OCCI：使用 SSL 钱包身份验证连接到 OracleDB
OCCI : Connecting to OracleDB using SSL wallet authentication
我对 OracleDB 还很陌生。我正在研究在不提供用户名和密码的情况下将客户端应用程序连接到服务器上的 Oracle 数据库。我的理解是否正确，这可以使用 orapki 钱包来实现？
我正在使用笔记本电脑同时充当客户端和服务器来对此进行测试。
我正在使用orapki为客户端和服务器端创建钱包，如下所示：
Create Server Wallet :
orapki wallet create -wallet "C:/app/wallet" -pwd Welcome1 -auto_login
orapki wallet add -wallet "C:/app/wallet" -pwd Welcome1 -dn "CN=MyHostName" -keysize 1024 -self_signed -validity 3650 -sign_alg sha256
orapki wallet export -wallet "C:/app/wallet" -pwd Welcome1 -dn "CN=MyHostName" -cert C:/app/wallet/MyHostName-certificate.crt
Create Client Wallet: [I choose CN name to match username for oracleDB login name, i.e., abcd]
orapki wallet create -wallet "C:/app/client_wallet" -pwd Welcome1 -auto_login
orapki wallet add -wallet "C:/app/client_wallet" -pwd Welcome1 -dn "CN=abcd" -keysize 1024 -self_signed -validity 3650 -sign_alg sha256
orapki wallet export -wallet "C:/app/client_wallet" -pwd Welcome1 -dn "CN=abcd" -cert C:/app/client_wallet/abcd-certificate.crt
从一侧加载证书到另一侧的钱包。
Load the server certificate into the client wallet.
orapki wallet add -wallet "C:/app/client_wallet" -pwd Welcome1 -trusted_cert -cert C:/app/wallet/MyHostName-certificate.crt
Load the Client certificate into the server wallet.
orapki wallet add -wallet "C:/app/wallet" -pwd Welcome1 -trusted_cert -cert C:/app/client_wallet/abcd-certificate.crt
显示钱包 给出以下结果：
Server Wallet:
orapki wallet display -wallet "C:/app/wallet" -pwd Welcome1
Oracle PKI Tool : Version 12.1.0.2
Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved.
Requested Certificates:
User Certificates:
Subject: CN=MyHostName
Trusted Certificates:
Subject: CN=abcd
Subject: CN=MyHostName
Client Wallet:
orapki wallet display -wallet "C:/app/client_wallet" -pwd Welcome1
Oracle PKI Tool : Version 12.1.0.2
Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved.
Requested Certificates:
User Certificates:
Subject: CN=abcd
Trusted Certificates:
Subject: CN=MyHostName
Subject: CN=abcd
我从上面的理解是服务器和客户端现在相互信任，因此有利于建立连接。
服务器设置文件如下图：
tnsnames.ora
TCP_ACTIVE =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = MyHostName)(PORT = 1521))
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = orcl)
)
)
TCPS_ACTIVE =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCPS)(HOST = MyHostName)(PORT = 1522))
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = orcl)
)
)
listener.ora
SSL_CLIENT_AUTHENTICATION = TRUE
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = C:\app\wallet)
)
)
SID_LIST_LISTENER =
(SID_LIST =
(SID_DESC =
(SID_NAME = CLRExtProc)
(ORACLE_HOME = C:\app\MyUser\product.1.0\dbhome_2)
(PROGRAM = extproc)
(ENVS = "EXTPROC_DLLS=ONLY:C:\app\MyUser\product.1.0\dbhome_2\bin\oraclr12.dll")
)
)
LISTENER =
(DESCRIPTION_LIST =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = MyHostName)(PORT = 1521))
(ADDRESS = (PROTOCOL = TCPS)(HOST = MyHostName)(PORT = 1522))
(ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
)
)
sqlnet.ora
SQLNET.AUTHENTICATION_SERVICES= (BEQ, TCPS, NTS)
SQLNET.WALLET_OVERRIDE = FALSE
#SSL_VERSION = 0
TRACE_LEVEL_CLIENT = SUPPORT
NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)
SSL_CLIENT_AUTHENTICATION = TRUE
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = C:\app\wallet)
)
)
#SSL_CIPHER_SUITES= (SSL_RSA_WITH_AES_256_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA)
我有一个简单的 c++ 测试 客户端 使用 OCCI 和设置文件，如下所示
tnsnames.ora
TCP_ACTIVE =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = MyHostName)(PORT = 1521))
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = orcl)
)
)
TCPS_ACTIVE =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCPS)(HOST = MyHostName)(PORT = 1522))
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = orcl)
)
)
sqlnet.ora
TRACE_LEVEL_CLIENT=support
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = C:\app\client_wallet)
)
)
SSL_CLIENT_AUTHENTICATION =TRUE
SSL_SERVER_DN_MATCH=OFF
TRACE_LEVEL_CLIENT = 16
TRACE_FILE_CLIENT = client_trace
TRACE_TIMESTAMP_CLIENT = ON
TRACE_DIRECTORY_CLIENT = C:\Client
DIAG_ADR_ENABLED=ON
我的服务器Listener服务状态如下图：
LSNRCTL> status
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=MyHostName)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for 64-bit Windows: Version 12.1.0.2.0 - Production
Start Date 24-OCT-2019 19:46:17
Uptime 0 days 21 hr. 31 min. 25 sec
Trace Level off
Security ON: Local OS Authentication
SNMP OFF
Listener Parameter File C:\app\MyUser\product.1.0\dbhome_2\network\admin\listener.ora
Listener Log File C:\app\MyUser\diag\tnslsnr\MyHostName\listener\alert\log.xml
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=MyHostName)(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=MyHostName)(PORT=1522)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\.\pipe\EXTPROC1521ipc)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=MyHostName)(PORT=5500))(Security=(my_wallet_directory=C:\app\wallet))(Presentation=HTTP)(Session=RAW))
Services Summary...
Service "CLRExtProc" has 1 instance(s).
Instance "CLRExtProc", status UNKNOWN, has 1 handler(s) for this service...
Service "orcl" has 1 instance(s).
Instance "orcl", status READY, has 1 handler(s) for this service...
Service "orclXDB" has 1 instance(s).
Instance "orcl", status READY, has 1 handler(s) for this service...
The command completed successfully
当我尝试使用连接字符串“TCP_ACTIVE”连接到服务器并提供用户名和密码时，我能够连接通常
Environment *env = Environment::createEnvironment();
Connection *conn = env->createConnection(m_username.c_str(), m_password.c_str(), m_dbConnectionString.c_str());
"conn" 中的连接似乎已形成并且能够成功地使用它来 运行 简单查询。
但是当我尝试使用 TCPS_ACTIVE 连接字符串连接到服务器时，只有在我提供用户名和密码时才能连接.以下是我在未提供用户名和密码时收到的错误消息：
ORA-01017: invalid username/password; logon denied
我很好奇是否可以使用钱包连接到服务器而不使用用户名和密码？如果是这样，我应该如何设置它以进行测试？
谢谢
P.S。 : 我调查过 similar question 但我不明白设置是如何完成的。
我的用户似乎需要在外部被识别为 "CN=abcd" 才能正常工作。
使用管理员登录转到 SQL 开发人员并 运行 :
alter user abcd identified externally as 'CN=abcd';
以上代码无需使用密码即可连接。
我对 OracleDB 还很陌生。我正在研究在不提供用户名和密码的情况下将客户端应用程序连接到服务器上的 Oracle 数据库。我的理解是否正确，这可以使用 orapki 钱包来实现？
我正在使用笔记本电脑同时充当客户端和服务器来对此进行测试。
我正在使用orapki为客户端和服务器端创建钱包，如下所示：
Create Server Wallet :
orapki wallet create -wallet "C:/app/wallet" -pwd Welcome1 -auto_login
orapki wallet add -wallet "C:/app/wallet" -pwd Welcome1 -dn "CN=MyHostName" -keysize 1024 -self_signed -validity 3650 -sign_alg sha256
orapki wallet export -wallet "C:/app/wallet" -pwd Welcome1 -dn "CN=MyHostName" -cert C:/app/wallet/MyHostName-certificate.crt
Create Client Wallet: [I choose CN name to match username for oracleDB login name, i.e., abcd]
orapki wallet create -wallet "C:/app/client_wallet" -pwd Welcome1 -auto_login
orapki wallet add -wallet "C:/app/client_wallet" -pwd Welcome1 -dn "CN=abcd" -keysize 1024 -self_signed -validity 3650 -sign_alg sha256
orapki wallet export -wallet "C:/app/client_wallet" -pwd Welcome1 -dn "CN=abcd" -cert C:/app/client_wallet/abcd-certificate.crt
从一侧加载证书到另一侧的钱包。
Load the server certificate into the client wallet.
orapki wallet add -wallet "C:/app/client_wallet" -pwd Welcome1 -trusted_cert -cert C:/app/wallet/MyHostName-certificate.crt
Load the Client certificate into the server wallet.
orapki wallet add -wallet "C:/app/wallet" -pwd Welcome1 -trusted_cert -cert C:/app/client_wallet/abcd-certificate.crt
显示钱包 给出以下结果：
Server Wallet:
orapki wallet display -wallet "C:/app/wallet" -pwd Welcome1
Oracle PKI Tool : Version 12.1.0.2
Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved.
Requested Certificates:
User Certificates:
Subject: CN=MyHostName
Trusted Certificates:
Subject: CN=abcd
Subject: CN=MyHostName
Client Wallet:
orapki wallet display -wallet "C:/app/client_wallet" -pwd Welcome1
Oracle PKI Tool : Version 12.1.0.2
Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved.
Requested Certificates:
User Certificates:
Subject: CN=abcd
Trusted Certificates:
Subject: CN=MyHostName
Subject: CN=abcd
我从上面的理解是服务器和客户端现在相互信任，因此有利于建立连接。
服务器设置文件如下图：
tnsnames.ora
TCP_ACTIVE =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = MyHostName)(PORT = 1521))
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = orcl)
)
)
TCPS_ACTIVE =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCPS)(HOST = MyHostName)(PORT = 1522))
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = orcl)
)
)
listener.ora
SSL_CLIENT_AUTHENTICATION = TRUE
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = C:\app\wallet)
)
)
SID_LIST_LISTENER =
(SID_LIST =
(SID_DESC =
(SID_NAME = CLRExtProc)
(ORACLE_HOME = C:\app\MyUser\product.1.0\dbhome_2)
(PROGRAM = extproc)
(ENVS = "EXTPROC_DLLS=ONLY:C:\app\MyUser\product.1.0\dbhome_2\bin\oraclr12.dll")
)
)
LISTENER =
(DESCRIPTION_LIST =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = MyHostName)(PORT = 1521))
(ADDRESS = (PROTOCOL = TCPS)(HOST = MyHostName)(PORT = 1522))
(ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
)
)
sqlnet.ora
SQLNET.AUTHENTICATION_SERVICES= (BEQ, TCPS, NTS)
SQLNET.WALLET_OVERRIDE = FALSE
#SSL_VERSION = 0
TRACE_LEVEL_CLIENT = SUPPORT
NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)
SSL_CLIENT_AUTHENTICATION = TRUE
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = C:\app\wallet)
)
)
#SSL_CIPHER_SUITES= (SSL_RSA_WITH_AES_256_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA)
我有一个简单的 c++ 测试 客户端 使用 OCCI 和设置文件，如下所示
tnsnames.ora
TCP_ACTIVE =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = MyHostName)(PORT = 1521))
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = orcl)
)
)
TCPS_ACTIVE =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCPS)(HOST = MyHostName)(PORT = 1522))
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = orcl)
)
)
sqlnet.ora
TRACE_LEVEL_CLIENT=support
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = C:\app\client_wallet)
)
)
SSL_CLIENT_AUTHENTICATION =TRUE
SSL_SERVER_DN_MATCH=OFF
TRACE_LEVEL_CLIENT = 16
TRACE_FILE_CLIENT = client_trace
TRACE_TIMESTAMP_CLIENT = ON
TRACE_DIRECTORY_CLIENT = C:\Client
DIAG_ADR_ENABLED=ON
我的服务器Listener服务状态如下图：
LSNRCTL> status
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=MyHostName)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for 64-bit Windows: Version 12.1.0.2.0 - Production
Start Date 24-OCT-2019 19:46:17
Uptime 0 days 21 hr. 31 min. 25 sec
Trace Level off
Security ON: Local OS Authentication
SNMP OFF
Listener Parameter File C:\app\MyUser\product.1.0\dbhome_2\network\admin\listener.ora
Listener Log File C:\app\MyUser\diag\tnslsnr\MyHostName\listener\alert\log.xml
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=MyHostName)(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=MyHostName)(PORT=1522)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\.\pipe\EXTPROC1521ipc)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=MyHostName)(PORT=5500))(Security=(my_wallet_directory=C:\app\wallet))(Presentation=HTTP)(Session=RAW))
Services Summary...
Service "CLRExtProc" has 1 instance(s).
Instance "CLRExtProc", status UNKNOWN, has 1 handler(s) for this service...
Service "orcl" has 1 instance(s).
Instance "orcl", status READY, has 1 handler(s) for this service...
Service "orclXDB" has 1 instance(s).
Instance "orcl", status READY, has 1 handler(s) for this service...
The command completed successfully
当我尝试使用连接字符串“TCP_ACTIVE”连接到服务器并提供用户名和密码时，我能够连接通常
Environment *env = Environment::createEnvironment();
Connection *conn = env->createConnection(m_username.c_str(), m_password.c_str(), m_dbConnectionString.c_str());
"conn" 中的连接似乎已形成并且能够成功地使用它来 运行 简单查询。
但是当我尝试使用 TCPS_ACTIVE 连接字符串连接到服务器时，只有在我提供用户名和密码时才能连接.以下是我在未提供用户名和密码时收到的错误消息：
ORA-01017: invalid username/password; logon denied
我很好奇是否可以使用钱包连接到服务器而不使用用户名和密码？如果是这样，我应该如何设置它以进行测试？
谢谢
P.S。 : 我调查过 similar question 但我不明白设置是如何完成的。
我的用户似乎需要在外部被识别为 "CN=abcd" 才能正常工作。 使用管理员登录转到 SQL 开发人员并 运行 :
alter user abcd identified externally as 'CN=abcd';
以上代码无需使用密码即可连接。