Configuring Clients to Use the External Password Store - syncsort_capacity_management - 12 - 12.40

Syncsort Capacity Management Installation Guide
Product type
Software
Portfolio
Integrate
Product family
Syncsort
Product
Syncsort Capacity Management
Version
12.40
Language
English
Product name
Syncsort Capacity Management
Title
Syncsort Capacity Management Installation Guide
Topic type
How Do I
Copyright
2023
First publish date
1985

If your client is already configured to use external authentication, such as Windows native authentication or Secure Sockets Layer (SSL), then that authentication method will be used. The same credentials used for such authentication are typically also used to log in to the database.

For clients not using such authentication methods or wanting to override them for database authentication, a new parameter (SQLNET.WALLET_OVERRIDE) in sqlnet.ora can be set to TRUE. The default value for SQL­NET.WALLET_OVERRIDE is FALSE, allowing standard use of authentication credentials as before.

If you want a client to use the secure external password store feature, then perform the following configuration tasks.

To enable clients to use the external password store:
  1. Create a wallet on the client by using the following syntax at the command line:

    mkstore -wrl <wallet_location> -create

    wallet_location is the path to the directory where you want to create and store the wallet. This command creates an Oracle wallet with the auto login feature enabled at the location you specify. The auto login feature enables the client to access the wallet contents without supplying a password. Refer to Oracle Data­base Advanced Security Administrator’s Guide for information about auto login wallets.

    Create an Oracle wallet in the previously specified location using the mkstore utility with the -create option. The wallet is password protected, but is defined with the “Auto Login” property enabled so connection attempts by the user who created the wallet do not require a password.

  2. Create database connection credentials in the wallet by using the following syntax at the command line:

    mkstore -wrl <wallet_location> -createCredential <db_connect_string>

    <username> <password>

    wallet_location is the path to the directory where you created the wallet in Step 1. The db_connect_string can be the TNS alias you use to specify the database in the tnsnames.ora file or any service name you use to identify the database on an Oracle network. The username and password are the database login credentials.

    Repeat this step for each database you want accessible using the CONNECT /@db_connect_string syntax.

    Note: The db_connect_string used in the CONNECT /@db_connect_string statement must be identical to the db_connect_string specified in the -createCredential command.

  3. In the client sqlnet.ora file, enter the WALLET_LOCATION parameter and set it to the directory location of the wallet you created in Step 1.

    For example, if you created the wallet in $ORACLE_HOME/network/admin and your Oracle home is set to /private/ora102, then you need to enter the following into your client sqlnet.ora file:
    
WALLET_LOCATION =
(SOURCE =
  (METHOD = FILE)
   (METHOD_DATA =
     (DIRECTORY = = /private/ora102/network/admin) 
  )
 )
  4. In the client sqlnet.ora file, enter the SQLNET.WALLET_OVERRIDE parameter and set it to TRUE as follows:

    SQLNET.WALLET_OVERRIDE = TRUE

    This setting causes all CONNECT /@db_connect_string statements to use the information in the wallet at the specified location to authenticate to databases.

    When external authentication is in use, an authenticated user with such a wallet can use the CONNECT /@db_connect_string syntax to access the previously specified databases without providing a user name and password. However, if a user fails that external authentication, then these connect statements also fail.

    Note: Multiple wallets may be created on a machine; however, each wallet should be contained in its own directory.
     

Following example shows a sample sqlnet.ora file with the WALLET_LOCATION and the SQLNET.WALLET_OVER­RIDE parameters set as described in Steps 3 and 4.

Example SQLNET.ORA File with Wallet Parameters Set:


WALLET_LOCATION =
  (SOURCE =  
   (METHOD = FILE)
   (METHOD_DATA =
    (DIRECTORY = /private/ora102/network/admin)
   )
  )
 SQLNET.WALLET_OVERRIDE = TRUE
 SSL_CLIENT_AUTHENTICATION = FALSE
 SSL_VERSION = 0