🔐 Oracle GoldenGate Credential Store - Complete Guide 🔐
🤔 What is the Oracle GoldenGate Credential Store?
The Oracle GoldenGate Credential Store is a security feature that securely stores database login credentials (usernames and passwords) in an encrypted wallet file. This eliminates the security risk of hard-coding sensitive passwords in parameter files or commands.
The credential store is managed through the GoldenGate Software Command Interface (ggsci), making it easy to integrate into your data replication workflow.
✨ Benefits of Using the Credential Store
- 🛡️ Enhanced Security: Credentials are stored in an encrypted format
- 🧰 Simplified Management: No need to update multiple parameter files when passwords change
- ⚠️ Reduced Risk: Eliminates plaintext passwords in configuration files
- ⚡ Operational Efficiency: Use aliases instead of managing credentials directly
📝 Step 1: Creating the Credential Store
From the GGSCI command prompt, create your credential store:
ADD CREDENTIALSTORE
By default, GoldenGate creates the wallet in $OGG_HOME/dircrd/. You can specify a custom location by modifying the GLOBALS file:
vi $OGG_HOME/GLOBALS
CREDENTIALSTORELOCATION /your/custom/path
If you change the location, you'll need to run the CREATE CREDENTIALSTORE command again.
👤 Step 2: Adding User Credentials
To add database credentials to your store:
ALTER CREDENTIALSTORE ADD USER <username>@<tns_alias>, ALIAS <your_alias> [DOMAIN <domain_name>]
Example:
ALTER CREDENTIALSTORE ADD USER ggadmin@ggdb, ALIAS ggdb
When you run this command, GoldenGate will securely prompt you for the password.
🔄 Step 3: Using Your Stored Credentials
Once you've stored your credentials, you can use them in your DBLOGIN command:
DBLOGIN USERIDALIAS ggdb
You can also reference them in your extract or replicat parameter files:
USERIDALIAS ggdb
✅ Step 4: Testing the Connection
Verify your credentials are working correctly:
DBLOGIN USERIDALIAS ggdb
A successful connection will show:
Successfully logged into database.
⚠️ Common Errors and Troubleshooting
🚫 Error: Credential store location was not found
Solution:
- If you haven't created the store yet: Run
ADD CREDENTIALSTORE - If using a custom path: Verify the directory exists and has the proper permissions
🚫 ORA-12154: TNS:could not resolve the connect identifier specified
Solution:
- Verify your
tns_aliasis correctly defined - Check that
tnsnames.orais accessible
Set your environment variables:
export TNS_ADMIN=/path/to/network/admin
export LD_LIBRARY_PATH=/opt/oracle/product/19c/lib
Test with:
tnsping ggdb
🚫 ORA-12514: TNS:listener does not currently know of service requested
Solution:
- Your TNS alias doesn't match the actual service registered with the listener
Check the available services on the database host:
lsnrctl status
Update your tnsnames.ora accordingly.
🚫 OGG-03542: Failed to connect to the database
Solution:
Check these common issues:
- Incorrect
LD_LIBRARY_PATH - Incorrect
TNS_ADMINpath - Instant client incompatibility
- Insufficient user privileges
Ensure these variables are set:
export TNS_ADMIN=/path/to/network/admin
export LD_LIBRARY_PATH=/path/to/instantclient
🗑️ Deleting or Resetting the Credential Store
GoldenGate doesn't provide a DROP CREDENTIALSTORE command. To delete it manually:
cd $OGG_HOME/dircrd
rm -f cwallet.sso ewallet.p12
Remember to update your GLOBALS file if needed.
To recreate the credential store:
ADD CREDENTIALSTORE
ALTER CREDENTIALSTORE ADD USER ...
💻 Example Setup for GoldenGate Instant Client
Here's a complete example of setting up the credential store with an instant client:
export TNS_ADMIN=/opt/app/ogg21c/network/admin
export LD_LIBRARY_PATH=/opt/app/ogg21c/instantclient
cd /opt/app/ogg21c
./ggsci
ADD CREDENTIALSTORE
ALTER CREDENTIALSTORE ADD USER ggudb@gg_dev, ALIAS gg_dev
DBLOGIN USERIDALIAS gg_dev
🎯 Conclusion
The Oracle GoldenGate Credential Store provides an essential security layer for your data replication environment. By properly implementing the credential store, you'll eliminate plaintext passwords in your configuration files while streamlining credential management for your database connections.
✍️ Have you implemented the GoldenGate Credential Store in your environment? Share your experience in the comments below!
This guide was last updated on April 22, 2025. ⏱️
Comments
Post a Comment