Here's a list of typical tasks that must be performed before creating named credentials.

1. The Database Administrator creates the database user credentials. For information on how to create user accounts, see Creating User Accounts in Oracle Database Security Guide.
2. An Oracle Cloud Infrastructure user with the required permissions creates a Vault service secret for the database user password. The secret can be created in a different compartment or in the same compartment with a different or the same vault key.

   Here's an example of the policy that grants a user group the permission to create secrets:

   Allow group DB-MGMT-USER to manage secret-family in compartment ABC

   For information on how to create a secret, see Creating a Secret in a Vault.

3. The Database Administrator with the required Oracle Cloud Infrastructure permissions creates one of the following types of policies to provide access to the Vault service secret with the database user password:
   • User: The permission to access the password secret is defined for a user in the policy.

     Here's an example of the policy that grants a user the permission to access the secret:

     Allow any-user to read secret in compartment ABC where request.user.id = <user_OCID>

   • Resource: The permission to access the password secret is defined for the type of resource in the policy.

     Named credentials are supported for Database Management-enabled Oracle Databases resources (dbmgmtmanageddatabase). Here's an example of the policy that grants this resource-type the permission to access the secret:

     Allow any-user to read secret-family in compartment ABC where ALL {request.principal.type='dbmgmtmanageddatabase'}

On performing the prerequisite tasks, a user with the Database Management dbmgmt-named-credentials resource permissions can create and manage named credentials. Here are a few examples of the policies that grant user groups the required permissions:

• To grant the DB-MGMT-ADMIN user group the permission to create named credentials for all the Managed Databases in compartment ABC:

  Allow group DB-MGMT-ADMIN to manage dbmgmt-named-credentials in compartment ABC

  Allow group DB-MGMT-ADMIN to use dbmgmt-managed-databases in compartment ABC

• To grant the DB-MGMT-ADMIN user group the permission to delete the named credentials in compartment ABC:

  Allow group DB-MGMT-ADMIN to manage dbmgmt-named-credentials in compartment ABC

• To grant the DB-MGMT-ADMIN user group the permission to move the named credentials in compartment ABC to another compartment:

  Allow group DB-MGMT-ADMIN to manage dbmgmt-named-credentials in compartment ABC

Once a named credential is created, the permission to use the named credential to perform various Database Management Diagnostics & Management tasks must be granted to user groups (in addition to other required permissions). For example, here are the policies that grant the DB-MGMT-USER user group the permission to create a tablespace and use named credentials to do so:

Allow group DB-MGMT-USER to use dbmgmt-managed-databases in compartment ABC

Allow group DB-MGMT-USER to read dbmgmt-named-credentials in compartment ABC

For more information on Database Management resource-types and permissions, see Policy Details for Database Management.

You can create named credentials to access, monitor and manage a Managed Database on the Managed database details page.

1. Go to the Managed database details page and on the left pane under Resources, click Credentials.
2. Click the Named credentials tab.
   The list of named credentials, if any, in the compartment are listed, and to view the named credentials in another compartment, click Change compartment. In addition, you can use the options in the View by drop-down list and the Search by name field to filter the list of named credentials.
3. Click Create named credential.
4. In the Create named credential panel:
   1. Provide the following information in the General section:
      1. Name: Review the unique name displayed for the named credential and change it, if required.
      2. Description: Optionally, enter a description for the named credential.
   2. Review the database details and set the named credential as a preferred credential, if required, in the Resource section:
      1. Type: Review the resource type. Oracle Database is selected by default and this field cannot be edited.
      2. Scope: Select the scope of the named credential:
         • Resource: A named credential with the Resource scope can be used to access, monitor and manage a single Managed Database.
         • Global: A named credential with the Global scope can be used to access, monitor and manage all the Managed Databases.
      3. Resource name: Review the name of the Managed Database. This field cannot be edited when the Create named credential panel is accessed from the Managed database details page.
         Note
         
         To create a named credential for a different Managed Database, go to the Administration Named credentials page.
      4. Set as preferred credential: Optionally, select this check box and select a preferred credential. If you opt to link the named credential to a preferred credential, you can use the named credential to perform the tasks associated with the preferred credential. For information on preferred credentials, see Set Preferred Credentials.
         Note
         
         A preferred credential is set for a particular Managed Database, therefore, the Set as preferred credential check box is not displayed if the Global scope option is selected.
   3. Specify the following credential details:
      • User name: Enter the database user name to connect to the Managed Database.
      • User password secret: Select the secret that contains the database user password from the drop-down list. If the compartment in which the secret resides is different from the compartment displayed, click Change compartment and select another compartment.

        If an existing secret with the database user password is not available, then select Create new secret... in the drop-down list. For information on the permission required to create a secret and how to create a secret, see Perform Prerequisite Tasks and Obtain Required Permissions.

      • Role: Select the role from the available options, NORMAL or SYSDBA.
      • Password secret access mode: Select the password secret access mode:
        • User: The permission to access the password secret is defined for a user in the policy.
        • Resource: The permission to access the password secret is defined for the type of resource (for which the named credential is created) in the policy.

        For information on the policies that provide access to the secret with the database user password, see Perform Prerequisite Tasks and Obtain Required Permissions.

   4. Optionally, click Show advanced options to add free-form or defined tags to the named credential. If you have the permissions required to create a named credential, then you also have permissions to add free-form tags. To add a defined tag, you must have permissions to use the tag namespace.

      For information on:

      • Tagging concepts and the permissions required to work with tags, see Overview of Tagging.
      • How to add a tag during resource creation, see To add a tag during resource creation.
   5. Optionally, click Test to check whether the connection to the Managed Database is established successfully using the credentials.
   6. Click Create to create the named credential.