Oracle 12c 新特性 --- Oracle Data Guard 配置自动同步密码文件

1 概念

 

This feature automatically synchronizes password files across Oracle Data Guard configurations. When the passwords of SYS, SYSDG, and so on, are changed, the password file at the primary database is updated and then the changes are propagated to all standby databases in the configuration.
该特性自动同步Oracle数据保护配置中的密码文件。当SYS、SYSDG等的密码发生更改时，主数据库中的密码文件被更新，然后将更改传播到配置中的所有备用数据库。
This feature provides additional automation that further simplifies management of Oracle Data Guard configurations.
这个特性提供了额外的自动化，进一步简化了Oracle数据保护配置的管理。
Redo Transport Authentication Using a Password File
In an Oracle Data Guard configuration, all physical and snapshot standby databases must use a copy of the password file from the primary database. That copy is automatically refreshed whenever an administrative privilege (SYSDG, SYSOPER, SYSDBA, and so on) is granted or revoked, and after the password of any user with administrative privileges is changed. The only exception to this is far sync instances. Updated password files must still be manually copied to far sync instances because far sync instances receive redo, but do not apply it. Once the password file is up-to-date at the far sync instance the redo containing the password update at the primary is automatically propagated to any standby databases that are set up to receive redo from that far sync instance. The password file is updated on the standby when the redo is applied.

在Oracle数据保护配置中，所有物理和快照备用数据库必须使用来自主数据库的密码文件副本。当管理员权限(SYSDG、SYSOPER、SYSDBA等)被授予或撤销时，该副本将自动刷新，并且任何具有管理员权限的用户的密码发生更改后，该副本将自动刷新。唯一的例外是far sync instances。更新的密码文件必须手动复制到far sync instances，因为far sync instances接收重做，但不应用它。一旦密码文件在远同步实例中是最新的，那么在主服务器上包含密码更新的重做就会自动传播到任何准备far sync instances接收重做的备用数据库。在应用重做时，在备用服务器上更新密码文件。

2 实验

2.1 tnsname.ora 中配置主备库的网络服务

PDBCNDBA_P =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP)(HOST = 192.168.1.74)(PORT = 1521))
    (CONNECT_DATA =
      (SERVICE_NAME = cndba)
    )
  )

PDBCNDBA_S =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP)(HOST = 192.168.1.75)(PORT = 1521))
    (CONNECT_DATA =
      (SERVICE_NAME = cndba)
    )
  )

2.2 修改主库sys 用户密码 

[oracle@dg1 admin]$ sqlplus sys/PDBCNDBA_P@cndba as sysdba

SQL*Plus: Release 12.2.0.1.0 Production on Tue Aug 15 10:55:49 2017

Copyright (c) 1982, 2016, Oracle.  All rights reserved.


Connected to:
Oracle Database 12c Enterprise Edition Release 12.2.0.1.0 - 64bit Production

SQL> alter user sys identified by oracle_p; 

User altered.
2.3 验证备库密码也跟着改变。
SQL> connect sys/oracle_p@PDBCNDBA_P as sysdba
Connected.
SQL> connect sys/oracle_p@"PDBCNDBA_S" as sysdba
Connected.

3 参考链接

http://docs.oracle.com/database/122/NEWFT/new-features.htm#NEWFT-GUID-A6211BAC-0534-44B9-B988-A7CC2B97044F 

https://petesdbablog.wordpress.com/2017/03/11/12-2-new-feature-automatically-synchronize-password-files-in-oracle-data-guard/ 

https://uhesse.com/2017/01/10/auto-sync-for-password-files-in-oracle-12c-data-guard/