When you configure auto-login with an Oracle RAC cluster, you will need to create an ASM wallet so that it is accessible to all nodes in the cluster.

Before You Begin 

Replace the following values according to your setup: 

Script Value

Actual Value

/opt/oracle/entrust/orcl.conf

Replace with the actual path of your configuration file.

ASMDIR

Replace with your ASM storage directory name.

Database Name

Replace with the name of your database.

software_keystore_password

Replace with the password that you want to use.

backup_identifier

Replace with a tag of your choice to identify the backup.

Procedure 

  1. Close the hardware keystore if it is opened using the following command: 

    Copy
    connect / as sysdba;
    ADMINISTER KEY MANAGEMENT SET KEYSTORE CLOSE IDENTIFIED BY "file:/opt/oracle/entrust/orcl.conf" 
    CONTAINER = ALL;

  2. Create a wallet in ASM using the asmcmd command. 

    For example, +ASMDIR/<Database name>/wallet/tde

  3. Set parameters for software keystore using the following commands: 


    Copy
    ALTER SYSTEM SET WALLET_ROOT="+ASMDIR/<Database name>/wallet" scope=spfile sid='*';
    shutdown immediate;
    startup;
    ALTER SYSTEM SET TDE_CONFIGURATION="KEYSTORE_CONFIGURATION=FILE" SCOPE=both sid='*';
    shutdown immediate;
    startup;


  4. Create and open the software keystore.

    Copy
    ADMINISTER KEY MANAGEMENT CREATE KEYSTORE IDENTIFIED BY <software_keystore_password>;
    ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY <software_keystore_password>;

  5. Add the config file as secret for a client HSM_PASSWORD.

    Copy
    ADMINISTER KEY MANAGEMENT ADD SECRET 'file:/opt/oracle/entrust/orcl.conf' FOR CLIENT 'HSM_PASSWORD' IDENTIFIED BY <software_keystore_password> WITH BACKUP USING <backup_identifier>;

  6. Close the software keystore.

    Copy
    ADMINISTER KEY MANAGEMENT SET KEYSTORE CLOSE IDENTIFIED BY <software_keystore_password>;

  7. Create Auto-login keystore.

    Copy
    ADMINISTER KEY MANAGEMENT CREATE AUTO_LOGIN KEYSTORE FROM KEYSTORE IDENTIFIED BY <software_keystore_password>;

  8. Set parameters for software to hardware keystore configuration.

    Copy
    ALTER SYSTEM SET TDE_CONFIGURATION="KEYSTORE_CONFIGURATION=HSM|FILE" SCOPE=both;
    shutdown immediate;
    startup;
    SELECT * FROM V$ENCRYPTION_WALLET;

After this configuration, when the database starts, the hardware keystore is opened automatically.