Support for mTLS in oracle

[jakobhaggstrom]

Hi all,

We want to ingest from an Oracle Autonomous Database on Exadata Cloud@Customer with the Lakeflow Connect query-based Oracle connector (classic compute). The database enforces mutual TLS: the listener requires a client certificate from the Oracle wallet. Disabling mTLS is not an option for us.

What we see:

• The Unity Catalog Oracle connection only accepts host, port, user, password, encryption_protocol, userProvidedServerCertificate, service_name and timezone_as_region. Server verification with our private CA works on DBR 19, but there's no way to provide a client certificate or wallet. The handshake fails with ORA-17967: SSL Handshake failure: (certificate_required).
• Extra driver properties such as oracle.net.wallet_location are rejected with "CONNECTION_ORACLE does not support the following option(s)".
• The Lakeflow Connect Oracle CDC docs list Autonomous Database as unsupported and basic authentication as the only option.

On a dedicated job cluster we can make the foreign catalog work with an unsupported workaround. Pipeline compute runs in standard access mode, though, so that isn't possible for the managed connector.

Questions:

1. Is client-certificate / Oracle wallet (mTLS) authentication for Oracle connections, federation and the Lakeflow Connect Oracle connectors on the roadmap? If so, is there a rough timeline or a preview we could join?
2. Is there a supported way today to use the managed Oracle connector against an mTLS-only Oracle database?
3. If not, what does Databricks recommend for Autonomous Database customers who must keep mTLS?

Thanks!

[NinaThoni]

Hi @jakobhaggstrom,

Thanks for the detailed write-up.

You've read it correctly. Today, Unity Catalog Oracle connections, Lakehouse Federation and the Lakeflow Connect Oracle connectors don't support client-certificate or Oracle wallet (mTLS) authentication.

1. Roadmap: There's no public timeline or preview for wallet or mTLS authentication on Oracle connections. Please share your requirement with your Databricks account team so it's recorded against your use case.

2. Managed connector against an mTLS-only database: There's no supported way to do this today. The Oracle connectors support basic authentication (username and password) only, and Oracle Autonomous Database is listed as unsupported for the integrated CDC connector.

3. Options while you keep mTLS:

• Spark JDBC on dedicated compute. A job cluster in dedicated (single user) access mode can use the Oracle JDBC driver with your wallet. You'd write the results to Delta tables and schedule it with Lakeflow Jobs, loading incrementally on a cursor column such as a last-updated timestamp. Of these options, this is the closest to what the managed connector does.
  
  
• Oracle GoldenGate if you need log-based CDC. GoldenGate can write directly to Databricks and handles mTLS on the Oracle side.

Thanks again for raising it.

Cheers,
Nina

References

• Oracle integrated CDC connector limitations
• Oracle integrated CDC connector concepts
• Connect to data sources and external services