> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Oracle accounts

> Give people and agents access to an Oracle database without sharing its credentials.

An Oracle [account](https://infisical.com/docs/documentation/platform/pam/accounts/overview.md) stores the credentials for one Oracle database user. Members connect to the database through the Infisical CLI, and Infisical records every statement they run.

## Prerequisites

* The Admin [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md) on the [folder](https://infisical.com/docs/documentation/platform/pam/folders/overview.md) you'll add the account to
* A [gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) that can reach the database
* An Oracle [account template](https://infisical.com/docs/documentation/platform/pam/templates/overview.md)
* An Oracle password of 30 characters or fewer, because the gateway can't sign in with a longer one

## Create the account

**Step 1**

Go to **Privileged Access Management** > **Accounts** and select **Add Account**.

**Step 2**

Select the **Folder** and an Oracle **Account Template**, then select **Next**.

**Step 3**

Enter a **Name** and the connection details:

| Field | Description |
| - | - |
| **Host** | The database's hostname or IP address |
| **Port** | The listener's port (defaults to `1521`; the TCPS listener usually uses `2484`) |
| **Service Name** | The Oracle service name, such as `ORCL` or `FREEPDB1` |
| **SSL Enabled** | Whether to connect to the TCPS listener |
| **Reject Unauthorized** | Whether to reject a server certificate that can't be verified (shown when **SSL Enabled** is on) |
| **SSL Certificate** | The CA certificate that signed the server's certificate (shown when **SSL Enabled** is on) |

**Step 4**

Enter the credentials:

| Field | Description |
| - | - |
| **Username** | The Oracle user, exactly as Oracle stores it (Oracle stores unquoted names in uppercase) |
| **Password** | The user's password |

**Step 5**

Select **Create**.

When you select **Create**, Infisical only checks that it can reach the host and port. The first [credential health check](https://infisical.com/docs/documentation/platform/pam/credential-health/overview.md) checks the username and password, and reports **Out of Sync** if Oracle rejects them.

## Connect

To open a session, follow [Connect to an account](https://infisical.com/docs/documentation/platform/pam/accounts/connect.md). Oracle accounts don't support the browser, so use the CLI.

Start the local proxy. The CLI prints the port, the username, and the service name to connect with:

```bash theme={"dark"}
infisical pam access finance/billing-db
```

The proxy keeps running in that terminal. In a second terminal, connect your Oracle client, such as `sqlplus` or SQL Developer, to the port:

```bash theme={"dark"}
sqlplus <username>/password@127.0.0.1:<port>/<service-name>
```

## Next steps

> [card] [Oracle credential rotation](https://infisical.com/docs/documentation/platform/pam/credential-rotation/oracledb.md)
>
> Rotate the passwords of Oracle accounts.

> [card] [Sessions](https://infisical.com/docs/documentation/platform/pam/sessions/overview)
>
> Review and end the connections that people and agents make to your accounts.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.