Oracle

This guide demonstrates a basic Fudo Enterprise configuration for monitoring and controlling Oracle database access through a secure proxy connection.

Note

Oracle connections use native client support only, and the client connects directly to the Fudo Enterprise listener. Unlike the other database protocols, Oracle is not available in the User Access Gateway portal, so there is no connection command and no One-Time Password to copy - users authenticate with their own database credentials.

Prerequisites

Before starting this configuration:

  • System must be initialized (see System initiation)

  • Oracle server must be accessible from Fudo Enterprise

  • Oracle SQL*Plus client must be installed on your workstation

  • The database credentials of the user who will connect


Architecture Overview

The following diagram illustrates the Oracle connection flow:

../../_images/data_modeling.png

Connection Flow:

  1. SQL*Plus connects to the Fudo Enterprise listener address instead of the database

  2. The user authenticates with their own Oracle user name and password

  3. Fudo Enterprise records the session and forwards the credentials to the Oracle server

  4. The Oracle server accepts or rejects the login

Configuration Steps

Step 1: Create Oracle Server

Define the target Oracle server in Fudo Enterprise.

  1. Navigate to Session Management > Servers

  2. Click + Add server

  1. In the Protocol section, press the Show all button to expand the list of supported protocols.

  2. Configure the server with following settings:

    General

    Name: Oracle_Server
    Description: Production Oracle Database
    Blocked: ☐ Unchecked

    Settings Tab: Protocol

    Protocol: Oracle
    TLS enabled: ☐ Unchecked for a database that does not accept TCPS connections
    Legacy crypto: ☐ Unchecked
    Use SSH tunnel: ☐ Unchecked

    Settings Tab: Bind Address

    Bind address: Any

    Settings Tab: Destination

    Type: IPv4
    Address: 10.0.100.36
    Mask: 32
    Port: 1521

    Settings Tab: Server Verification

    Method: None when TLS is not used

Warning

TLS enabled is selected by default. Leave it selected only if the database accepts TCPS connections and your users connect with SQL*Plus - other client applications do not support TLS with Fudo Enterprise.

  1. Click Save and Close.

Step 2: Create User

Create a user who will access the Oracle server.

Warning

For Oracle, the Fudo Enterprise user name must be identical to the database user name. Fudo Enterprise identifies the user by the name that the client sends when it logs in to the database - the scott in sqlplus scott/tiger@... - because the Oracle protocol carries no separate field for a Fudo Enterprise user name.

A database user with the same name must therefore exist in the Oracle database - john_smith in the example below. If the names differ, the connection is not established.


  1. Select User Management > Users.

  2. Click Add User.

  1. Provide essential user information:

    General

    Name: john_smith
    Blocked: ☐ Unchecked
    Account validity: Indefinite

    Settings Tab

    Authentication failures: ☐ Unchecked
    Enforce password complexity: ☐ Unchecked
    Add authentication method: Static password
    Password john

    User Data Tab

    Full name: John Smith
    Email: john@smith.com

    Roles Tab

    Assign Role: e.g., admin

  1. Click Save and Close.

Step 3: Create Listener

Configure the proxy endpoint for Oracle connections.

  1. Navigate to Session Management > Listeners

  2. Click Add

  1. In the Protocol section, press the Show all button and select Oracle.

  2. Configure the listener:

    General Settings

    Name: Oracle_Listener
    Protocol: Oracle
    Blocked: ☐ Unchecked

    Connection Settings

    Mode: proxy (the only mode available for Oracle)
    Local address: 10.31.134.220
    Port: 1521
    TLS enabled: ☐ Unchecked
    Legacy crypto: ☐ Unchecked

    Access Control

    Granted users: Leave empty (configured via safe)

  1. Click Save and Close.

Step 4: Create Account

Define how Fudo Enterprise reaches the database.

  1. Navigate to Session Management > Accounts

  2. Click Add

  1. Configure the account:

    General

    Name: Oracle_Account
    Session recording: all
    Notes: Oracle database account

    Settings Tab: Type

    Account type: FORWARD

    Settings Tab: Target

    Server: Oracle_Server (select from dropdown)
    Authenticate against server: ✓ Checked and greyed out - Fudo Enterprise sets it automatically

Warning

The default session recording mode is noraw, which cannot be used with Oracle - the account will not be saved. Change it to all, raw or none before saving. Timestamping requires all or raw.

Note

Accounts of the REGULAR type are not offered for Oracle servers, so the Credentials section stays empty. Users authenticate with their own database credentials and password substitution is not available.

  1. Click Save and Close.

Step 5: Create Safe

Configure access control and bind all components together.

  1. Navigate to Session Management > Safes

  2. Click Add Safe

  1. Configure the safe:

    General

    Name: Oracle_Safe
    Blocked: ☐ Unchecked

    General Tab: Connection

    Login reason: ✓ Checked (optional, for audit trail)

  1. Click Save and Close.

  1. Add users to the safe:

    1. Select Users tab

    2. Click Manage Users

    3. Find and add your user (e.g., John)

    4. Click Save

  2. Add account to the safe:

    1. Select Accounts tab

    2. Click Manage Accounts

    3. Find and add Oracle_Account

    4. Click Save

  3. Assign listener to the account:

    1. Click in the Listeners column for Oracle_Account

    2. Find and add Oracle_Listener

    3. Click Save

  4. Click Save and Close


Establishing Oracle Connection

Point SQL*Plus at the Fudo Enterprise listener instead of the database, and log in with your own Oracle user name and password. Use the listener Local address and Port defined in Step 3, and the service name of the target database:

# Template format
sqlplus <database_user>/<password>@<listener_address>:<listener_port>/<service_name>

# Example
sqlplus john_smith/<password>@10.31.134.220:1521/FREEPDB1

Note

Important Connection Details:

  • Authentication is performed by the Oracle server. Wrong credentials are rejected with ORA-01017.

  • Oracle native encryption (Advanced Security Option) is refused. Configure the client so that it does not negotiate it.

  • Encrypted connections are supported with SQL*Plus only. Other client applications can be used without TLS.

The session is recorded and available in Sessions, where it can be filtered by the Oracle protocol.


Related topics: