Is there a way to connect to a wallet automatically using public keypair, then store credentials for future use without user required to give permission every time?
Related
The OCI Phyton SDK has functions, like GenerateAutonomousDatabaseWalletDetails and generate_autonomous_database_wallet, to generate the database wallet.
Is there any function that allows adding user credentials on the wallet for the available service names? Something similar to what can be done with mkstore and createCredentials option.
No, there is no function for adding user credentials. Perhaps somewhat aside, but the 'user' and 'password' would be specific to the database instance, would have to be pre-created in the database and given access privileges, are not tied to a cloud user identity it any way. The exception being the ADMIN user, who is both an IAM user and a database user.
The underlying connection APIs expect the 'user' and 'password' of these database users in addition to the TLS credentials and the encryption mechanics it provides.
I am building a custom credential provider. In that I want to provide the option of Self Service Password Reset (SSPR) to users.
The SSPR works fine when the the DC is reachable from the user machine. But if the DC is not reachable (like if user is remote and and can not connect to DC on login screen) and user wants to do SSPR, how can I update the local cached credentials of the user? Updating of password in DC is taken care of.
I found some tools already providing this functionality. One example is SSPR from specopssoft.
Is there any windows API which allows to reset/update the local cached credential of AD user?
Is it possible using Custom Credential Provider to make windows logon without real password of local user?
I'm already able to install/register sample code from Microsoft, and even able to debug it.
My expectation from this mechanism: User inputs some password and my implementation performs some comparison against local database of my password (stored as sqlite database).
Reality: local user password MUST be passed to LSA subsystem within
ICredentialProviderCredential::GetSerialization(...)
Frankly speaking I'm trying to use some sort of -one-time-coupon codes as passwords, to login to a kiosk-like workstation.
This is the main reason for developing custom credential provider.
Your provider must return to the Logon UI or Cred UI the authentication information. It can be a login/password pair or a certificate based authentication.
Inside of your database you can store a real user's password and return it after checking your own OTP.
I use WNetAddConnection2 to connect the windows share drive using user name and password, which store in our own database. Although I encrypt the password in the database, but have to decrypt in the client to conduct the real connection. My program is running under condor.
This method has the security risk to leak the password. Could I implement a token method to authorize the windows share drive? This token have to be generated by one computer, and used by other computers.
Our organization use windows domain to store user name and password. All computers are variable Windows operating systems.
Thanks for any suggestions. Please let me know if more information required.
I am trying to store password in an Oracle Wallet file which I will retrieve from the code and use.
I tried to create a wallet and save a credential there:-
$ mkstore -wrl <wallet_location> -createCredential sid scott tiger
Oracle Secret Store Tool : Version 12.1.0.2
Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved.
Enter wallet password:
Create credential oracle.security.client.connect_string1
The creation does not give any error but when I try to list the credential, I don’t get anything.
$ mkstore -wrl -listCredential
Oracle Secret Store Tool : Version 12.1.0.2
Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved
Also, how to retrieve this password using java?
For connecting the Oracle DB using wallet requires the following changes.
you need to create a wallet store, you need to also choose a password for the wallet and you need to use this password while modifying the wallet
OracleClientHome/bin/mkstore -wrl Where you want to store your wallet -create
e.g. C:\Oracle_11.2.0\product\client_1\bin\mkstore -wrl C:\Users\sample\app\wallet
you need to add the tns entries in tnsnames.ora (OracleClientHome/network/admin/tnsnames.ora) and same tns entry name will be used us wallet connect string
TNS_Entry_Name=(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=Hostname)(PORT=Port_Number))(CONNECT_DATA=(SERVER=dedicated)(SERVICE_NAME=Service_Name)))
e.g. C:\Oracle_11.2.0\product\client_1\network\admin\tnsnames.ora
SAMPLEDB_RO=(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=HostName)(PORT=PortNumber))(CONNECT_DATA=(SERVER=dedicated)(SERVICE_NAME=samplesrv)))
you need to create wallet entry for the above tns entry with credentials, you also need to provide the wallet password which you have given while creating the wallet.
OracleClientHome/bin/mkstore -wrl Where you want to store your wallet -createCredential TNS_Entry_Name/Wallet_Entry_name DB_Username DB_Password
e.g. C:\Oracle_11.2.0\product\client_1\bin\mkstore -wrl C:\Users\sample\app\wallet -createCredential SAMPLEDB_RO sample sample
you need to add the sqlnet.ora file to update the wallet location and wallet override flag to true
WALLET_LOCATION =(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=Where you want to store your wallet)))
SQLNET.WALLET_OVERRIDE = TRUE
e.g.
WALLET_LOCATION =(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=C:\Users\sample\app\wallet)))
SQLNET.WALLET_OVERRIDE = TRUE
test the db connection using wallet and oracle client to make sure the wallet configurations are correct
OracleClientHome/bin/sqlplus /nolog
connect DB_Username/DB_Password#TNS_Entry_Name
connect /#TNS_Entry_Name
e.g.
connect sample/sample#SAMPLEDB_RO
connect /#SAMPLEDB_RO
you need to make the java application ready to use the wallet and run the java program with the below JVM Parameters
Add the following jars to the application classpath.
OracleClientHome/jdbc/lib/ojdbc.jar
OracleClientHome/jlib/oraclepki.jar
OracleClientHome/jlib/osdt_cert.jar
OracleClientHome/jlib/osdt_core.jar
e.g.
C:\Oracle_11.2.0\product\client_1\jdbc\lib\ojdbc.jar
C:\Oracle_11.2.0\product\client_1\jlib\oraclepki.jar
C:\Oracle_11.2.0\product\client_1\jlib\osdt_cert.jar
C:\Oracle_11.2.0\product\client_1\jlib\osdt_core.jar
Change application configuration thin url to use the wallet
jdbc:oracle:thin:/#TNS_Entry_Name/Wallet_Entry_name
e.g.
jdbc:oracle:thin:/#SAMPLEDB_RO
Also add the following properties as JVM Parameters, this help the library to find the oracle wallet
-Doracle.net.tns_admin=OracleClientHome/network/admin -Doracle.net.wallet_location=Where you want to store your wallet
e.g. -Doracle.net.tns_admin=C:\Oracle_11.2.0\product\client_1\network\admin -Doracle.net.wallet_location=C:\Users\sample\app\wallet
You are all set!!
For listing the existing credentials in the wallet you can use the below command, but you need to provide the wallet password which you have given while creating the wallet.
OracleClientHome/bin/mkstore -wrl Where you want to store your wallet -listCredential
e.g. C:\Oracle_11.2.0\product\client_1\bin\mkstore -wrl C:\Users\sample\app\wallet -listCredential
One important thing you must have in mind is, that the alias you choose for the createCredential command must be identical to the URL you are using for the connection.
When your JDBC connection string looks like jdbc:oracle:thin:/#dbsrv:1521/orcl you must use the command
mkstore -wlr /foobar -createCredential dbsrv:1521/orcl USER PASSWORD