Getting an ewallet.pem from ewallet.p12 created by orapki/mkstore?

[cmarqu]

Hi,

I am using RHEL 7 and so far successfully used cx_Oracle together with the Client libraries to connect to our on-prem database, using a wallet created via orapki/mkstore.

Now I want to use python-oracledb in Thin mode to not need the Client libraries anymore, but am failing to create the needed ewallet.pem from my existing ewallet.p12.

I am following the instructions in https://python-oracledb.readthedocs.io/en/latest/user_guide/connection_handling.html#creating-a-pem-file-for-python-oracledb-thin-mode and am using the provided create_pem.py script (with some modifications for debugging), but I find that the line

result = pkcs12.load_key_and_certificates(pkcs12_data, args.wallet_password.encode())

returns

(None, None, [])

(with a correct wallet password), thus, making the whole script fail with

    f.write(private_key.private_bytes(Encoding.PEM, PrivateFormat.PKCS8,
            ^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'private_bytes'

.

I have also unsuccessfully tried to convert the file using openssl:

$ openssl pkcs12 -in $HOME/.local/share/oracle/ewallet.p12 -out $HOME/.local/share/oracle/ewallet.pem
Enter Import Password:
Warning unsupported bag type: secretBag
Warning unsupported bag type: secretBag
Warning unsupported bag type: secretBag

Is it possible to create a wallet with tools like orapki and/or mkstore that I can then use with python-oracledb?

---

For reference, here is how I created the wallet:

$ orapki wallet create -wallet $HOME/.local/share/oracle
Oracle PKI Tool Release 21.0.0.0.0 - Production
Version 21.0.0.0.0
Copyright (c) 2004, 2022, Oracle and/or its affiliates. All rights reserved.

Enter password:   
Enter password again:   
Operation is successfully completed.
$ mkstore -wrl $HOME/.local/share/oracle -createCredential 'cred' <user> <secret>
Oracle Secret Store Tool Release 21.0.0.0.0 - Production
Version 21.0.0.0.0
Copyright (c) 2004, 2022, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:   
$ mkstore -wrl $HOME/.local/share/oracle -listCredential

Oracle Secret Store Tool Release 21.0.0.0.0 - Production
Version 21.0.0.0.0
Copyright (c) 2004, 2022, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:   
List credential (index: connect_string username)
1: cred <user>

[anthony-tuininga]

Wallets created for storing certificates and private keys (for authentication with the database server, usually on the cloud) is what is intended, not for storing passwords -- which is what you appear to be doing here!

[cmarqu]

I see... I was hoping I could silently upgrade my users to use python-oracledb and reuse whatever wallet content they have.
Any suggestions on how to go from here? Do I need to switch to e.g. https://pypi.org/project/keyring/ (which AIUI would require user participation)?

[cjbj]

Good questions. I suspect we need to involve the Oracle DB security folk in discussions about all this, and about what they are willing to let us put in Thin driver code.

[cmarqu]

Oh, nice, is this supported now?