📋Steps in this guide1/27

How to Create an Oracle Wallet for Applications to Use

Learn how to create and configure an Oracle Wallet for applications to securely connect to Oracle databases. Step-by-step guide with mkstore, auto-login wallet, examples, and best practices.

oracle configurationintermediate

by OracleDba

13 views

Introduction

In modern enterprise environments, security is not optional it is mandatory. Applications frequently need to connect to Oracle databases using credentials, certificates, or secure communication channels. Hardcoding usernames and passwords inside application code or configuration files is a major security risk. This is where Oracle Wallet plays a crucial role. An Oracle Wallet is a secure container used to store authentication credentials, SSL certificates, encryption keys, and database passwords. It allows applications to connect to Oracle databases without exposing sensitive credentials . In this blog, we will cover: - What Oracle Wallet is - Why applications need Oracle Wallet - Types of Oracle Wallets - Step-by-step process to create an Oracle Wallet - How applications use Oracle Wallet - Common issues and best practices

Why Applications Need Oracle Wallet

Applications often face the following security challenges: - Hardcoded database passwords - Password exposure in config files - Difficulty rotating passwords - Non-compliance with security standards

Benefits of Using Oracle Wallet

- No hardcoded credentials - Centralized credential management - Easy password rotation without code changes - Strong encryption for stored secrets - Supports SSL/TLS for secure connections - Required for Autonomous Database and TCPS connections

1. Password-Based Wallet

- Protected by a wallet password - Must be opened manually - Suitable for interactive environments

2. Auto Login Wallet (cwallet.sso)

- No password required at runtime - Automatically opens when accessed - Recommended for application usage Most applications use Auto Login Wallets .

Prerequisites

Before creating an Oracle Wallet, ensure: - Oracle Client or Database software is installed - ORACLE_HOME is set correctly - utility is available - OS user has permissions on wallet directory

On Linux / Unix

Code/Command (click line numbers to comment):

1
2

mkdir -p /u01/app/wallets/app_wallet
chmod 700 /u01/app/wallets/app_wallet

On Windows

> 🔐 Tip: Wallet directory should be owned by the application or Oracle user. 🔐 Tip: Wallet directory should be owned by the application or Oracle user.

Code/Command (click line numbers to comment):

mkdir C:\oracle\wallets\app_wallet

Step 2: Create the Oracle Wallet

Use the mkstore utility.

Linux / Unix

Code/Command (click line numbers to comment):

mkstore -wrl /u01/app/wallets/app_wallet -create

Windows

You will be prompted to set a wallet password. Wallet files created: -

Code/Command (click line numbers to comment):

mkstore -wrl C:\oracle\wallets\app_wallet -create

Step 3: Create Auto Login Wallet (Recommended)

Auto login wallet allows applications to access the wallet without a password.

Linux

Code/Command (click line numbers to comment):

mkstore -wrl /u01/app/wallets/app_wallet -createALogin

Windows

This creates: -

Code/Command (click line numbers to comment):

mkstore -wrl C:\oracle\wallets\app_wallet -createALogin

Syntax

Code/Command (click line numbers to comment):

mkstore -wrl <wallet_location> -createCredential <db_connect_string> <username> <password>

Example (Linux)

Code/Command (click line numbers to comment):

1
2

mkstore -wrl /u01/app/wallets/app_wallet \
-createCredential orclpdb app_user Welcome@123

Example (Windows)

Code/Command (click line numbers to comment):

mkstore -wrl C:\oracle\wallets\app_wallet -createCredential orclpdb app_user Welcome@123

Step 5: Verify Wallet Contents

Output example:

Code/Command (click line numbers to comment):

mkstore -wrl /u01/app/wallets/app_wallet -listCredential

List credential (index: connect_string username)
1: orclpdb app_user

Step 6: Configure sqlnet.ora

Applications and Oracle clients must know the wallet location. Edit > 🔹 ensures wallet credentials override login prompts. 🔹 ensures wallet credentials override login prompts.

Code/Command (click line numbers to comment):

WALLET_LOCATION =
 (SOURCE =
   (METHOD = FILE)
   (METHOD_DATA =
     (DIRECTORY = /u01/app/wallets/app_wallet)
   )
 )

SQLNET.WALLET_OVERRIDE = TRUE

Using SQL*Plus (No Password)

Code/Command (click line numbers to comment):

sqlplus /@orclpdb

JDBC Connection Example

Code/Command (click line numbers to comment):

String url = "jdbc:oracle:thin:@orclpdb";
Properties props = new Properties();
props.put("oracle.net.wallet_location", "/u01/app/wallets/app_wallet");

Connection conn = DriverManager.getConnection(url, props);

TNS Entry Example (tnsnames.ora)

Code/Command (click line numbers to comment):

ORCLPDB =
 (DESCRIPTION =
   (ADDRESS = (PROTOCOL = TCP)(HOST = dbhost)(PORT = 1521))
   (CONNECT_DATA =
     (SERVICE_NAME = orclpdb)
   )
 )

Common Use Cases for Oracle Wallet

- Secure application-to-database connectivity - SSL/TLS database connections (TCPS) - Oracle Autonomous Database - Database links without passwords - REST API authentication - OCI services integration

ORA-01017: Invalid username/password

- Check wallet credentials - Verify connect string

ORA-28759: Failed to open file

- Check wallet directory permissions - Verify wallet path in sqlnet.ora

ORA-29024: Certificate validation failure

- Ensure correct SSL certificates - Verify wallet contains trusted certs

Best Practices

- Always use Auto Login Wallet for applications - Restrict wallet directory permissions - Never commit wallet files to source control - Rotate passwords using without code changes - Backup wallet securely

Comments (0)

Please to add comments

No comments yet. Be the first to comment!