Oracle 12c – SET_AUTHENTICATION_FROM_WALLET ACL Error

acloracleoracle-12c

Running Oracle Database 12c Enterprise Edition Release 12.2.0.1.0 – 64bit Production. Have a wallet setup containing a basic authentication credential.
PL/sql package is executing a request over https to an external server. The acl seems to be setup correctly, as when I issue a request as below, and do some gets, I get results back.

D_Request_context := UTL_HTTP.CREATE_REQUEST_CONTEXT(
                                 wallet_path     => D_Path,
                                 wallet_password => NULL,
                                 enable_cookies  => FALSE
                              );

    D_Req := UTL_HTTP.BEGIN_REQUEST(
                  url             => D_Url,
                  method          => C_METHOD,
                  http_version    => C_VERSION,
                  request_context => D_Request_context      )

If I call the same code, but include this call

   UTL_HTTP.SET_AUTHENTICATION_FROM_WALLET(
            r         => D_Req,
            alias     => 'myalias',
            scheme    => C_SCHEME,
            for_proxy => false
         );

I get this error:

ORA-29273: HTTP request failed
ORA-06512: at line 52
ORA-24247: network access denied by access control list (ACL)
ORA-06512: at "SYS.UTL_HTTP", line 450
ORA-06512: at "SYS.UTL_HTTP"

So why does the call to BEGIN_REQUEST get through the ACL, but the SET_AUTHENTICATION_FROM_WALLET, gets an error?

Best Answer

Using a wallet requires an ACE (new name of ACL) as well.

SET_AUTHENTICATION_FROM_WALLET Procedure

Usage Notes

To use the password credentials in a wallet, the UTL_HTTP user must have the use-passwords privilege on the wallet.

Configuring Access Control to an Oracle Wallet

Example:

BEGIN
 DBMS_NETWORK_ACL_ADMIN.APPEND_WALLET_ACE (
  wallet_path => 'file:/home/oracle/wallet',
  ace         => xs$ace_type(privilege_list => xs$name_list('use_passwords'),
                             principal_name => 'YOUR_USER',
                             principal_type => xs_acl.ptype_db));
END;
/
Related Question