{"id":4988,"date":"2025-11-28T23:40:36","date_gmt":"2025-11-28T23:40:36","guid":{"rendered":"https:\/\/w3buddy.com\/?p=4988"},"modified":"2026-01-15T12:40:53","modified_gmt":"2026-01-15T07:10:53","slug":"how-to-set-up-oracle-wallet-for-passwordless-login-19c-21c","status":"publish","type":"post","link":"https:\/\/w3buddy.com\/blog\/how-to-set-up-oracle-wallet-for-passwordless-login-19c-21c\/","title":{"rendered":"How to Set Up Oracle Wallet for Passwordless Login (19c\/21c)"},"content":{"rendered":"\n

Oracle Wallet allows secure storage of database login credentials and enables passwordless authentication for scripts, applications, and command-line tools. Instead of exposing clear-text passwords, a wallet stores encrypted credentials that can be used automatically when connecting to the database.<\/p>\n\n\n\n

This guide provides a complete and generalized step-by-step process for configuring Oracle Wallet in Oracle Database 19c and 21c.<\/p>\n\n\n\n

Table of Contents<\/h1>\n\n\n\n
    \n
  1. Overview<\/li>\n\n\n\n
  2. Wallet Types and Tools<\/li>\n\n\n\n
  3. Create Wallet Directory<\/li>\n\n\n\n
  4. Create TNS_ADMIN Directory<\/li>\n\n\n\n
  5. Add TNS Entry<\/li>\n\n\n\n
  6. Configure SQLNET.ORA<\/li>\n\n\n\n
  7. Set Oracle Environment Variables<\/li>\n\n\n\n
  8. Create Oracle Wallet<\/li>\n\n\n\n
  9. Add Credentials to Wallet<\/li>\n\n\n\n
  10. Test Passwordless Connection<\/li>\n\n\n\n
  11. List Credentials<\/li>\n\n\n\n
  12. Modify Stored Credentials<\/li>\n\n\n\n
  13. View Wallet Contents<\/li>\n\n\n\n
  14. Change Wallet Password<\/li>\n\n\n\n
  15. Delete Credentials<\/li>\n\n\n\n
  16. Delete Oracle Wallet<\/li>\n\n\n\n
  17. Recommended Directory Layout<\/li>\n\n\n\n
  18. Security Best Practices<\/li>\n\n\n\n
  19. Troubleshooting<\/li>\n\n\n\n
  20. Summary<\/li>\n<\/ol>\n\n\n\n

    1. Overview<\/h1>\n\n\n\n

    Oracle Wallet provides a secure mechanism to store authentication credentials so that jobs, applications, or users do not need to embed usernames and passwords in scripts.
    Multiple database credentials can be stored in a single wallet, and auto-login wallets allow Oracle tools to access credentials without requiring a wallet password.<\/p>\n\n\n\n

    This guide uses a generic non-database OS user to demonstrate a clean and safe configuration.<\/p>\n\n\n\n

    2. Wallet Types and Tools<\/h1>\n\n\n\n

    Types of Oracle Wallets<\/h3>\n\n\n\n
      \n
    • Password-protected wallet (ewallet.p12<\/code>)<\/strong>
      Access requires entering the wallet password.<\/li>\n\n\n\n
    • Auto-login wallet (cwallet.sso<\/code>)<\/strong>
      Opens automatically without password (recommended for scheduled jobs).<\/li>\n\n\n\n
    • Auto-login local wallet<\/strong>
      Auto-login wallet restricted to the local host.<\/li>\n<\/ul>\n\n\n\n

      Tools<\/h3>\n\n\n\n
        \n
      • mkstore<\/strong> \u2013 Add, view, update, delete stored credentials.<\/li>\n\n\n\n
      • orapki<\/strong> \u2013 Create wallet, change password, view wallet contents.<\/li>\n<\/ul>\n\n\n\n

        3. Create Wallet Directory<\/h1>\n\n\n\n

        Create a secure folder for wallet files:<\/p>\n\n\n\n

        mkdir -p \/opt\/oracle\/wallet_store\nchmod 700 \/opt\/oracle\/wallet_store<\/code><\/pre>\n\n\n\n
        4. Create TNS_ADMIN Directory<\/h1>\n\n\n\n
        Wallet-based TNS files should be isolated:<\/p>\n\n\n\n
        mkdir -p \/opt\/oracle\/wallet_store\/network\nchmod 700 \/opt\/oracle\/wallet_store\/network<\/code><\/pre>\n\n\n\n
        5. Add TNS Entry<\/h1>\n\n\n\n
        Create or edit tnsnames.ora<\/code>:<\/p>\n\n\n\n
        MYDB =\n  (DESCRIPTION =\n    (ADDRESS = (PROTOCOL = TCP)(HOST = dbserver.example.com)(PORT = 1521))\n    (CONNECT_DATA =\n      (SERVICE_NAME = mydbservice)\n    )\n  )<\/code><\/pre>\n\n\n\n
        Save as:<\/p>\n\n\n\n
        \/opt\/oracle\/wallet_store\/network\/tnsnames.ora<\/code><\/pre>\n\n\n\n
        6. Configure SQLNET.ORA<\/h1>\n\n\n\n
        Create the wallet configuration file:<\/p>\n\n\n\n
        SQLNET.WALLET_OVERRIDE = TRUE\nSSL_CLIENT_AUTHENTICATION = FALSE\nWALLET_LOCATION =\n (SOURCE =\n   (METHOD = FILE)\n   (METHOD_DATA = (DIRECTORY = \/opt\/oracle\/wallet_store))\n )<\/code><\/pre>\n\n\n\n
        Save as:<\/p>\n\n\n\n
        \/opt\/oracle\/wallet_store\/network\/sqlnet.ora<\/code><\/pre>\n\n\n\n
        7. Set Oracle Environment Variables<\/h1>\n\n\n\n
        export ORACLE_HOME=\/path\/to\/oracle\/home\nexport PATH=$ORACLE_HOME\/bin:$PATH\nexport ORACLE_SID=mydb\nexport TNS_ADMIN=\/opt\/oracle\/wallet_store\/network<\/code><\/pre>\n\n\n\n
        Test connectivity:<\/p>\n\n\n\n
        tnsping MYDB<\/code><\/pre>\n\n\n\n
        8. Create Oracle Wallet (Password + Auto-login)<\/h1>\n\n\n\n
        orapki wallet create -wallet \/opt\/oracle\/wallet_store -auto_login<\/code><\/pre>\n\n\n\n
        Enter the new wallet password when prompted.<\/p>\n\n\n\n
        Verify wallet files:<\/p>\n\n\n\n
        ewallet.p12\ncwallet.sso<\/code><\/pre>\n\n\n\n
        9. Add Credentials to Wallet<\/h1>\n\n\n\n
        Syntax:<\/p>\n\n\n\n
        mkstore -wrl <wallet_path> -createCredential <TNS_ALIAS> <USERNAME><\/code><\/pre>\n\n\n\n
        Example:<\/p>\n\n\n\n
        mkstore -wrl \/opt\/oracle\/wallet_store -createCredential MYDB appuser<\/code><\/pre>\n\n\n\n
        You will be prompted for:<\/p>\n\n\n\n
          \n
        • Database password<\/li>\n\n\n\n
        • Wallet password<\/li>\n<\/ul>\n\n\n\n
          10. Test Passwordless Connection<\/h1>\n\n\n\n
          sqlplus \/@MYDB<\/code><\/pre>\n\n\n\n
          If configured correctly, the connection succeeds without prompting for credentials.<\/p>\n\n\n\n
          11. List Credentials in Wallet<\/h1>\n\n\n\n
          mkstore -wrl \/opt\/oracle\/wallet_store -listCredential<\/code><\/pre>\n\n\n\n
          12. Modify Stored Credentials<\/h1>\n\n\n\n
          (When database password changes)<\/p>\n\n\n\n
          mkstore -wrl \/opt\/oracle\/wallet_store -modifyCredential MYDB appuser newpassword<\/code><\/pre>\n\n\n\n
          13. View Wallet Contents<\/h1>\n\n\n\n
          orapki wallet display -wallet \/opt\/oracle\/wallet_store<\/code><\/pre>\n\n\n\n
          14. Change Wallet Password<\/h1>\n\n\n\n
          orapki wallet change_pwd -wallet \/opt\/oracle\/wallet_store<\/code><\/pre>\n\n\n\n
          15. Delete Stored Credentials<\/h1>\n\n\n\n
          mkstore -wrl \/opt\/oracle\/wallet_store -deleteCredential MYDB<\/code><\/pre>\n\n\n\n
          16. Delete Oracle Wallet<\/h1>\n\n\n\n
          Delete wallet files:<\/p>\n\n\n\n
          rm -f \/opt\/oracle\/wallet_store\/*wallet*<\/code><\/pre>\n\n\n\n
          Or delete entire directory:<\/p>\n\n\n\n
          rm -rf \/opt\/oracle\/wallet_store<\/code><\/pre>\n\n\n\n
          17. Recommended Directory Layout<\/h1>\n\n\n\n
          \/opt\/oracle\/wallet_store\/\n    ewallet.p12\n    cwallet.sso\n    network\/\n        sqlnet.ora\n        tnsnames.ora<\/code><\/pre>\n\n\n\n
          This separation simplifies configuration and improves manageability.<\/p>\n\n\n\n
          18. Security Best Practices<\/h1>\n\n\n\n
            \n
          1. Restrict permissions <\/li>\n<\/ol>\n\n\n\n
            chmod 600 ewallet.p12 cwallet.sso\nchmod 700 wallet_directory<\/code><\/pre>\n\n\n\n
              \n
            1. Do not place wallet inside ORACLE_HOME (patching may remove it).<\/li>\n\n\n\n
            2. Use auto_login_local<\/em> for added security.<\/li>\n\n\n\n
            3. Always back up wallet files before changes.<\/li>\n\n\n\n
            4. Document wallet location and credential policies.<\/li>\n\n\n\n
            5. Regularly rotate wallet and database passwords.<\/li>\n<\/ol>\n\n\n\n
              19. Troubleshooting<\/h1>\n\n\n\n
              Password prompt appears<\/h3>\n\n\n\n
                \n
              • Incorrect wallet path<\/li>\n\n\n\n
              • Wrong TNS_ADMIN<\/li>\n\n\n\n
              • Missing SQLNET.WALLET_OVERRIDE<\/li>\n\n\n\n
              • TNS alias mismatch<\/li>\n<\/ul>\n\n\n\n
                tnsping works but sqlplus fails<\/h3>\n\n\n\n
                SQLNET.ORA might not be in the active TNS_ADMIN path.<\/p>\n\n\n\n
                Wallet shows OPEN_NO_MASTER_KEY<\/h3>\n\n\n\n
                Normal if Transparent Data Encryption (TDE) is not enabled.
                Does not affect wallet-based credential access.<\/p>\n\n\n\n
                Permission denied errors<\/h3>\n\n\n\n
                Ensure OS user has read access to wallet files.<\/p>\n\n\n\n
                20. Summary<\/h1>\n\n\n\n
                Oracle Wallet provides a secure mechanism to store credentials and enable passwordless authentication for Oracle Database 19c and 21c environments. This guide covered:<\/p>\n\n\n\n
                  \n
                • Creating wallet directories<\/li>\n\n\n\n
                • Configuring TNS entries<\/li>\n\n\n\n
                • Setting up SQLNET.ORA<\/li>\n\n\n\n
                • Creating and managing wallets<\/li>\n\n\n\n
                • Adding, modifying, and deleting credentials<\/li>\n\n\n\n
                • Security best practices<\/li>\n\n\n\n
                • Troubleshooting<\/li>\n<\/ul>\n\n\n\n
                  With this configuration, scripts, jobs, and applications can connect securely without exposing plain-text passwords.<\/p>\n","protected":false},"excerpt":{"rendered":"
                  Oracle Wallet allows secure storage of database login credentials and enables passwordless authentication for scripts, applications, and command-line tools. Instead of exposing clear-text passwords, a wallet stores encrypted credentials that can be used automatically when connecting to the database. This guide provides a complete and generalized step-by-step process for configuring Oracle Wallet in Oracle Database […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"googlesitekit_rrm_CAowu461DA:productID":"","footnotes":""},"categories":[1225],"tags":[],"class_list":["post-4988","post","type-post","status-publish","format-standard","hentry","category-database"],"_links":{"self":[{"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/posts\/4988","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/comments?post=4988"}],"version-history":[{"count":1,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/posts\/4988\/revisions"}],"predecessor-version":[{"id":4989,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/posts\/4988\/revisions\/4989"}],"wp:attachment":[{"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/media?parent=4988"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/categories?post=4988"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/tags?post=4988"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}