Packaging ojdbc-extensions for managed software distribution

Over the last few years of helping customers explore Entra ID and OCI IAM integration with the Oracle AI Database for centralized authentication, authorization and user life cycle management, several have encountered issues downloading the required ojdbc-extensions libraries from Maven repository.  This is typically because enterprise firewalls or computer configurations are locked down to prevent downloading and installing un-approved software. That completely makes sense from a security perspective. However, it also inhibits the deployment of required software for JDBC-thin applications like SQL Developer for VS Code, SQL Developer and SQLcl that is already in use.  In this post, I'm going to share how enterprise management packaging teams can download and bundle up these requisites for their package management distribution systems like Microsoft InTune, Microsoft Configuration Manager, Windows Package Manager, Action1, PDQ Deploy and more...

Before getting into the procedure, it is imperative to note that this is an iterative process that will need to be periodically repeated with updated ojdbc-extensions versions.  Therefore, document this procedure for future re-use within your packaging management distribution solution.

1. Download Software

In the case of SQLcl and SQL Developer for VS Code, the built-in sdk is the preferred method to download the requisites.

SQLcl and SQL Developer for VS Code:

For SQLcl, use the built-in sdk command to download the requisite jar files.  For SQL Developer for VS Code, open the builtin SQLcl command. For more details, see corresponding post Entra ID Integration For VS Code.

sql -thin /nolog

SQL> sdk install jdbc-zure
Downloading the ojdbc-provider-azure SDK and all its dependencies.
The jdbc-azure SDK is installed successfully, restart SQLcl for changes to take effect

SQL> sdk install jdbc-oci
Downloading the ojdbc-provider-oci SDK and all its dependencies.
The jdbc-oci SDK is installed successfully, restart SQLcl for changes to take effect

SQL> sdk list
+------------+-----------+---------+----------------------------------------------------------------------+
| SDK        | INSTALLED | VERSION | DOCS                                                                 |
+------------+-----------+---------+----------------------------------------------------------------------+
| jdbc-oci   | YES       | 1.1.0   | https://docs.oracle.com/en/database/oracle/oracle-database/23/jjdbc/ |
| jdbc-azure | YES       | 1.1.0   | https://docs.oracle.com/en/database/oracle/oracle-database/23/jjdbc/ |
+------------+-----------+---------+----------------------------------------------------------------------+

If the SQLcl or SQL Developer for VS Code sdk command fails to connect to Maven to download the requisite files and your company has a corporate proxy, try setting the relevant java web proxy options to enable routing the connection through the corporate web proxy before running sql command:

export _JAVA_OPTIONS="-Dhttp.proxyHost=YOUR_PROXY_HOST \

                      -Dhttp.proxyPort=YOUR_PROXY_PORT \

                      -Dhttp.proxyUser=YOUR_USERNAME \

                      -Dhttp.proxyPassword=YOUR_PASSWORD \

                      -Dhttps.proxyHost=YOUR_PROXY_HOST \

                      -Dhttps.proxyPort=YOUR_PROXY_PORT \

                      -Dhttps.proxyUser=YOUR_USERNAME \

                      -Dhttps.proxyPassword=YOUR_PASSWORD \

                      -Djdk.http.auth.tunneling.disabledSchemes= \

                      -Djdk.http.auth.proxying.disabledSchemes="

If going through a web proxy does not work, then a firewall rule or proxy will need to be setup to enable the downloads.  If is not possible, work with your corporate security time to find a compromise to complete the downloads.

For SQL Developer and other JDBC-thin applications that don't include SQlcl sdk command, you can use the JDBC driver get-deps command to download the requisites and create the product.conf configuration file.  Start with downloading the OJDBC driver and confirm the check sum matches.

Mac/Linux:

jdbcjar="https://repo1.maven.org/maven2/com/oracle/database/jdbc/ojdbc11/23.26.1.0.0/ojdbc11-23.26.1.0.0.jar"

curl -sko ojdbc11.jar ${jdbcjar}

ckmd5=$(openssl dgst -md5 ojdbc11.jar|awk '{ print $2 }')

md5=$(curl -sk ${jdbcjar}.md5)

echo -e "${md5}\n${ckmd5}"

c0d07c69b0030f2f661a6c749919467f
c0d07c69b0030f2f661a6c749919467f

Windows PowerShell:

$jdbcJar = "https://repo1.maven.org/maven2/com/oracle/database/jdbc/ojdbc11/23.26.1.0.0/ojdbc11-23.26.1.0.0.jar"

curl.exe -s -k -o ojdbc11.jar $jdbcJar

$ckmd5 = (Get-FileHash -Algorithm MD5 -Path ojdbc11.jar).Hash.ToLower()

$md5 = (curl.exe -s -k "$jdbcJar.md5").Trim()

"$md5`n$ckmd5"

c0d07c69b0030f2f661a6c749919467f
c0d07c69b0030f2f661a6c749919467f

If these downloads are not successful, you may need to add relevant web proxy options to _JAVA_OPTIONS cited above with SQLcl sdk command before running the java command to route the requests through the web proxy.

If routing the requests through the web proxy are unsuccessful, work with the corporate security time to find an approach that enables you to download the requisties.

2. Prepare SQL Developer Requisites

SQL Developer has two additional requisites beyond just downloading the jar files.  The path where the ojdbc-extensions will need to be pre-determined for consistent dependency resolution and a corresponding product.conf configuration file needs to be created for either inclusion with SQL Developer or deploying to the user's <home>\AppData\Roaming\sqldeveloper\<version>\ Windows directory or $HOME/.sqldeveloper/<version>/ directory.  For more instructions on how to create this product.conf configuration file, see my post on ODB Entra ID Integration For JDBC-thin Applications.

Note for OCI IAM integration that you will be getting the ojdbc-provider-oci provider rather than the ojdbc-provider-azure provider.  It doesn't hurt to have both providers so long as they are in separate destination folders like "C:\u01\app\ojdbc-extensions-1.0.6\azure" for the ojdbc-provider-azure provider and "C:\u01\app\ojdbc-extensions-1.0.6\oci" for the ojdbc-provider-oci provider.

3. Complete Functional Application Testing

Once the requisites are downloaded, confirm that use of each JDBC-thin application works properly with the respective Entra ID and/or OCI IAM integration.

4. Bundle Software

Once the functional testing is complete, then bundle up the requisite jar files and product.conf according to your corporate standards and package management distribution solution.  For example, perhaps zip up the entire directory into a hard coded full path that will be distributed and unziped to the target system for deployment.

5.  Register Package Bundle Into Management System

Once the package bundle is complete, register the package for distribution into your package management distribution solution so that it will become available to end user requests.

6. Test End User Deployment

Once the package bundle is registered, test deploying to an end user computer with your respective package management distribution solution. Then confirm that the respective JDBC-thin application functions properly for Entra ID and/or OCI IAM integration connections.

I hope you found this post helpful and informative.

Blessings!

Brad