Proxy Authentication (Oracle DB)

Sometimes administrators need to connect to an application schema to perform maintenance. Sharing the application schema password among several administrators would provide no accountability. Instead, proxy authentication allows the administrators to authenticate with their own credentials first and then proxy to the application schema. In such cases, the audit records show the actual user who performed the maintenance activities. This form of proxy authentication is supported in Oracle Call Interface (OCI), JDBC, and on the SQL*PLUS command line.

Client-side Oracle wallet

Users are expected to provide the password when they connect to the database, but applications, middle-tier systems, and batch jobs cannot depend on a human to type the password. Earlier, a common way to provide passwords was to embed user names and passwords in the code or in scripts. This increased the attack surface and people had to make sure that their scripts were not exposed to anyone else. Also, if passwords were ever changed, changes to the scripts were required. Now you can store password credentials by using a client-side Oracle wallet. This reduces risks because the passwords are no longer exposed on command-line history, and password management policies are more easily enforced without changing application code whenever user names or passwords change.

12c: Managing PDBs

Managing a pluggable database (PDB) involves a subset of the tasks required to administer a non-CDB. In this subset of tasks, most are the same for a PDB and a non-CDB, but there are some differences. A PDB administrator is limited to managing a single PDB and cannot affect other PDBs in the multitenant container database (CDB).

12c: ORA-65114: space usage in container is too high

ORA-65114: space usage in container is too high

Cause: Space usage in the current container exceeded the value of MAX_PDB_STORAGE for the container.

Action: Specify a higher value for MAX_PDB_STORAGE using the ALTER PLUGGABLE DATABASE statement.

12c: Network Data Encryption

Few organizations today have access to truly private and secure networks; instead, they share network infrastructure with other organizations. As a result, information traveling over these public or virtual private networks is often vulnerable to interception. The purpose of a secure cryptosystem is to convert plaintext data into unintelligible ciphertext based on a key, in such a way that it is very hard (computationally infeasible) to convert ciphertext back into its corresponding plaintext without knowledge of the correct key.

12c: Transparent Sensitive Data Protection

TSDP is the another new security feature of Oracle 12c , basically a complement to Data Redaction and Virtual Private Database. It allows to categorize sensitive columns across database and then to set a policy to each defined category of columns for example telephone number columns' policy to redact into a random number.

The packages DBMS_TSDP_MANAGE and DBMS_ TSDP_PROTECT are used to manage the categories and policies.

12c: Data Redaction

Oracle Data Redaction  is the feature which enables to mask data at run time that is returned from queries issued by applications. During the time that the data is being masked or redacted, all of the data processing is performed normally, and the back-end referential integrity constraints are preserved. It is ideal for situations in which you must redact specific characters out of the result set of queries of Personally Identifiable Information (PII) returned to certain application users. 

12c: Using Transparent Data Encryption

Oracle Database uses authentication, authorization, and auditing mechanisms to secure data in the database, but not in the operating system data files where data is stored. To protect these data files, Oracle Database provides Transparent Data Encryption (TDE). TDE encrypts sensitive data stored in data files. To prevent unauthorized decryption, TDE stores the encryption keys in a security module external to the database, called a keystore.

12c: Using In-Memory Column Store

The In-Memory Column Store (IM column store) is an optional portion of the system global area (SGA) that stores copies of tables, table partitions, and other database objects. In the IM column store, data is populated by column rather than row as it is in other parts of the SGA, and data is optimized for rapid scans, it does not replace the buffer cache, but acts as a supplement. The IM column store is included with the Oracle Database In-Memory option. To enable the IM column store, the INMEMORY_SIZE initialization parameter must be set to a non-zero value.

12c: Monitor SGA Memory on PDB

The CDB and all pluggable databases (PDBs) share a single database instance composed of the system global area (SGA) and background processes. Because of this sharing of memory resources, it would be desirable to distinguish resource usage among databases sharing the instance. You can use the below script to get it.

12c: Enterprise Manager Database Express

For Oracle Database 12c, Enterprise Manager Express enables you to perform administrative tasks such as managing user security and managing database memory and storage. You can also view performance and status information about your database. You can access Enterprise Manager Database Express using the URL that was displayed during installation. The default port used is 5011. In case you want to use a different port, you need to configure the port using the dynamic protocol registration method. After the HTTP port is configured, you use it to access Enterprise Manager Express.

12c: SYSBACKUP, SYSDG and SYSKM Administrative Users

In order to support segregation of duties requirements, Oracle 12c has introduced new administrative roles to conform to the principle of access to the least privilege. Three new user SYSBACKUP, SYSDG and SYSKM are created in support of this, when the database is created, with their account in the “EXPIRED & LOCKED” status. A equivalent administrative privilege with the same name as the user is created as well.

12c: Database Resident Connection Pooling

Database Resident Connection Pooling (DRCP) provides a connection pool in the database server for typical Web application usage scenarios. It complements middle-tier connection pools that share connections between threads in a middle-tier process. DRCP is relevant for architectures with multi-process single threaded application servers (such as PHP/Apache) that cannot perform middle-tier connection pooling. DRCP is available to clients that use the OCI driver with C, C++, and PHP.

12c: Using DBFS

Oracle 12c introduces HTTP/HTTPS, FTP and WebDAV access to DBFS via the "/dbfs" virtual directory in the XML DB repository.

12c: Plugging unplugging Database

1- Unplugging the PDB

To unplug a PDB, you first close it and then generate an XML manifest file. The XML file contains information about the names and the full paths of the tablespaces, as well as data files of the unplugged PDB. The information will be used by the plugging operation.

12c: Working with Oracle Multitenant

Working with Oracle Multitenant
Environment: Oracle Database 12c (12.1.0) Installed on Windows 7

Creating a CDB creates a service whose name is the CDB name. As a side effect of creating a PDB in the CDB, a service is created inside it with a property that identifies it as the initial current container. The service is also started as a side effect of creating the PDB. The service has the same name as the PDB. Although its metadata is recorded inside the PDB, the invariant is maintained so that a service name is unique within the entire CDB.

12c: Configure EM Database Express HTTP port

In case you want to change default port of 12c EM Database Express, you need to configure the port using the dynamic protocol registration method. After the HTTP port is configured, you use it to access Enterprise Manager Express.

1- C:\Users\inam.HOME>set oracle_home=D:\app\Inam\product\12.1.0\dbhome_1

2- Verify that the listener is started by executing the lsnrctl status command.

C:\Users\inam.HOME>lsnrctl status

LSNRCTL for 64-bit Windows: Version 12.1.0.1.0 - Production on 22-JUL-2013 09:54:41

Copyright (c) 1991, 2013, Oracle.  All rights reserved.

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))
STATUS of the LISTENER
------------------------
Alias                     LISTENER
Version                   TNSLSNR for 64-bit Windows: Version 12.1.0.1.0 - Production
Start Date                18-JUL-2013 11:21:15
Uptime                    3 days 22 hr. 33 min. 27 sec
Trace Level               off
Security                  ON: Local OS Authentication
SNMP                      OFF
Listener Parameter File   D:\app\Inam\product\12.1.0\dbhome_1\network\admin\listener.ora
Listener Log File         D:\app\Inam\diag\tnslsnr\Inam-pc\listener\alert\log.xml
Listening Endpoints Summary...
  (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC1521ipc)))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=Inam-pc.HOME.domain)(PORT=1521)))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=Inam-pc.HOME.domain)(PORT=5500))(Security=(my_wallet_directory=D:\APP
admin\or12c\xdb_wallet))(Presentation=HTTP)(Session=RAW))
Services Summary...
Service "CLRExtProc" has 1 instance(s).
  Instance "CLRExtProc", status UNKNOWN, has 1 handler(s) for this service...
Service "or12c.HOME.domain" has 1 instance(s).
  Instance "or12c", status READY, has 1 handler(s) for this service...
Service "or12cXDB.HOME.domain" has 1 instance(s).
  Instance "or12c", status READY, has 1 handler(s) for this service...
Service "pdbor12c.HOME.domain" has 1 instance(s).
  Instance "or12c", status READY, has 1 handler(s) for this service...
The command completed successfully
3- Log in to SQL*Plus as the SYSDBA user and verify that the DISPATCHERS parameter in the initialization parameter file includes the PROTOCOL=TCP attribute.
C:\Users\inam.HOME>set oracle_sid=or12c
C:\Users\inam.HOME>sqlplus / as sysdba

SQL*Plus: Release 12.1.0.1.0 Production on Mon Jul 22 09:55:31 2013
Copyright (c) 1982, 2013, Oracle.  All rights reserved.
Connected to:
Oracle Database 12c Enterprise Edition Release 12.1.0.1.0 - 64bit Production
With the Partitioning, OLAP, Advanced Analytics and Real Application Testing options

SQL> show parameters dispatcher

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
dispatchers                          string      (PROTOCOL=TCP) (SERVICE=or12cX
                                                 DB)
max_dispatchers                      integer

4-  Execute the DBMS_XDB.setHTTPPort procedure to set the HTTP port for Enterprise Manager Express.

SQL> EXEC DBMS_XDB.setHTTPPort(8081);

PL/SQL procedure successfully completed.

5- D:\app\Inam\product\12.1.0\dbhome_1\BIN>lsnrctl status

LSNRCTL for 64-bit Windows: Version 12.1.0.1.0 - Production on 22-JUL-2013 10:32:24

Copyright (c) 1991, 2013, Oracle.  All rights reserved.

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))
STATUS of the LISTENER
------------------------
Alias                     LISTENER
Version                   TNSLSNR for 64-bit Windows: Version 12.1.0.1.0 - Production
Start Date                22-JUL-2013 10:28:01
Uptime                    0 days 0 hr. 4 min. 26 sec
Trace Level               off
Security                  ON: Local OS Authentication
SNMP                      OFF
Listener Parameter File   D:\app\Inam\product\12.1.0\dbhome_1\network\admin\listener.ora
Listener Log File         D:\app\Inam\diag\tnslsnr\Inam-pc\listener\alert\log.xml
Listening Endpoints Summary...
  (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC1521ipc)))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=Inam-pc.HOME.domain)(PORT=1521)))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=Inam-pc.HOME.domain)(PORT=8081))(Presentation=HTTP)(Session=RAW))
Services Summary...
Service "CLRExtProc" has 1 instance(s).
  Instance "CLRExtProc", status UNKNOWN, has 1 handler(s) for this service...
Service "or12c.HOME.domain" has 1 instance(s).
  Instance "or12c", status READY, has 1 handler(s) for this service...
Service "or12cXDB.HOME.domain" has 1 instance(s).
  Instance "or12c", status READY, has 1 handler(s) for this service...
Service "pdbor12c.HOME.domain" has 1 instance(s).
  Instance "or12c", status READY, has 1 handler(s) for this service...
The command completed successfully

5- In your Web browser enter the URL to access Enterprise Manager: http://inam-pc.HOME.domain:8081/em

Installing 12c RAC on Linux

Pre-Req
Familiarity with Oracle Virtual Machine
Understaning with Oracle RAC eg; 11gRAC. You can have the understanding by below posts.
Installing Oracle 11g RAC on Windows 2008
Installing 11gR2 RAC on Linux
Installing 11gR2 RAC on Solaris

Oracle Database 12c: Are you ready?

What is 12c Database?

Oracle Database 12c is the next release of Oracle’s flagship database product, expected to be launched in calendar Q1, 2013. Because it is  not yet officially launched to general availability , information about it, is limited. following are the information I could manage to gather from various sources, 100% authenticity is not guaranteed until the product is released officially.