OracleSecurity & users

CMU step 4: create dsi.ora

Tells the database which domain controllers to use. Put it in the same folder as the wallet from step 3. Use fully qualified host names, and list at least two DCs or a load-balanced name so logins survive a DC outage. If you edit it later, re-run the ALTER SYSTEM in step 6 or restart.

Changes data19cOS prompt

Not yet verified. How scripts are tested

This changes files or settings on the server. Check the names and values before you run it.

ora-cmu-dsi.sh

1# On the database server as the oracle software owner, in the wallet folder2# from step 3.3cd /u01/app/oracle/cmu/<pdb_name>/wallet4 5cat > dsi.ora <<'EOF'6DSI_DIRECTORY_SERVERS = (dc1.corp.example.com:389:636, dc2.corp.example.com:389:636)7DSI_DIRECTORY_SERVER_TYPE = AD8EOF9 10# Optional, and Oracle recommends leaving it out: limit the search to one OU.11# DSI_DEFAULT_ADMIN_CONTEXT = "OU=Oracle,DC=corp,DC=example,DC=com"12 13cat dsi.ora14ls -l    # cwallet.sso, ewallet.p12 and dsi.ora side by side

Run these at the operating system prompt.

Open in denrepo

Helps with

ORA-28030: Server encountered problems accessing LDAP directory service

Part of these runbooks

Set up CMU with Active Directory

More Oracle scripts: Security & users

Accounts locked, expired or expiring soonApplication accounts that aren't OPEN, or whose passwords expire in the next 14 days. Catch service accounts before they break an application.
Who has DBA, SYSDBA and powerful system privilegesNon-Oracle accounts and roles holding the DBA role or high-risk ANY privileges, then everyone in the password file. Worth reviewing every audit cycle.
CMU step 1: prepare Active DirectoryDone once by an AD administrator before any database work: create the service account the database binds with, install Oracle's password filter on…
CMU step 2: export the AD root certificateThe database talks to AD over LDAPS, so its wallet must trust the certificate authority that issued the domain controllers' certificates. Export that…
CMU step 3: create the walletBuilds the auto-login wallet the database reads at login: the service account's user name, DN and password, plus the AD root certificate. With PDBs,…
CMU step 5: point each PDB at its wallet (CMU_WALLET)Creates a directory object for the wallet folder from step 3 and sets the CMU_WALLET database property in the PDB, so CMU reads that PDB's wallet and…