Hi OAC Team,
We need a supported passwordless connection from OAC to ADW that uses Resource Principal authentication and database proxy access.
Current status:
• Resource Principal login from OAC to ADW works in our POC.
• An OAC RP system connection can be referenced by its Object ID in an RPD connection pool.
• The OAC RP connection dialog does not provide a target proxy-schema setting.
• The OAC team previously indicated that this capability is on the backlog.
Required setup:
One OAC Resource Principal authenticates as the mapped database user HORIZON_OAC. Each OAC connection must use a fixed proxy target:
• Connection 1: HORIZON_OAC → REVENUE
• Connection 2: HORIZON_OAC → HDP
Both connections must work concurrently. We need this for datasets and RPD/subject-area system connections.
Database passwords and direct SELECT grants to HORIZON_OAC are not permitted in the intended design. Access must use database proxy grants:
ALTER USER REVENUE GRANT CONNECT THROUGH HORIZON_OAC;
ALTER USER HDP GRANT CONNECT THROUGH HORIZON_OAC;
We require a fixed proxy target per connection. We do not require the identity of each OAC end user to be passed to ADW.
ADB confirmation:
In ADB-1847552, the ADB team confirmed support for IAM database-token authentication with database proxy access, including tokens obtained through a Resource Principal. They confirmed concurrent connections with different proxy targets and provided a JDBC example using oracle.jdbc.proxyClientName.
This confirms the database capability. We need the supported OAC configuration or enhancement.
Please provide:
1. The supported OAC UI or API configuration, if available.
2. If unsupported, confirmation of the remaining OAC connection or connection-pool limitation.
3. The enhancement reference, responsible owner, and expected delivery date.
4. Any specific ADB dependency or supported passwordless alternative that preserves proxy-only access.
Impact:
This gap blocks migration of our OAC proxy connections to passwordless ADW access. If no supported path is available, we plan to request a temporary SDR exception to retain the HORIZON_OAC password, subject to approval.
References:
Internal ADB confirmation:
Internal OAC ticket:
https://jira-sd.mc1.oracleiaas.com/browse/AOAC-222169
