tcps oracle tomcat瘦驱动程序不工作

Question

我需要在设置新环境时获得帮助

Tomcat (wallet + jdbc瘦驱动程序) --> TCPS --> Oracle 12

我一直在关注这篇文章(Oracle JDBC thin driver SSL)，但一无所获

当我尝试启动Tomcat时，显示以下错误

Caused by: java.security.SignatureException: Signature length not   correct: got 256 but was expecting 128
    at sun.security.rsa.RSASignature.engineVerify(RSASignature.java:189)
    at java.security.Signature$Delegate.engineVerify(Signature.java:1219)

我想我错过了什么，但我不知道在哪里..。

Oracle端

listener.ora

WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = /u01/app/oracle/wallet)
    )
  )

SSL_CLIENT_AUTHENTICATION = FALSE

LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = 72795752816f)(PORT = 1521))
      (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
      (ADDRESS = (PROTOCOL = TCPS)(HOST = 72795752816f)(PORT = 2484))
    )
  )
ADR_BASE_LISTENER = /u01/app/oracle

sqlnet.ora

WALLET_LOCATION =
   (SOURCE =
     (METHOD = FILE)
     (METHOD_DATA =
       (DIRECTORY = /u01/app/oracle/wallet)
     )
   )

SQLNET.AUTHENTICATION_SERVICES = (TCPS,NTS,BEQ)
SSL_CLIENT_AUTHENTICATION = FALSE
SSL_CIPHER_SUITES = (SSL_RSA_WITH_RC4_128_SHA,     SSL_RSA_WITH_RC4_128_MD5)

SQLNET.WALLET_OVERRIDE = TRUE

Tomcat侧

tnsnames.ora

TEST =
 (DESCRIPTION =
  (ADDRESS = 
    (PROTOCOL = TCPS)
    (HOST = 72795752816f)
    (PORT = 2484)
  )
   (CONNECT_DATA = 
    (SERVER = DEDICATED) 
    (SERVICE_NAME = xe.oracle.docker)   
   )
 )

context.xml

<Resource name="jdbc/edorasone" auth="Container"
          type="javax.sql.DataSource"     driverClassName="oracle.jdbc.OracleDriver"
      url="jdbc:oracle:thin:/@TEST"
  connectionProperties="javax.net.ssl.keyStore=/tomcat/wallet/cwallet.sso;\
javax.net.ssl.keyStoreType=PCKS12;\
oracle.net.ssl_version=1.0;\
oracle.net.ssl_cipher_suites=(SSL_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_MD5);\
oracle.net.authentication_services=( TCPS )"
/>

顺便说一下:如果在Tomcat中使用带有sqlnet.ora(=Oracle) & tnsnames.ora (=Tomcat)的sqlplus客户端，我可以毫无问题地进行连接。

Answer 1

(a)您是否有使用Oracle wallets所需的其他jars？(oraclepki.jar、osdt_core.jar、osdt_cert.jar)？

(2)纠正javax.net.ssl.keyStoreType=PKCS12。你有一个打字错误。

(3) DB URL应为"jdbc: Oracle :thin:@TEST“，由于您使用的是别名，因此需要设置系统属性-Doracle.net.tns_admin=(a)使用Oracle wallets是否需要额外的jars？(oraclepki.jar、osdt_core.jar、osdt_cert.jar)？

有关更多详细信息，请查看SSL with JDBC whitepaper。

Answer 2

非常感谢你的帮助。a)是的，它们已经就位了b)它可以与PCKS12协同工作c) tns_admin已经进入了setenv.sh脚本

我终于让我的设置开始工作了。

SSL_CIPHER_SUITES必须在两端都匹配，所以我所做的就是强制使用相同的密码

sqlnet.ora

 SSL_CIPHER_SUITES = (SSL_RSA_WITH_AES_256_CBC_SHA)

setenv.sh

CATALINA_OPTS+=" -Doracle.net.ssl_cipher_suites=TLS_RSA_WITH_AES_256_CBC_SHA " 

(注意前缀不一样:Oracle端是SSL_，Tomcat/Java端是TLS_ )

对于那些有类似配置问题的用户，我让Tomcat在这里进行配置

###############################
# DB CONNECTION CONFIGURATION #
###############################
# Oracle DB (JNDI)
CATALINA_OPTS+=" -Dspring.profiles.active=database-jndi "
CATALINA_OPTS+=" -Doracle.net.tns_admin=/tomcat/wallet "
CATALINA_OPTS+=" -Djavax.net.ssl.keyStore=/tomcat/wallet/keystore.jks "
CATALINA_OPTS+=" -Djavax.net.ssl.keyStoreType=JKS "
CATALINA_OPTS+=" -Djavax.net.ssl.keyStorePassword=Passw0rd  "
CATALINA_OPTS+=" -Djavax.net.ssl.trustStore=/tomcat/wallet/truststore.jks  "    
CATALINA_OPTS+=" -Djavax.net.ssl.trustStorePassword=Passw0rd  "                 
CATALINA_OPTS+=" -Doracle.net.authentication_services=TCPS   "
CATALINA_OPTS+=" -Doracle.net.ssl_cipher_suites=TLS_RSA_WITH_AES_256_CBC_SHA "

context.xml

<Resource name="jdbc/efdesone" auth="Container"
      type="javax.sql.DataSource" driverClassName="oracle.jdbc.OracleDriver"
      url="jdbc:oracle:thin:/@TEST"
  username="<username>" password="<password>" maxActive="20" maxIdle="10" maxWait="-1"
/>

亲切的问候

纳乔。