如何在TDE环境下配置pdb为isolated mode keystore

配置pdb为 isolated mode keystore有两种方式，一种就是
administer key management isolate keystore,这个语句适合于本来这个pdb是处于united mode，并且这个pdb的master encryption key已经创建，并且也已经有数据是用这个master encryption key加密的情况下，由united mode转化为isolated mode

另外一种方式就是在初始创建这个pdb的时候，这个时候这个pdb还没有master encryption key，这个pdb的默认方式是united mode，但是还没有创建master encryption key，在这种情况下如果将这个pdb修改为isolated mode

18:22:07 SQL> create pluggable database tdetest2pdb10888 admin user pdbadmin identified by tdetest2;

Pluggable database created.

Elapsed: 00:00:04.11
18:22:37 SQL> alter pluggable database tdetest2pdb10888 open read write instances=all;

Pluggable database altered.

Elapsed: 00:00:09.04
18:23:04 SQL> alter session set container=tdetest2pdb10888;

Session altered.

Elapsed: 00:00:00.00
18:23:26 SQL> select status,keystore_mode from v$encryption_wallet;

STATUS			       KEYSTORE
------------------------------ --------
CLOSED			       UNITED

Elapsed: 00:00:00.01
18:23:41 SQL> administer key management set keystore open identified by "WelCome-123#";

keystore altered.

Elapsed: 00:00:00.11
18:24:13 SQL> select status,keystore_mode from v$encryption_wallet;

STATUS			       KEYSTORE
------------------------------ --------
OPEN_NO_MASTER_KEY	       UNITED

Elapsed: 00:00:00.01


pdb tdetest2pdb10888是新建的，显示为united mode，master encryption key还没有创建



这个时候，tde_configuration这个参数是为空的

18:24:32 SQL> show parameter tde_configuration;

NAME				     TYPE	 VALUE
------------------------------------ ----------- ------------------------------
tde_configuration		     string

我们修改了这个参数后，keystore mode就会转变成isolated mode

18:24:32 SQL> show parameter tde_configuration;

NAME				     TYPE	 VALUE
------------------------------------ ----------- ------------------------------
tde_configuration		     string
18:26:03 SQL> alter system set tde_configuration='keystore_configuration=file' scope=both;

System altered.

Elapsed: 00:00:00.03
18:26:44 SQL> show parameter tde_configuration;

NAME				     TYPE	 VALUE
------------------------------------ ----------- ------------------------------
tde_configuration		     string	 keystore_configuration=file
18:26:52 SQL> select status,keystore_mode from v$encryption_wallet;

STATUS			       KEYSTORE
------------------------------ --------
OPEN_NO_MASTER_KEY	       ISOLATED

Elapsed: 00:00:00.00

如果我们重新将这个参数设置为空的话，则keystore mode又会变回united mode

18:27:05 SQL> alter system set tde_configuration='' scope=both;

System altered.

Elapsed: 00:00:00.03
18:28:01 SQL> show parameter tde_configuration;

NAME				     TYPE	 VALUE
------------------------------------ ----------- ------------------------------
tde_configuration		     string
18:28:16 SQL> select status,keystore_mode from v$encryption_wallet;

STATUS			       KEYSTORE
------------------------------ --------
OPEN_NO_MASTER_KEY	       UNITED

Elapsed: 00:00:00.01

下面重新设置tde_configuration，然后开始测试isolated mode的pdb
18:28:30 SQL> alter system set tde_configuration='keystore_configuration=file' scope=both;

System altered.

Elapsed: 00:00:00.03
18:30:00 SQL> select status,keystore_mode from v$encryption_wallet;

STATUS			       KEYSTORE
------------------------------ --------
OPEN_NO_MASTER_KEY	       ISOLATED

Elapsed: 00:00:00.00

因为这个pdb是新建的，也没有创建master encryption key，所以其实keystore也还没有创建，因为现在是isolated mode，所以我们需要先创建keystore

18:31:48 SQL> administer key management create keystore identified by tdetest2pdb10888;

keystore altered.

Elapsed: 00:00:00.15

这个命令会在wallet_root下创建一个这个pdb的guid为目录名的目录，下面创建tde目录，然后tde目录下是这个password-protected 的keystore，名字为ewallet.p12

[oracle@scaqai06adm07 tde]$ pwd
/u01/app/v1/tdetest2/B74BAD732DE4D14EE053D529850A546A/tde
[oracle@scaqai06adm07 tde]$ ls -al
total 108
drwxr-x--- 2 oracle oinstall 20480 Dec 25 18:32 .
drwxr-x--- 3 oracle oinstall 20480 Dec 25 18:32 ..
-rw------- 1 oracle oinstall  2555 Dec 25 18:32 ewallet.p12

在修改tde_configuration参数后需要先将这个PDB重启一遍，否则直接创建master encryption key会碰到下面的错误

18:34:54 SQL> administer key management set key force keystore identified by tdetest2pdb10888 with backup;
administer key management set key force keystore identified by tdetest2pdb10888 with backup
*
ERROR at line 1:
ORA-46627: keystore password mismatch


Elapsed: 00:00:00.00

我们按照下面的步骤做一遍，先将pdb重启一遍，再创建master encryption key
19:05:09 SQL> alter pluggable database close immediate instances=all;

Pluggable database altered.

Elapsed: 00:00:01.46
19:05:35 SQL> alter pluggable database open read write instances=all;

Pluggable database altered.

Elapsed: 00:00:03.02

在先将pdb重启一遍之后，就不会再碰到这个问题了

下面我们测试一下pdb本来是united mode并且已经创建了master encrypted key的情况下如何转化为isolated mode

19:20:20 SQL> select status,keystore_mode from v$encryption_wallet;

STATUS			       KEYSTORE
------------------------------ --------
OPEN			       UNITED

Elapsed: 00:00:00.02
19:21:05 SQL> show con_name;

CON_NAME
------------------------------
TDETEST2PDB10892

这是一个新的pdb，并且已经创建了master encryption key，并且已经基于这个master encryption key创建了表 表空间等

一条命令就可以实现将keystore从united mode转化为isolated mode
这个命令应该是做了如下的操作，一个是将这个pdb的tde_configuration参数进行了修改，另外就是将这个pdb原来在那个united mode的keystore里面的key move到了新的united keystore里面

19:21:13 SQL> administer key management isolate keystore identified by tdetest2pdb10892 from root keystore force keystore identified by "WelCome-123#" with backup;

keystore altered.

Elapsed: 00:00:00.73

19:24:05 SQL> show parameter tde_configuration;

NAME				     TYPE	 VALUE
------------------------------------ ----------- ------------------------------
tde_configuration		     string	 KEYSTORE_CONFIGURATION=FILE
19:24:12 SQL> select status,keystore_mode from v$encryption_wallet;

STATUS			       KEYSTORE
------------------------------ --------
OPEN			       ISOLATED
 

tde的password如果忘记了，那就没法弄了
vault的密码还可以搞几个vault账号，如果忘了这个，还有那个，可是tde的密码只有一个啊，那要是忘了可怎么办呢
sys的密码很重要，可以sys的密码忘了也没关系，你只要能登录操作系统就没问题