Configure Auto-login for Hardware Keystore

The auto login feature for wallets does not require human intervention to supply the necessary passwords it can enable PKI-based access to services. Enabling auto login creates an obfuscated copy of the wallet, which is then used automatically until the auto login feature is disabled for that wallet.

By Default, auto login feature is disabled. You must enable auto login if you want single signon access to multiple Oracle databases. When auto login is enabled then .sso file gets created under wallet directory.

1. Close the Hardware Keystore if it is opened.

SQL> ADMINISTER KEY MANAGEMENT SET KEYSTORE CLOSE IDENTIFIED BY <hsm_password>; 

2. Set the WALLET_ROOT parameter.

SQL> connect / as sysdba  

SQL> alter system set wallet_root='<path to the oracle wallet directory>' scope=spfile 

3. Shut down and start up database.

SQL> shutdown immediate; 

SQL> startup; 

4. Set the TDE_CONFIGURATION parameter.

SQL> alter system set TDE_CONFIGURATION="KEYSTORE_CONFIGURATION=FILE" SCOPE=both; 

5. Create the software keystore.

SQL> ADMINISTER KEY MANAGEMENT CREATE KEYSTORE IDENTIFIED BY <software_keystore_password>; 

6. Open the Software Keystore.

SQL> ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY <software_keystore_password>; 

7. Add HSM password as a client to the Software Keystore.

SQL> ADMINISTER KEY MANAGEMENT ADD SECRET '<hsm_password>' FOR CLIENT 'HSM_PASSWORD' IDENTIFIED BY <software_keystore_password> WITH BACKUP; 

8. Close the Software Keystore.

SQL> ADMINISTER KEY MANAGEMENT SET KEYSTORE CLOSE IDENTIFIED BY <software_keystore_password>; 

9. Create Auto-Login keystore.

SQL> ADMINISTER KEY MANAGEMENT CREATE AUTO_LOGIN KEYSTORE FROM KEYSTORE IDENTIFIED BY <software_keystore_password>; 

10. Set TDE_CONFIGURATION parameter.

SQL> alter system set TDE_CONFIGURATION="KEYSTORE_CONFIGURATION=HSM|FILE" SCOPE=both;

11. At this stage, close the database and open it one more time and the next time when a TDE operation executes, the hardware security module auto-login keystore opens automatically.

SQL> shutdown immediate; 

SQL> startup; 

12. Check the status of the wallet.

SQL> select * from V$ENCRYPTION_WALLET; 

Now you have a software wallet that contains the HSM password. And the software wallet password is protected by Oracles auto-login feature.