Oracle Key Vault (OKV) enables customers to easily deploy encryption and other security solutions by offering robust, central management of encryption keys, Oracle Wallets, Java Keystores, and credential files.
Enterprise User Security (EUS) is an
Oracle
Database EE
feature
which
leverages
the LDAP-compliant directory services to centralize database
user and role management.
While implementing EUS, we need to register the DB with the LDAP which houses the users. This process creates a DB wallet which is used to securely communicate to the LDAP.
Question is if we can use OKV to store this wallet and EUS can refer to OKV instead of wallet stored locally in the DB thereby enhancing Security.
Here's what I could find out on this -
- When we register a database to OUD using DBCA, a local wallet will always be created containing the credentials for OUD access.
- This behavior cannot be changed, however the same wallet can be uploaded to OKV for a backup using okvutil utility.
- We cannot use/get the EUS credentials directly from OKV, they will always be taken from the local wallet [i.e. sqlnet.ora will not refer to OKV wallet].
- Even if the EUS wallet is uploaded in the OKV after the DB registration, we cannot do a 'direct connection' to OKV to retrieve EUS credentials from the virtual wallet. Such a 'direct connection' is possible with TDE wallets (OKV directly provides access to the TDE master keys). The wallets containing SSL certificates or credentials can be uploaded to OKV and downloaded at will, but client cannot be configured to use them directly from OKV.
- There is no auto sync job for the wallet (local->OKV), once the credentials change, we need to re-upload the wallet in the OKV.
