Process for provisioning a TDE-enabled vPDB
Overview
Refer to the Transparent Data Encryption and Delphix article for an overview of TDE and the Continuous Data implementation.
Delphix supports provisioning a vPDB to three different types of a TDE-enabled target container:
Software keystore based target container database.
OKV-enabled target container database.
HSM-enabled target container database.
The following pages will describe in detail the procedure for each of these.
Prerequisites for provisioning a TDE-enabled vPDB to a linked CDB
The same prerequisites that apply for provisioning a regular vPDB to a Linked CDB, also apply to a TDE software keystore based, OKV-enabled or HSM-enabled vPDB. Specifically, there must be a target environment that has an Oracle installation compatible with the Oracle installation of the source CDB and the source PDB. The following database requirements are needed to provision the vPDB to a linked CDB. For more information, refer to the Requirements for Oracle Hosts and Databases section.
Auto discovery is recommended so that the CDB can be found. Otherwise, the CDB must be manually discovered before provisioning.
CDB must be running
CDB must be in ARCHIVELOG mode
CDB must be using Block Change Tracking (BCT)
LogSync must be enabled for the CDB after linking.
Compatibility requirements for provisioning a TDE-enabled vPDB to a linked CDB
For provisioning a vPDB into a Linked CDB, the source CDB and the target CDB must meet the following compatibility requirements:
The value of the COMPATIBLE parameter in the source CDB must be less than or equal to the value of the COMPATIBLE parameter in the target CDB.
They must have the same endianness.
They must have compatible character sets and national character sets.
If TDE is configured using
sqlnet.ora, the encryption wallet location must be configured on the target host in the standard location as described in the Oracle documentation. If theTNS_ADMINenvironment variable is being used to specify the directory location where thesqlnet.orais located,TNS_ADMINmust point to the default location as indicated above.
Setting up auxiliary CDB parameters
For more details on additional TDE-related processing that is performed in the Auxiliary CDB, refer to the A closer look at the TDE provisioning page.