Getting an ewallet.pem from ewallet.p12 created by orapki/mkstore?

[cmarqu]

Hi,

I am using RHEL 7 and so far successfully used cx_Oracle together with the Client libraries to connect to our on-prem database, using a wallet created via orapki/mkstore.

Now I want to use python-oracledb in Thin mode to not need the Client libraries anymore, but am failing to create the needed ewallet.pem from my existing ewallet.p12.

I am following the instructions in https://python-oracledb.readthedocs.io/en/latest/user_guide/connection_handling.html#creating-a-pem-file-for-python-oracledb-thin-mode and am using the provided create_pem.py script (with some modifications for debugging), but I find that the line

result = pkcs12.load_key_and_certificates(pkcs12_data, args.wallet_password.encode())

returns

(None, None, [])

(with a correct wallet password), thus, making the whole script fail with

    f.write(private_key.private_bytes(Encoding.PEM, PrivateFormat.PKCS8,
            ^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'private_bytes'

.

I have also unsuccessfully tried to convert the file using openssl:

$ openssl pkcs12 -in $HOME/.local/share/oracle/ewallet.p12 -out $HOME/.local/share/oracle/ewallet.pem
Enter Import Password:
Warning unsupported bag type: secretBag
Warning unsupported bag type: secretBag
Warning unsupported bag type: secretBag

Is it possible to create a wallet with tools like orapki and/or mkstore that I can then use with python-oracledb?

---

For reference, here is how I created the wallet:

$ orapki wallet create -wallet $HOME/.local/share/oracle
Oracle PKI Tool Release 21.0.0.0.0 - Production
Version 21.0.0.0.0
Copyright (c) 2004, 2022, Oracle and/or its affiliates. All rights reserved.

Enter password:   
Enter password again:   
Operation is successfully completed.
$ mkstore -wrl $HOME/.local/share/oracle -createCredential 'cred' <user> <secret>
Oracle Secret Store Tool Release 21.0.0.0.0 - Production
Version 21.0.0.0.0
Copyright (c) 2004, 2022, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:   
$ mkstore -wrl $HOME/.local/share/oracle -listCredential

Oracle Secret Store Tool Release 21.0.0.0.0 - Production
Version 21.0.0.0.0
Copyright (c) 2004, 2022, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:   
List credential (index: connect_string username)
1: cred <user>

[anthony-tuininga]

Wallets created for storing certificates and private keys (for authentication with the database server, usually on the cloud) is what is intended, not for storing passwords -- which is what you appear to be doing here!

[cmarqu]

I see... I was hoping I could silently upgrade my users to use python-oracledb and reuse whatever wallet content they have.
Any suggestions on how to go from here? Do I need to switch to e.g. https://pypi.org/project/keyring/ (which AIUI would require user participation)?

[cjbj]

Good questions. I suspect we need to involve the Oracle DB security folk in discussions about all this, and about what they are willing to let us put in Thin driver code.

[cmarqu]

Oh, nice, is this supported now?

[sundar-mudupalli-work]

Hello @cmarqu,

Wallets are archives to store different items. They are used to store certificates - which is used to authenticate the server (or the client). You can extract the certificates into .pem files and use them if you want to set up TLS or mTLS using oracledb Thin mode. The certificates are not "secrets". You just have to make sure you trust the person who issued the certificate.

Wallets can also be used to credentials (user names and passwords). These are secret and added using the mkstore utilty. In the example you gave, you created a credential called cred, which is a db_connect_string, referring to an alias in tnsnames.ora or a service name in the Oracle Database Network. This is not supported by oracledb in Thin mode per my understanding. You will need to use Thick mode, have sqlnet.ora and tnsnames.ora and the ewallet.p12 in the config_dir and use cred as the dsn to connect to the database with the specified credentials.

Sundar Mudupalli