self-signed certificates or a Certificate Authority (CA) from a trusted provider for the client-server connection. SSL acts as a digital passport that verifies your credentials and the end web server's credentials by using public and private keys. When both identities are verified, SSL grants a secure connection through HTTPS. This process is performed using SSL Certificates.

    Note:

    If you use a user certificate issued by a certificate authority such as Verisign, you don't need to roll out certificates to the client. Add the CA root certificate and any intermediate certificates in the chain to the wallet as Trusted Certificates before adding the user certificate.
    1. Create Oracle wallet and self-signed certificates on Oracle RAC nodes. Run the following commands on one of the Oracle RAC nodes as a root user:
      mkdir -p /u01/app/wallet_dir
chown grid:oinstall /u01/app/wallet_dir
chmod 750 /u01/app/wallet_dir
    2. Run the following commands as a grid user:
      $ORACLE_HOME/bin/orapki wallet create -wallet /u01/app/wallet_dir -pwd <Replace With Your Password> -auto_login
$ORACLE_HOME/bin/orapki wallet display -wallet /u01/app/wallet_dir
$ORACLE_HOME/bin/orapki wallet add -wallet /u01/app/wallet_dir -pwd <Replace With Your Password> -dn "CN=racnode-scan.sub12161926541.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US"  -keysize 2048 -self_signed -validity 365
$ORACLE_HOME/bin/orapki wallet add -wallet /u01/app/wallet_dir -pwd <Replace With Your Password> -dn "CN=racnode-scan,OU=ST,O=Oracle,ST=California,C=US"  -keysize 2048 -self_signed -validity 365
$ORACLE_HOME/bin/orapki wallet display -wallet /u01/app/wallet_dir
[grid@racnode1 ~]$ $ORACLE_HOME/bin/orapki wallet display -wallet /u01/app/wallet_dir
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Requested Certificates:
User Certificates:
Subject:        CN=racnode-scan.sub12161926541.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
Subject:        CN=racnode-scan,OU=ST,O=Oracle,ST=California,C=US
Trusted Certificates:
Subject:        CN=racnode-scan,OU=ST,O=Oracle,ST=California,C=US
Subject:        CN=racnode-scan.sub12161926541.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
    3. Create wallet and self-signed certificates on the Connection Manager host. When you configure the Oracle Notification Server proxy to run on a CMAN environment and communicate with the Oracle Notification Server servers running on both CMAN and RAC nodes, SSL certificates are required to ensure secure communication.

      Note:

      Change the password based on your environment password policies.
    4. The following is a step-by-step process to configure the Oracle Notification Server proxy with SSL certificates.
      Run the following commands as a root user:
      mkdir -p /u01/app/oracle/wallet_dir
chown oracle:oinstall /u01/app/oracle/wallet_dir
chmod 750 /u01/app/oracle/wallet_dir
      Run the following commands as an oracle user:
      $ORACLE_HOME/bin/orapki wallet create -wallet /u01/app/oracle/wallet_dir -pwd <Replace With Your Password> -auto_login
$ORACLE_HOME/bin/orapki wallet display -wallet /u01/app/oracle/wallet_dir
      Create the self-signed certificates as an oracle user:
      $ORACLE_HOME/bin/orapki wallet add -wallet /u01/app/oracle/wallet_dir -pwd <Replace With Your Password> "CN=cman-host.sub12161926540.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US"  -keysize 2048 -self_signed -validity 365
$ORACLE_HOME/bin/orapki wallet add -wallet /u01/app/oracle/wallet_dir -pwd REPLACE WITH YOUR PASSWORD> -dn "CN=cman-host,OU=ST,O=Oracle,ST=California,C=US"  -keysize 2048 -self_signed -validity 365
      After the wallet is created, display the wallet as an oracle user. You won't see any entries yet, because the certificate is not created.
      [oracle@cman-host ~] $ $ORACLE_HOME/bin/orapki wallet display -wallet /u01/app/oracle/wallet_dir
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Requested Certificates:
User Certificates:
Subject:        CN=cman-host.sub12161926540.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
Subject:        CN=cman-host,OU=ST,O=Oracle,ST=California,C=US
Trusted Certificates:
Subject:        CN=cman-host,OU=ST,O=Oracle,ST=California,C=US
Subject:        CN=cman-host.sub12161926540.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
    5. Create wallet and self-signed certificates on the client machine in Google Cloud. Since the Oracle Notification Server proxy on the CMAN host is configured with an SSL wallet, the client machine must also have a wallet configured with self-signed SSL certificates to establish a secure connection. In this case, you have the Oracle client installed on the client host, which provides the necessary tools to create and manage wallets.
      Run the following commands as a root user:
      mkdir -p /u01/app/client/wallet_dir
chown oracle:oinstall /u01/app/client/wallet_dir
chmod 750 /u01/app/client/wallet_dir
      Run the following commands as an oracle user:
      $ORACLE_HOME/bin/orapki wallet create -wallet /u01/app/client/wallet_dir -pwd <Replace With Your Password>-auto_login
$ORACLE_HOME/bin/orapki wallet display -wallet /u01/app/client/wallet_dir
      Create the self-signed certificate as an oracle user:
      $ORACLE_HOME/bin/orapki wallet add -wallet /u01/app/client/wallet_dir -pwd <Replace With Your Password> -dn "CN=client-host.c.oraoperator-on-gke.internal,OU=ST,O=Oracle,ST=California,C=US" -keysize 2048 -self_signed -validity 365
$ORACLE_HOME/bin/orapki wallet add -wallet /u01/app/client/wallet_dir -pwd <Replace With Your Password>-dn "CN=client-host,OU=ST,O=Oracle,ST=California,C=US" -keysize 2048 -self_signed -validity 365
      After the wallet is created, display the wallet as an oracle user. You won't see any entries yet, because the certificate is not created.
      [oracle@client-host ~]$ $ORACLE_HOME/bin/orapki wallet display -wallet /u01/app/client/wallet_dir
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Requested Certificates:
User Certificates:
Subject:       CN=client-host.c.oraoperator-on-gke.internal,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=client-host,OU=ST,O=Oracle,ST=California,C=US
Trusted Certificates:
Subject:       CN=client-host.c.oraoperator-on-gke.internal,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=client-host,OU=ST,O=Oracle,ST=California,C=US
    6. After you've set up the wallet and SSL certificates on Oracle RAC, and configured the CMAN and client machines, export self-signed certificates on Connection Manager and Oracle RAC Node 1 using these procedures:
      Run the following commands on Oracle RAC Node 1 as the grid user:
      $ORACLE_HOME/bin/orapki wallet export -wallet /u01/app/wallet_dir -pwd <Replace With Your Password> -dn "CN=racnode-scan,OU=ST,O=Oracle,ST=California,C=US" -cert "/tmp/scan_app1.crt"
$ORACLE_HOME/bin/orapki wallet export -wallet /u01/app/wallet_dir -pwd <Replace With Your Password> -dn "CN=racnode-scan.sub12161926541.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US" -cert "/tmp/scan_app2.crt"
      Run the following commands on Oracle RAC Node 1 as the oracle user:
      $ORACLE_HOME/bin/orapki wallet export -wallet /u01/app/oracle/wallet_dir -pwd <Replace With Your Password> -dn "CN=cman-host,OU=ST,O=Oracle,ST=California,C=US" -cert "/tmp/cman1.crt"
$ORACLE_HOME/bin/orapki wallet export -wallet /u01/app/oracle/wallet_dir -pwd <Replace With Your Password> -dn "CN=cman-host.sub12161926540.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US" -cert "/tmp/cman2.crt"
    7. After the certificates are exported, import the certificates so that the CMAN Oracle Notification Server proxy can handshake with the Oracle RAC Oracle Notification Server.
      Copy the Connection Manager wallets to Oracle RAC Node 1 and import the certificates:
      scp /tmp/cman* grid@racnode1.sub12161926541.onsproxyvcn.oraclevcn.com:/tmp/
$ORACLE_HOME/bin/orapki wallet add -wallet  /u01/app/wallet_dir  -pwd <Replace With Your Password> -trusted_cert -cert /tmp/cman1.crt
$ORACLE_HOME/bin/orapki wallet add -wallet  /u01/app/wallet_dir  -pwd <Replace With Your Password> -trusted_cert -cert /tmp/cman2.crt
      Copy the wallets from Oracle RAC Node1 to the CMAN host and import the certificates:
      scp grid@racnode1.sub12161926541.onsproxyvcn.oraclevcn.com:/tmp/scan_app* /tmp/
$ORACLE_HOME/bin/orapki wallet add -wallet  /u01/app/oracle/wallet_dir  -pwd <Replace With Your Password> -trusted_cert -cert /tmp/scan_app1.crt
$ORACLE_HOME/bin/orapki wallet add -wallet  /u01/app/oracle/wallet_dir  -pwd <Replace With Your Password> -trusted_cert -cert /tmp/scan_app2.crt
    8. Copy the wallet from Oracle RAC Node 1 to Oracle RAC Node 2:
      Run the following commands on Oracle RAC Node 1 as root user:
      mkdir -p /u01/app/wallet_dir
chown grid:oinstall /u01/app/wallet_dir
chmod 750 /u01/app/wallet_dirscp grid@racnode1.sub12161926541.onsproxyvcn.oraclevcn.com:/u01/app/wallet_dir/* /u01/app/wallet_dir
      Run the following commands on Oracle RAC Node 1 as grid user:
      [grid@racnode1 ~]$ $ORACLE_HOME/bin/orapki wallet display -wallet /u01/app/wallet_dir
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Requested Certificates:
User Certificates:
Subject:       CN=racnode-scan.sub12161926541.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=racnode-scan,OU=ST,O=Oracle,ST=California,C=US
Trusted Certificates:
Subject:       CN=racnode-scan,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=cman-host,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=cman-host.sub12161926540.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=racnode-scan.sub12161926541.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
[grid@racnode2 ~]$ $ORACLE_HOME/bin/orapki wallet display -wallet /u01/app/wallet_dir
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Requested Certificates:
User Certificates:
Subject:       CN=racnode-scan.sub12161926541.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=racnode-scan,OU=ST,O=Oracle,ST=California,C=USTrusted Certificate
Subject:       CN=racnode-scan,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=cman-host,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=cman-host.sub12161926540.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=racnode-scan.sub12161926541.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
    9. Follow these steps to copy the wallet from the client machine in Google Cloud to the CMAN machine on OCI:
      Run the following commands to export the wallets on the client-host machine:
      $ORACLE_HOME/bin/orapki wallet export -wallet /u01/app/client/wallet_dir -pwd <Replace With Your Password> -dn "CN=client-host,OU=ST,O=Oracle,ST=California,C=US" -cert "/tmp/cert_app1.crt"
$ORACLE_HOME/bin/orapki wallet export -wallet /u01/app/client/wallet_dir -pwd <Replace With Your Password> -dn "CN=client-host.c.oraoperator-on-gke.internal,OU=ST,O=Oracle,ST=California,C=US" -cert "/tmp/cert_app2.crt"
      Copy the wallet from client-host to cman-host under the /tmp directory:
      scp -i /tmp/gcp  oracle@client-host.c.oraoperator-on-gke.internal:/tmp/cert_app* /tmp/
      Copy the CMAN wallet from cman-host to the client-host under the /tmp directory:
      scp -i /tmp/gcp  /tmp/cman* oracle@client-host.c.oraoperator-on-gke.internal:/tmp/
    10. Run these commands to import the wallets of client-host on cman-host machine:
      $ORACLE_HOME/bin/orapki wallet add -wallet  /u01/app/oracle/wallet_dir  -pwd <Replace With
        Your Password> -trusted_cert -cert /tmp/cert_app1.crt
$ORACLE_HOME/bin/orapki wallet add -wallet  /u01/app/oracle/wallet_dir  -pwd <Replace With
        Your Password> -trusted_cert -cert /tmp/cert_app2.crt  [oracle@cman-host ~]$
$ORACLE_HOME/bin/orapki wallet display -wallet
      /u01/app/oracle/wallet_dirOracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Requested Certificates:
User Certificates:
Subject:       CN=cman-host,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=cman-host.sub12161926540.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
Trusted Certificates:
Subject:       CN=client-host.c.oraoperator-on-gke.internal,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=racnode-scan.sub12161926541.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=cman-host,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=cman-host.sub12161926540.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=racnode-scan,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=client-host,OU=ST,O=Oracle,ST=California,C=US
      Run these commands to import the wallets of cman-host onto the client-host machine:
      $ORACLE_HOME/bin/orapki wallet add -wallet  /u01/app/client/wallet_dir  -pwd <Replace With Your Password> -trusted_cert -cert /tmp/cman1.crt
$ORACLE_HOME/bin/orapki wallet add -wallet  /u01/app/client/wallet_dir  -pwd <Replace With Your Password> -trusted_cert -cert /tmp/cman2.crt

[oracle@client-host ~]$ $ORACLE_HOME/bin/orapki wallet display -wallet /u01/app/client/wallet_dir
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.

Requested Certificates:
User Certificates:
Subject:      CN=client-host.c.oraoperator-on-gke.internal,OU=ST,O=Oracle,ST=California,C=US
Subject:      CN=client-host,OU=ST,O=Oracle,ST=California,C=USTrusted Certificates:
Subject:      CN=cman-host,OU=ST,O=Oracle,ST=California,C=US
Subject:      CN=client-host.c.oraoperator-on-gke.internal,OU=ST,O=Oracle,ST=California,C=US
Subject:      CN=cman-host.sub12161926540.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
Subject:      CN=client-host,OU=ST,O=Oracle,ST=California,C=US
    11. Set up Oracle Notification Server on Oracle RAC nodes.
      Run the following commands as the grid user to disallow connections that don't match the CN in the wallet to Oracle Notification Server and allow connections only to trusted clients.
      $ORACLE_HOME/bin/crsctl modify res ora.ons -attr "ALLOW_UNSECURE_SUBSCRIBER=no" -unsupported
$ORACLE_HOME/bin/srvctl modify nodeapps -clientdata /u01/app/wallet_dir/cwallet.sso
$ORACLE_HOME/opmn/bin/onsctl reload
      Run this command to check the configuration on both Oracle RAC Node 1 and Oracle RAC Node 2 as the grid user:
      [grid@racnode1 ~]$ cat /u01/app/23.0.0.0/grid/opmn/conf/ons.config.racnode1
usesharedinstall=true
allowgroup=true
localport=6100                 # line added by Agent
remoteport=6200                              # line added by Agent
nodes=racnode1-priv:6200,racnode2-priv:6200                               # line added by Agent
walletfile=/u01/app/grid/crsdata/racnode1/onswallet/                          # line added by Agent
allowunsecuresubscriber=no                     # line added by Agent

[grid@racnode2 ~]$ cat /u01/app/23.0.0.0/grid/opmn/conf/ons.config.racnode2
usesharedinstall=true
allowgroup=true
localport=6100                 # line added by Agent
remoteport=6200                              # line added by Agent
nodes=racnode1-priv:6200,racnode2-priv:6200                               # line added by Agent
walletfile=/u01/app/grid/crsdata/racnode2/onswallet/                          # line added by Agent
allowunsecuresubscriber=no                     # line added by Agent
      Run this command to check the wallet on both the Oracle RAC Nodes as the grid user.
      [grid@racnode1 ~]$ $ORACLE_HOME/bin/orapki wallet display -wallet /u01/app/grid/crsdata/racnode1/onswallet
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Requested Certificates:
User Certificates:
Subject:       CN=racnode-scan.sub12161926541.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=racnode-scan,OU=ST,O=Oracle,ST=California,C=USTrusted Certificates:
Subject:       CN=racnode-scan,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=cman-host,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=cman-host.sub12161926540.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=racnode-scan.sub12161926541.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US

[grid@racnode2 ~]$ $ORACLE_HOME/bin/orapki wallet display -wallet /u01/app/grid/crsdata/racnode2/onswallet
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Requested Certificates:
User Certificates:
Subject:       CN=racnode-scan.sub12161926541.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
ubject:        CN=racnode-scan,OU=ST,O=Oracle,ST=California,C=USTrusted Certificates:
Subject:       CN=racnode-scan,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=cman-host,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=cman-host.sub12161926540.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
Subject:       CN=racnode-scan.sub12161926541.onsproxyvcn.oraclevcn.com,OU=ST,O=Oracle,ST=California,C=US
  3. Set up the Oracle Notification Server proxy on the Connection Manager host.
    Create $ORACLE_HOME/opmn/conf/onsproxy.properties file with the following contents:
    setConfigHome: /u01/app/oracle/product/23ai/client_1
debug: true
addConfig: localport=6100
addConfig: remoteport=6200
addConfig: walletfile=/u01/app/oracle/wallet_dir
addNetwork: nodes.aaa=10.0.1.13:6200,10.0.1.95:6200|walletfile=/u01/app/oracle/wallet_dir/cwallet.sso
addSubscription: ("eventType=database/event/service")
addSubscription: ("eventType=database/event/host")
    Create $ORACLE_HOME/opmn/conf/ons.config with the following contents:
    # Generated by ONS Proxy
allowpublish=127.0.0.1,::1
extendedsecurityheader=tenant_id
allowunsecuresubscriber=false
walletfile=/u01/app/oracle/wallet_dir
localport=6100
remoteport=6400
=strict
  4. Check the connections established at the database. Check the connections established at the database end when the Oracle Notification Server proxy is started on the cman-host.
  5. Update the Tenant ID with Client Host Machine Name. Log in to SQLPLUS with SYSDBA Privileges and update the Tenant ID with the name of the Client Host Machine client-host in this case.
  6. Log in to SQLPLUS with SYSDBA privileges and update the Tenant ID with the name of the Client Host Machine such as client-host in this case.

    Note:

    Ensure that it matches the name used in the client wallet CN. 
    SQL> alter session set container=ORCLPDB;                             
Session altered                                                 
SQL> alter pluggable database orclpdb tenant_id = 'client-host';
Pluggable database altered.                                     
SQL> select con_id, name, tenant_id from v$pdbs where name = 'ORCLPDB';
    CON_ID     NAME              TENANT_ID                           
----------     -------------   ------------------------
          3           ORCLPDB                 client-host

Create Oracle RAC Database Service

Create the Oracle RAC database service and test the connection from the Oracle RAC host to the Oracle RAC database. Start application on the client machine to make a SQL connection to the Oracle RAC database using Oracle RAC and ONS connection with the Oracle Notification Server running on the CMAN host. Simulate service start and stop events on the database server and check the FAN events received at the client.

Follow these steps to create and start the Database services:
  1. Run the following command as an oracle user to create database services.
    su - oracle
srvctl add service -d ORCLCDB_8p7_phx -preferred ORCLCDB1,ORCLCDB2 -s raconssvc2 -pdb ORCLPDB  -notification TRUE
  2. Run the following command to start the database services:
    [oracle@racnode1 ~]$ srvctl start service -d ORCLCDB_8p7_phx -s raconssvc2
  3. Run the following command to reset the password for the system user. Use a <PASSWORD> based on your environment policies:
    SQL> alter user system identified by <PASSWORD>;User altered.
  4. Follow these steps to connect to the database from cman-host machine:
    [oracle@cman-host ~]$ $ORACLE_HOME/bin/sqlplus system/<PASSWORD>@//cman-host.sub12161926540.onsproxyvcn.oraclevcn.com:1521/raconssvc2.sub12161926541.onsproxyvcn.oraclevcn.com
SQL*Plus: Release 23.0.0.0.0 - for Oracle Cloud and Engineered Systems on Thu Dec 19 01:49:12 2024
Version 23.5.0.24.07
Copyright (c) 1982, 2024, Oracle.  All rights reserved.
Last Successful login time: Wed Dec 18, 2024, 00:59:27 +00:00
Connected to:Oracle Database 23ai EE Extreme Perf Release 23.0.0.0.0 - for Oracle Cloud and Engineered Systems
Version 23.6.0.24.10
SQL>
  5. Follow these steps to connect to the database from the client-host machine:
    [oracle@client-host ~]$ $ORACLE_HOME/bin/sqlplus system//<PASSWORD>@//cman-host.sub12161926540.onsproxyvcn.oraclevcn.com:1521/raconssvc2.sub12161926541.onsproxyvcn.oraclevcn.com

    Note:

    Ensure the connection is successful before proceeding to the next step.

Configure fanWatcher on the Client Host

Follow these steps to configure FANWatcher on the client host machine:
  1. Copy the fanWatcher code and stage it on the client-host machine under the /tmp/app folder.
    [oracle@client-host response]$ mkdir /tmp/app
[oracle@client-host response]$ export CLASSPATH="/tmp/app:$ORACLE_HOME/opmn/lib/ons.jar:$ORACLE_HOME/jlib/oraclepki.jar:$ORACLE_HOME/jlib/osdt_core.jar:$ORACLE_HOME/jlib/osdt_cert.jar:$ORACLE_HOME/jdbc/lib/ojdbc8.jar:."
[oracle@client-host ~]$ cd /tmp/app/
[oracle@client-host app]$ ls -rlt
total 8
-rw-r--r--. 1 oracle oinstall 6434 Dec 17 21:00 fanWatcher.java
  2. Set up the fanWatcher.java file.
    [oracle@client-host app]$ javac fanWatcher.java
Note: fanWatcher.java uses or overrides a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
[oracle@client-host app]$[oracle@client-host app]$
[oracle@client-host app]$ export user=system
[oracle@client-host app]$ export password=<PASSWORD>
[oracle@client-host app]$ export url='jdbc:oracle:thin:@cman-host.sub12161926540.onsproxyvcn.oraclevcn.com:1521/raconssvc2' 
[oracle@client-host app]$ $ORACLE_HOME/jdk/bin/java -Doracle.ons.walletfile=/u01/app/client/wallet_dir -classpath ${CLASSPATH} fanWatcher "nodes=cman-host.sub12161926540.onsproxyvcn.oraclevcn.com:6200"
Subscribing to events of type:
Opening FAN Subscriber Window ...