Friday 3 January 2020

Oracle RCU Does Not Support SSL for SQL Server

As the title suggests, this is just a warning to anyone in a highly security-conscious environment. If SSL connections for SQL Server are mandatory in your environment you will not be able to run the Oracle RCU, required before you can deploy applications to WebLogic.

There are 2 Oracle Support documents that cover this, DocID 2545309.1 and DocID 2343965.1.

The solutions given are thus:


I did wonder about migrating an RCU repository between SQL Servers. The interesting thing about running the RCU is that actually there is only one table that mentions server names at all. Assuming the database you ran the RCU against is called "OWSM" and the prefix you chose is "EPM" then you can check that by running the below command:

SELECT * FROM [OWSM].[EPM_STB].[COMPONENT_SCHEMA_INFO]


Theoretically that could mean that you could migrate between SQL instances just by editing  the DB_HOSTNAME column in this table - but I have no idea how much that would mess things up! Passwords appear to be embedded into SQL tables, so even though there are documents covering how to change the RCU schema passwords and change the data sources appropriately I am not sure if they could actually work in this case.

2 comments:

  1. This is interesting stuff!

    As far I wasn't able to find a workaround to avoid SQL Force Encryption. I made a script which creates all RCU stuff to DB (Schema users, tables, etc..)and manually created to WebLogic all RCU Data Sources in SSL mode (ENCRYPTIONMETHOD=SSL).

    So far so good, all works, BUT the deployments still fails ("SQL Server login requires SSL...") as it seems to me that Config tool uses RCU on the backgound and there is not any workarounds to avoid RCU utility (which is not supporting SSL)

    I was hitting my head to the wall badly with the RCU, so I am more than interesting all further details.

    ReplyDelete
  2. did you ever resolve ? the rcu.properties file controls those logins from deployment/configtool is there the possibility of adding a updated and corrected JDBC string there to bypass encryption

    ReplyDelete