Named credentials in OEM12c

In Oracle Enterprise Manager 12c (aka OEM) there is such a great facility called “Named Credentials”. This allows someone to create a pair of username/password which can be used afterwards without knowing the actual password. Named credentials can be defined on target (i.e. single database or host) or on global level (available on all targets of specified type).

This already works great for a single user (no need to remember all the different passwords, just key them in once and give them a useful name), but how about a bigger environment. If a password change is executed all administrators have to update their stored Named Credentials. If one is missed, his/her jobs will fail and irritation level will increase.

It would be nice to have 1 user who is responsible for setting up and maintaining the Named Credential, and all other admins just consuming them when needed. This functionality is out of the box available in the OEM console, so whats the worry…? No worries, but now we upscale a bit.

Imagine we have several administrators who only consume the Named Credentials. If a new colleague arrives, he has to be granted use ‘View’ rights on all (maybe a lot) Named Credentials. Same applies if a new Named Credential is added to the pool. It has to be granted to all admins. Or the other way around: the current admin leaves his job: all change rights on all Named Credentials have to be changed…. This calls for the usage of a group functionality.

This functionality is  not available in the GUI of OEM, neither explained in the manuals (at least I couldn’t find it).

Luckely we have EMCLI (Enterprise Manager Command Line Interface), giving a lot more functionality then the GUI does. And since it is command line, we can also script against it. Installation instructions for EMCLI can be found in your OEM instance: Navigate to Setup > Command Line Interface…

One small downside on this construction is the fact that the admins can not be ‘Super Administrator’ anymore, the will have be ‘demoted’ to ‘Admin’.

What we will do is:

1. Create required accounts and roles in OEM
2. Create a user who will be owner of all named credentials (it’s pure administrative)
3. List all named credentials
4. Grant access to the named credentials to the roles
5. Grant the appropriate roles to the administrators

Login in the OEM console using an account with super administrator privileges (i.e. sysman).

• Navigate to Setup > Security > Roles and click “Create”. Give this role the name “MY_SEC_ADMIN”, Click “Review” and then “Finish”
• Navigate to Setup > Security > Roles and click “Create”. Give this role the name “MY_SEC_USER”, Click “Review” and then “Finish”
• Navigate to Setup > Security > Roles and click “Create”. Give this role the name “MY_PUBLIC”, click “Next”, grant all privileges you might need  and continue until “Finish”
• Navigate to Setup > Security > Administrators  and click “Create”. Give this user the name “Credential_owner”, select “Superadministrator”, click “Review” and then “Finish”

Logout from OEM console, and login again using the newly created account Credential_owner

• Navigate to Setup > Security > Named Credentials
• Create a new named credential

Next step is to start emcli and connect to your OEM instance:

C:\emcli>emcli setup -url=https://xxxxxxxx.xxxxxx.com:7802/em -autologin -username=Credential_owner
Oracle Enterprise Manager Cloud Control 12c Release 2.
Copyright (c) 1996, 2012 Oracle Corporation and/or its affiliates. All rights reserved.

Enter password

Emcli setup successful

C:\emcli>

Next step is to list all named credentials this user has access on:

C:\emcli> emcli list_named_credentials

For each named credential a line will be written with Credential Name, Credential Owner and some target info.

To grant read access to all users who are in the group “MY_SEC_USER” execute the following statement:

C:\emcli>emcli grant_privs -name=”MY_SEC_USER” -privilege=”GET_CREDENTIAL;CRED_NAME=<credential_name>:CRED_OWNER=Credential owner”

To grant full access to the users in the group “My_SEC_ADMIN”you can use the following:

C:\emcli>emcli grant_privs -name=”MY_SEC_USER” -privilege=”FULL_CREDENTIAL;CRED_NAME=<credential_name>:CRED_OWNER=Credential owner”

Of course there is a lot more that can be achieved on this subject. This post is just to get you started…