DB connection encryption in IIQ

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ version are you inquiring about?

8.5p1

Hi All,

I’m interested if there is possibility to encrypt connection from IIQ to oracle Database.

Our DB server supports encryption, but when I try to connect with

dataSource.url=jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=hostname)(PORT=1521))(CONNECT_DATA=(SID=db_sid))(SECURITY=(ENCRYPTION_CLIENT=REQUIRED)(ENCRYPTION_TYPES_CLIENT=AES256)))

connection works but is not encrypted.

Does someone have experience with IIQ + Oracle private network (encryption over tcp).

Best regards,

Jacek

2

To encrypt the SailPoint IdentityIQ (IIQ) to Oracle database connection via Source XML, remove the (SECURITY=...) block from the TNS string and define encryption parameters within the connectionProperties map, as the JDBC driver parses these directly. The configuration requires setting oracle.net.encryption_client to REQUIRED and specifying oracle.net.encryption_types_client (e.g., AES256) within the application XML to enforce Native Network Encryption (NNE).

3

@JacekRutkowski Have you already tried setting below properties?

oracle.net.encryption_client=ACCEPTED
oracle.net.encryption_types_client=AES256
4

Hi @jchinnapareddy

I have tried, still doesn’t work as expected.

One more info… it connection to iiq database (not to oracle as managed application).

5

In IIQ, encrypting the Oracle DB connection using (SECURITY=...) in the JDBC URL will not work because the Oracle Thin driver ignores those parameters. The correct approach is to configure encryption using Oracle JDBC properties instead of the TNS string.

For IIQ database (not connector), defining oracle.net.encryption_client in application XML or connectionProperties is often not sufficient because IIQ may not pass these properties to the driver.

The reliable solution is to enforce encryption at the JVM level using system properties:

-Doracle.net.encryption_client=REQUIRED

-Doracle.net.encryption_types_client=AES256

-Doracle.net.crypto_checksum_client=REQUIRED

-Doracle.net.crypto_checksum_types_client=SHA256

Also ensure the DB server has SQLNET.ENCRYPTION_SERVER=REQUIRED; otherwise encryption may not be negotiated.

In short: for IIQ internal DB connections, JVM properties or sqlnet.ora are the only consistently working methods, not JDBC URL or XML configuration. Might this can help solve the issue