Skip to main content

Connecting Without a Wallet

Oracle Autonomous Database uses mTLS by default, which authenticates by downloading an electronic wallet file and installing it on the client. Connecting without managing a wallet requires switching to TLS-only mode. I could not find Korean documentation explaining this for the combination of macOS and DBeaver, so I wrote it down here.

This assumes that an Autonomous DB instance has already been created.

1. Configure the network access control list (ACL)​

Access control must be in place before mTLS can be disabled. In the database network settings, add the IP addresses that are allowed to connect to the access control list. In effect, access is narrowed through IP restrictions in exchange for giving up wallet authentication.

2. Switch from mutual TLS to TLS​

In the same network settings, change the mutual TLS (mTLS) requirement to TLS. This transition is allowed only after the ACL has been configured.

3. Copy the connection string​

Copy the TLS connection string from the DB connection information. Names are divided into _high, _medium, _low, and so on, with different concurrency and resource-allocation policies. If you do not know which to choose, you can start with the first one.

4. Build the JDBC URL​

This is the key step. Prefix the copied connection string with jdbc:oracle:thin:@ and it becomes the JDBC URL as-is.

jdbc:oracle:thin:@(description= (retry_count=20)(retry_delay=3)(address=(protocol=tcps)(port=1521)(host=adb.ap-seoul-1.oraclecloud.com))(connect_data=(service_name=asdasdasdas.adb.oraclecloud.com))(security=(ssl_server_dn_match=yes)))

Confirm that protocol=tcps and ssl_server_dn_match=yes remain. Although no wallet is used, the transport is still protected by TLS.

5. Configure DBeaver​

Change Connection Type to Custom in the DBeaver Oracle connection. The default SID/Service Name input method cannot accept a URL in the form above.

After changing it to Custom, paste the URL built in step 4 into the JDBC URL Template field that appears, fill in the username and password, and verify it with Test Connection. No field asking for a wallet file path appears.

Summary​

  • Registering an ACL is a prerequisite for connecting without a wallet; mTLS can then be lowered to TLS.
  • The client-side work is essentially just assembling jdbc:oracle:thin:@ + the connection string.
  • When DBeaver blocks you, the usual reason is that Connection Type is not set to Custom.