Summary of security-related options

Specifies the method the driver uses to authenticate the user to the server when a connection is established.

If set to 1 (Encrypt Password), the driver sends the user ID in clear text and an encrypted password to the server for authentication.

If set to 3 (Client Authentication), the driver uses client authentication when establishing a connection. The database server relies on the client to authenticate the user and does not provide additional authentication.

If set to 4 (Kerberos Authentication), the driver uses Kerberos authentication. This method supports both Windows Active Directory Kerberos and MIT Kerberos environments.

When set to 5 (Kerberos with UID & PWD), the driver uses both Kerberos authentication and user ID and password authentication. The driver first authenticates the user using Kerberos. If a user ID and password are specified, the driver reauthenticates using the user name and password supplied. An error is generated if a user ID and password are not specified.

If set to 6 (NTLM), the driver uses NTLMv1 authentication for Windows clients.

If set to 11 (SSL), the driver uses SSL certificate information to authenticate the client with the server when using Oracle Wallet. The User Name and Password options should not be specified. See "Oracle Wallet SSL Authentication" for additional requirements.

If set to 12 (SSL with UID & Password), the driver uses user ID/password and SSL authentication to connect with the server when using Oracle Wallet. See "Oracle Wallet SSL Authentication" for additional requirements.

If set to 16 (Wallet UID & PWD), the driver authenticates to the server using a user ID and password retrieved from Oracle Wallet. See "Oracle Wallet Password Store" for additional requirements.

If set to 38 (EntraIDAccessToken), the driver authenticates to the server using an Entra ID access token. This setting requires the Entra Access Token option to be specified. If an access token is not specified, the driver throws an exception. All communications with the service are encrypted using TLS/SSL encryption.

Default: 1 (Encrypt Password)

Specifies the string value used to identify database credential information stored in an Oracle Wallet. When Authentication Method is set to 16 (Wallet UID & PWD), the driver retrieves the user ID and password associated with the specified value from the wallet and uses them to authenticate to the server. This value provides a method for the correct user ID and password to be retrieved when there are multiple pairs in a wallet.

See "Oracle Wallet Password Store" for a complete list of options and settings required for the Oracle Wallet Password Store feature.

Specifies the password used to access the Oracle Wallet in which your database credential information is stored. When Authentication Method is set to 16 (Wallet UID & PWD), the driver uses this value to retrieve the database user ID and password that is stored in the wallet file specified by the Credentials Wallet Path option.

See "Oracle Wallet Password Store" for a complete list of options and settings required for the Oracle Wallet Password Store feature.

Specifies the fully-qualified path to the Oracle Wallet file in which your database credential information is stored. When Authentication Method is set to 16 (Wallet UID & PWD), the driver retrieves the database user name and password from this file.

See "Oracle Wallet Password Store" for a complete list of options and settings required for the Oracle Wallet Password Store feature.

Specifies the access token required to authenticate to an Oracle instance when using Entra ID access token authentication (AuthenticationMethod=38). Refer to the Oracle documentation for more information on obtaining an access token.

The name of the GSS client library that the driver uses to communicate with the Key Distribution Center (KDC).

Default: native (The driver uses the GSS client shipped with the operating system.)

Specifies the proxy user ID used for impersonation. The value for Impersonate User determines your identity and permissions when executing queries. When a value is specified for this option, the driver authenticates according to the setting of the Authentication Method option; then, after establishing a connection, the driver attempts to reauthenticate as the destination user. Note that the administrator must grant CONNECT THROUGH permission to the authenticated user in order to impersonate the destination user; otherwise, an error is returned.

Default: None

Specifies the cryptographic protocols to use when TLS/SSL is enabled using the Encryption Method connection option (EncryptionMethod=1).

Default: TLSv1.3,TLSv1.2

The absolute path for the OpenSSL library file containing the cryptographic library to be used by the data source or connection when TLS/SSL is enabled. The cryptograpic library contains the implementations of cryptographic algorithms the driver uses for data encryption.

Default: Empty string

Specifies a preference for the data integrity to be used on data sent between the driver and the database server. The connection fails if the database server does not have a compatible integrity algorithm.

If set to 0 (Rejected), a data integrity check on data sent between the driver and the database server is refused. The connection fails if the database server specifies REQUIRED.

If set to 1 (Accepted), a data integrity check can be made on data sent between the driver and the database server. Data integrity is used if the database server requests or requires it.

If set to 2 (Requested), the driver enables a data integrity check on data sent between the driver and the database server if the database server permits it.

If set to 3 (Required), a data integrity check must be performed on data sent between the driver and the database server. The connection fails if the database server specifies REJECTED.

See "Encryption and Data Integrity" for more information.

Default: 1 (Accepted)

Determines the method the driver uses to protect against attacks that intercept and modify data being transmitted between the client and server. You can enable data integrity protection without enabling encryption.

If multiple values are specified and Oracle Advanced Security data integrity is enabled using the Data Integrity Level option, the database server determines which algorithm is used based on how it is configured.

Default: MD5, SHA1, SHA256, SHA384, SHA512

If disabled, the OpenSSL library uses cryptographic algorithms from the default provider.

If enabled, the OpenSSL library uses cryptographic algorithms from the FIPS provider.

Default: Disabled

Specifies a preference on whether to use encryption on data being sent between the driver and the database server.

If set to 0 (Rejected), or if no match is found between the driver and server encryption types, data sent between the driver and the database server is not encrypted or decrypted. The connection fails if the database server specifies REQUIRED.

If set to 1 (Accepted), encryption is used on data sent between the driver and the database server if the database server requests or requires it.

If set to 2 (Requested), data sent between the driver and the database server is encrypted and decrypted if the database server permits it.

If set to 3 (Required), data sent between the driver and the database server must be encrypted and decrypted. The connection fails if the database server specifies REJECTED.

Default: 1 (Accepted)

The method the driver uses to encrypt data sent between the driver and the database server.

If set to 0 (No Encryption), data is not encrypted.

If set to 1 (SSL), data is encrypted using the TLS/SSL protocols specified in the Crypto Protocol Version connection option.

Default: 0 (No Encryption)

Specifies the encryption algorithms to use if Oracle Advanced Security encryption is enabled using the Encryption Level connection property.

Default: All listed encryption algorithms are selected.

A host name for certificate validation when TLS/SSL encryption is enabled (Encryption Method=1) and validation is enabled (Validate Server Certificate=1).

Default: None

Specifies the password used to access the individual keys in the keystore file when TLS/SSL is enabled (Encryption Method=1) and TLS/SSL client authentication is enabled on the database server.

Default: None

The absolute path of the keystore file to be used when TLS/SSL is enabled (EncryptionMethod=1) and TLS/SSL client authentication is enabled on the database server.

Default: None

The password used to access the keystore file when TLS/SSL is enabled (EncryptionMethod=1) and TLS/SSL client authentication is enabled on the database server.

Default: None

The absolute path for the OpenSSL library file containing the TLS/SSL library to be used by the data source or connection when TLS/SSL is enabled. The library contains the implementations of TLS/SSL protocols the driver uses for data encryption.

Default: Empty string