Authenticate OAuth Database Connection with Microsoft EntraID

EntraID is a passwordless way to authenticate into database. A regular credential uses username/password to authenticate with RDBMS. With EntraID, use client_id, tenant_id, app_id_uri, and client_secret for connecting to database. These values are embedded in the database connection string.

Oracle GoldenGate supports Microsoft Entra ID OAuth authentication by allowing a client secret to be stored in the GoldenGate CredentialStore and supplied during DBLOGIN. The client secret is used instead of a database password.

This configuration is intended for plugin-based OAuth authentication using an Entra ID service principal.

How Authentication Works

The GoldenGate authentication flow is as follows:

1. GoldenGate receives DBLOGIN USERIDALIAS ali_entra_u1.
2. It resolves ali_entra_u1 in the CredentialStore.
3. Identifies the entry as an Entra ID credential.
4. Reads the client secret from the CredentialStore.
5. Reads the remaining Entra ID attributes from the cdb1_pdb1 connect descriptor.
6. Establishes the database session using Microsoft Entra ID OAuth authentication.

Prerequisites

Before configuring GoldenGate DBLOGIN for Microsoft EntraID, ensure that:

• The Microsoft Entra application and service principal are configured.
• The service principal is authorized to connect to the target Oracle AI Database.
• The Oracle client connection descriptor contains the required Entra ID attributes.
• The GoldenGate CredentialStore is available and initialized.
• The client secret is available for registration in the CredentialStore.

Configure the Database Connect Descriptor

The EZConnect or TNS alias used by GoldenGate must contain the Entra ID connection attributes:

• TOKEN_AUTH=AZURE_SERVICE_PRINCIPAL
• TENANT_ID
• CLIENT_ID
• AZURE_DB_APP_ID_URI

For example:

cdb1_pdb1 =
  (DESCRIPTION =
    (ADDRESS =
      (PROTOCOL = tcps)
      (HOST = phoenix711387)
      (PORT = 61986)
    )
    (SECURITY =
      (SSL_SERVER_CERT_DN = "C=US,O=OracleCorporation,CN=sslserver1")
      (TOKEN_AUTH = AZURE_SERVICE_PRINCIPAL)
      (TENANT_ID = 443e3044-e82d-410a-8b0a-57498722241d)
      (CLIENT_ID = 30c99cb0-c7ab-4430-bcb6-7c0ca5b8fdee)
      (AZURE_DB_APP_ID_URI =
        https://ftest_cdb1_pdb1.az207oracleoutlook.onmicrosoft.com
      )
    )
    (CONNECT_DATA =
      (SERVICE_NAME = cdb1_pdb1.regress.rdbms.dev.us.oracle.com)
    )
  )

The connect descriptor stores the non-secret Entra ID connection properties. The client secret must be stored separately in the GoldenGate CredentialStore.

Add the Entra ID Credential

Use the CLIENTSECRET keyword to create an Entra ID credential:

ALTER CREDENTIALSTORE ADD USER /@cdb1_pdb1
  ALIAS ali_entra_u1
  CLIENTSECRET XkE8Q~rWlDiIl4bKAsWoER8m7hNrX_KBvG_bgdhT

Where:

• /@cdb1_pdb1 identifies the connect descriptor.
• ali_entra_u1 is the GoldenGate credential alias.
• CLIENTSECRET identifies the credential as an Entra ID OAuth credential.
• The value following CLIENTSECRET is the Entra ID application client secret.

An Entra ID CredentialStore entry contains the client secret only. It does not contain a database username or database password.

Log in Using the Credential Alias

After adding the credential, use the alias with DBLOGIN:

DBLOGIN USERIDALIAS ali_entra_u1

GoldenGate resolves the alias and uses the following authentication information:

• CLIENT_ID, TENANT_ID, and AZURE_DB_APP_ID_URI from the connect descriptor.
• CLIENTSECRET from the CredentialStore.

There is no requirment for a database username and password. Instead, GoldenGate supplies the client secret to the Oracle client OAuth session.

Use CLIENTSECRET for Entra ID OAuth authentication. Do not use NOPASSWORD when the client secret is being stored in the GoldenGate CredentialStore.

Considerations

• The client secret must correspond to the Entra ID application identified by CLIENT_ID.
• The TENANT_ID, CLIENT_ID, and AZURE_DB_APP_ID_URI values must be consistent with the Entra ID application and target database configuration.
• The client secret is associated with the GoldenGate alias, while the other OAuth parameters are associated with the database connect descriptor.
• Do not include a database username or password when creating an Entra ID credential.
• Use a separate credential alias for each client secret or target connection as required by your deployment.
• Protect the client secret during command execution and avoid recording it in scripts, command histories, or diagnostic output.