XMII enforce security of the jdbc connection to Oracle

[saptechnicalteam_rcs]

Hi XMII expert,

I am connecting to an external Oracle database using Oracle JDBC thin driver from XMII.

I wanted to know if the user/password connection is crypted or if you can see it in plain text on the network (with a sniffing tool).

If it is in plain text, is it possible to crypt the communication threw SSL or some other stuff.

Regards

Jean-Louis

[Former Member · Accepted solution]

Hi,

In either 11.5 or 12.0 version of xMII you can configure an Oracle server through "Data Services" tab. Under this there is one link named "Data Servers" where you can configure any data server other than SAP server.

While creating a new data server we have to provide following details.

Connector

ConnectorType = Oracle

DatePrefix

DateSuffix

Description

Enabled = True

InitCommand

InternalDateFormat = yyyy-MM-dd HH:mm:ss

JDBCDriver

Name

PoolMax = 256 (Maximum connection)

PoolSize

ServerPackage

ServerURL

Timeout

UseCount

UserName

ValidationQuery

WaitTime

You can mention the user name and password over there.

Password will come in encrypted form.

Thanks,

Rajesh Sivaprakasam

[sufw]

Hi Jean-Louis,

if you would like to encrypt the entire JDBC session, you could try SSH tunneling. Assuming both the MII and Oracle servers are running Windows, you can use PuTTY (> Google) on the MII server and SSHwindows (> http://sshwindows.sourceforge.net/) on the Oracle server.

SSH supports tunneling TCP ports through the encrypted session. If you set up a tunnel from the MII server to the Oracle server, and set the tunnel's exit port to point to the port Oracle is listening on (e.g. localhost:1433), you should be able to set MII's JDBC connection string to the tunnel's entry port on the MII and server and connect to the DB.

This might be a little tricky to set up at first, but the help files should help you out a bit. If not, come back here and ask.

Hope this helps,

Sascha

[saptechnicalteam_rcs]

Hi Rajesh,

I allready have setup my jdbc connection and it works and I have noticed that the password is stored in a crypted form in the table XMII_SERVERPROP.

But my question was more during the connection to oracle, is the password passed in unencrypted form over the network ?

Thanks Sascha,

I have thought of that kind of encryption but I would have prefer to use Oracle advanced secure properties than an ssl tunnel.

And my XMII server is on SOLARIS UNIX and my Oracle Database is on a Windows server.

It seems that JDBC thin Oracle client can support SSL encryption but I don't know how to set it up.

Many thanks to both of you Anyway.

But If someone has allready set up an oracle JDBC SSL communication, I would appreciate a little walkthrough.

Jean-Louis

[sufw]

Jean-Louis,

well, if your MII server is running on a Unix-like system, you will have SSH capabilities provided by the OS and won't need additional software.

But anyways, a quick Google search found this document from Oracle: http://www.oracle.com/technology/tech/java/sqlj_jdbc/pdf/wp-oracle-jdbc_thin_ssl_2007.pdf

Good luck,

Sascha

[saptechnicalteam_rcs]

Many Thanks sasha,

I was looking for that kind of document.

I have found a lots of but not this one.

Regards

Jean-Louis