How to Connect UCMDB Server Container to the Oracle Database with Advanced Security Option (ASO) Enabled

To do so, do the following:

1. Prerequisites

   The Oracle Database to which UCMDB will connect needs to be configured with Advanced Security Option (ASO). For instructions about how to enable this, see the information below. (It is recommended that you contact your DBA for this configuration).

   Add the following lines to the sqlnet.ora file:

   SQLNET.ENCRYPTION_SERVER = required
   SQLNET.ENCRYPTION_TYPES_SERVER= (AES256)
   SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER= (SHA1)
   SQLNET.CRYPTO_SEED = '23456789'
   SQLNET.CRYPTO_CHECKSUM_SERVER = required
   

   • The database administrator privilege is required to perform the above step.

   • Only SHA1 encryption is supported. For details, see the following:

     • Types of Oracle Advanced Security Data Integrity Algorithms supported by DataDirect: Data Integrity Types

       DataDirect supplies the JDBC drivers that the UCMDB installation is using to connect to the Oracle database.

     • Types of Oracle Advanced Security Data Integrity Algorithms supported by Oracle, see the 1.2.1.2 Data Integrity section.

2. On the master node (NFS server), download the local_policy.jar and US_export_policy.jar files from the Zulu Cryptography Extension Kit provided by OpenJDK.

3. On the master node (NFS server), create the jdbc.properties file and add the following settings:

   Oracle=ddoracle
   ddoracle.EncryptionTypes=AES256
   ddoracle.EncryptionLevel=required
   ddoracle.DataIntegrityTypes=SHA1
   ddoracle.DataIntegrityLevel=required
   

4. In the UCMDB yaml file, mount the jar files downloaded in step 2 (local_policy.jar and US_export_policy.jar) and the jdbc.properties file at the following location:

   volumes:
   "<path_on_the_host>/local_policy.jar:/ucmdb/bin/jre/lib/security/local_policy.jar"
   "<path_on_the_host>/US_export_policy.jar:/ucmdb/bin/jre/lib/security/US_export_policy.jar"
   "<path_on_the_host>/jdbc.properties:/ucmdb/conf/jdbc.properties"

   where <path_on_the_host> refers to the path of the UCMDB yaml file on the master node (NFS server).