Oracle wallet provides an easy method to manage database credentials across multiple domains. It lets you update database credentials by updating the wallet instead of potentially changing many data source definitions. You accomplish updates by using a database connection string in the data source definition that is resolved by an entry in the wallet.

In addition, this feature can be made even easier by also using an Oracle TNS (Transparent Network Substrate) administrative file to hide the details of the database connection string (host name, port number, and service name) from the data source definition and instead use an alias. If the connection information changes, it is simply a matter of changing the tnsnames.ora file.

By using this approach, you remove the encrypted password from the data source descriptor so that it is portable across domains and the same wallet and tnsnames.ora file can be shared across multiple domains: that includes two different WebLogic Server domains or sharing credentials between WebLogic Server and the database. When used correctly, it makes having passwords in the data source configuration unnecessary.

Oracle wallet has an auto login feature that allows client access to the wallet contents without supplying a password. Use of this feature prevents exposing a clear text password on the client.

On the client, create a wallet by using the following syntax:

mkstore -wrl <wallet_location> -create

Where wallet_location is the path to the directory where you want to create and store the wallet.

This command creates a wallet with the auto login feature enabled at the location specified. Auto login lets the client access the wallet contents without supplying a password and prevents exposing a clear text password on the client.

The mkstore command prompts for a password that is used for subsequent commands. Passwords must have a minimum length of eight characters and contain alphabetic characters combined with numbers or special characters. For example:

mkstore -wrl /tmp/wallet –create 
Enter password: mysecret 
PKI-01002: Invalid password. 
Enter password: mysecret1  (not echoed) 
Enter password again: mysecret1 (not echoed)

You can store multiple credentials for multiple databases in one client wallet. You cannot store multiple credentials (for logging in to multiple schemas) for the same database in the same wallet. If you have multiple login credentials for the same database, then they must be stored in separate wallets.

To add database login credentials to an existing client wallet, enter the following command:

mkstore -wrl <wallet_location> -createCredential <db_connect_string> <username> <password>

Where:

• The wallet_location is the path to the directory where you created the wallet.

• The db_connect_string must be identical to the connection string that you specify in the URL used in the data source definition (the part of the string that follows the @). It can be either the short form or the long form of the URL. For example:

  myhost:1521/myservice OR

  (DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=myhost-scan)(PORT=1521)))(CONNECT_DATA=(SERVICE_NAME=myservice)))

  Note:

  You should enclose this value in quotation marks to escape any special characters from the shell. Because this name is generally a long and complex value, an alternative is to use a TNS alias. See Use a TNS Alias instead of a DB Connect String.

• The username and password are the database login credentials.

Repeat this procedure for each database you want to use in a WebLogic data source.

For more information about using auto login and maintaining wallet passwords, see the Oracle Database Advanced Security Administrator's Guide.

To configure a WebLogic Server data source to use an Oracle wallet, copy the wallet files to a secure directory on the client machine and update the data source configuration files.

Use the following procedures to configure a WebLogic Server data source to use a wallet.

• Copy the Wallet Files
  
• Update the Data Source Configuration
  

1. Specify oracle.net.tns_admin=tns_directory to Connection Properties, where tns_directory is the directory location of the tnsnames.ora file. Alternatively, if all the data sources in the server have the same value, use the -Doracle.net.tns_admin=<tns_directory> with the location of a tnsnames.ora file.
2. Create or modify the tnsnames.ora file in the directory location specified by tns_directory. The entry has the form:

   alias=(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=host)(PORT=port))(CONNECT_DATA=(SERVICE_NAME=service)))

   Where host is the URL of a database listener, port is the port of a database listener, and service is the service name of the database to which you want to connect.

   For additional attributes that you can configure, see Local Naming Parameters (tnsnames.ora) in the Database Net Services Reference. Oracle recommends that the string be entered on a single line.

3. Use the alias in the data source definition URL by replacing the connection string with the alias. For example, change the URL attribute on the Connection Pool page in the Remote Console to jdbc:oracle:thin:@alias.