OracleDB Connection

Learn how to configure a Oracle Database Connection for Infisical.

OracleDB App Connection is a paid feature.

If you’re using Infisical Cloud, then it is available under the Enterprise Tier. If you’re self-hosting Infisical, then you should contact [e-mail] to purchase an enterprise license to use it.

Infisical supports connecting to OracleDB using a database user.

Configure an Oracle Database User for Infisical

1. Create a User

   Infisical recommends creating a designated user in your Oracle Database for your connection.

   -- create user
   CREATE USER infisical IDENTIFIED BY "my-password";
   
   -- grant create session privileges
   GRANT CREATE SESSION TO infisical;
   

   Username must either be ALL UPPERCASE or not be surrounded by “quotes”. Values not surrounded by quotes get automatically transformed to uppercase by Oracle Database.

2. Grant Relevant Permissions

   Depending on how you intend to use your OracleDB connection, you’ll need to grant one or more of the following permissions.

   To learn more about the Oracle Database permission system, please visit their documentation.

   Secret Rotation

   For Secret Rotations, your Infisical user will require the ability to alter other users’ passwords:

   -- enable permissions to alter login credentials
   GRANT ALTER USER TO infisical;
   
3. Get Connection Details

   One-way TLS

   You’ll need the following information to create your Oracle Database connection:

   • host - The hostname or IP address of your Oracle Database server
   • port - The port number your Oracle Database server is listening on (default: 1521)
   • database - The Oracle Service Name or SID (System Identifier) for the database you are connecting to. For example: ORCL, FREEPDB1, XEPDB1
   • username - The user name of the login created in the steps above
   • password - The user password of the login created in the steps above
   • sslCertificate (optional) - The SSL certificate required for connection (if configured)

   If you are self-hosting Infisical and intend to connect to an internal/private IP address, be sure to set the ALLOW_INTERNAL_IP_CONNECTIONS environment variable to true.

   Mutual TLS (Wallet)

   This configuration can only be done on self-hosted or dedicated instances of Infisical.

   Infisical includes Oracle Instant Client by default, enabling mTLS wallet-based connections without modifying the Docker image. You only need to mount your Oracle Wallet and configure the environment.

   When TNS_ADMIN is set and points to a valid wallet directory, all Oracle Database connections in your Infisical instance will use the wallet for authentication.

   Gateway Limitation: Wallet-based connections do not support Infisical Gateway. The connection details (host, port, protocol) are read directly from the tnsnames.ora file in the wallet, bypassing the gateway routing.

   Prerequisites

   Your Oracle Wallet folder should contain the following files:

   • cwallet.sso - Auto-login wallet (SSO wallet)
   • tnsnames.ora - Connection aliases for your Oracle Database
   • sqlnet.ora - Network configuration

   Configuration Steps

Create Connection in Infisical

Infisical UI

1. Navigate to the Integrations tab in the desired project, then select App Connections.

   

2. Select the OracleDB Connection option.

   

3. Select the Username & Password method option and provide the details obtained from the previous section and press Connect to OracleDB.

Optionally, if you’d like Infisical to manage the credentials of this connection, you can enable the Platform Managed Credentials option. If enabled, Infisical will update the password of the connection on creation to prevent external access to this database user.

4. Your OracleDB Connection is now available for use.

API

To create an Oracle Database Connection, make an API request to the Create OracleDB Connection API endpoint.

Optionally, if you’d like Infisical to manage the credentials of this connection, you can set the isPlatformManagedCredentials option to true. If enabled, Infisical will update the password of the connection on creation to prevent external access to this database user.

Sample request

Request

curl    --request POST \
--url https://app.infisical.com/api/v1/app-connections/oracledb \
--header 'Content-Type: application/json' \
--data '{
    "name": "my-oracledb-connection",
    "method": "username-and-password",
    "isPlatformManagedCredentials": true,
    "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
    "credentials": {
        "host": "123.4.5.6",
        "port": 1521,
        "database": "FREEPDB1",
        "username": "infisical",
        "password": "my-password",
        "sslEnabled": true,
        "sslRejectUnauthorized": true
    },
}'

Sample response

Response

{
    "appConnection": {
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "name": "my-oracledb-connection",
        "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
        "version": 1,
        "orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "createdAt": "2023-11-07T05:31:56Z",
        "updatedAt": "2023-11-07T05:31:56Z",
        "app": "oracledb",
        "method": "username-and-password",
        "isPlatformManagedCredentials": true,
        "credentials": {
            "host": "123.4.5.6",
            "port": 1521,
            "database": "FREEPDB1",
            "username": "infisical",
            "sslEnabled": true,
            "sslRejectUnauthorized": true
        }
    }
}