{
  "date": "2018-01-20T22:16:45",
  "slug": "unplug-an-encrypted-pdb-ora-46680-master-keys-of-the-container-database-must-be-exported",
  "link": "https://www.dbi-services.com/blog/unplug-an-encrypted-pdb-ora-46680-master-keys-of-the-container-database-must-be-exported/",
  "title": {
    "rendered": "Unplug an Encrypted PDB (ORA-46680: master keys of the container database must be exported)"
  },
  "content": {
    "rendered": "<h2>By Franck Pachot</h2>\n<p>.<br />\nIn the Oracle Database Cloud DBaaS you provision a multitenant database where tablespaces are encrypted. This means that when you unplug/plug the pluggable databases, you also need to export /import the encryption keys. You cannot just copy the wallet because the wallet contains all CDB keys. Usually, you can be guided by the error messages, but this one needs a little explanation and an example.<br />\n<!--more--><br />\nHere I&#8217;ll unplug PDB6 from CDB1 and plug it into CDB2</p>\n<pre><code>[oracle@VM122 blogs]$ connect /@CDB1 as sysdba\nSQLcl: Release 17.4.0 Production on Fri Jan 19 22:22:44 2018\nCopyright (c) 1982, 2018, Oracle.  All rights reserved.\nConnected to:\nOracle Database 12c Enterprise Edition Release 12.2.0.1.0 - 64bit Production\n&nbsp;\n22:22:46 SQL&gt; show pdbs\n&nbsp;\n  CON_ID CON_NAME   OPEN MODE    RESTRICTED\n  ------ ---------- ------------ ---------- \n       2 PDB$SEED   READ ONLY    NO\n       3 PDB1       READ WRITE   NO\n       5 PDB6       READ WRITE   NO</code></pre>\n<p>Here are the master keys:</p>\n<pre><code>\nSQL&gt; select con_id,tag,substr(key_id,1,6)||'...' \"KEY_ID...\",creator,key_use,keystore_type,origin,creator_pdbname,activating_pdbname from v$encryption_keys;\n&nbsp;\n  CON_ID TAG    KEY_ID...   CREATOR   KEY_USE      KEYSTORE_TYPE       ORIGIN   CREATOR_PDBNAME   ACTIVATING_PDBNAME\n  ------ ---    ---------   -------   -------      -------------       ------   ---------------   ------------------\n       1 cdb1   AcyH+Z...   SYS       TDE IN PDB   SOFTWARE KEYSTORE   LOCAL    CDB$ROOT          CDB$ROOT\n       3 pdb6   Adnhnu...   SYS       TDE IN PDB   SOFTWARE KEYSTORE   LOCAL    PDB6              PDB6\n</code></pre>\n<h3>Export keys and Unplug PDB</h3>\n<p>Let&#8217;s try to unplug PDB6:</p>\n<pre><code>22:22:51 SQL&gt; alter pluggable database PDB6 close immediate;\nPluggable database PDB6 altered.\n&nbsp;\n22:23:06 SQL&gt; alter pluggable database PDB6 unplug into '/var/tmp/PDB6.xml';\n&nbsp;\nError starting at line : 1 in command -\nalter pluggable database PDB6 unplug into '/var/tmp/PDB6.xml'\nError report -\nORA-46680: master keys of the container database must be exported\n</code></pre>\n<p>This message is not clear. You don&#8217;t export the container database (CDB) key. You have to export the PDB ones.</p>\n<p>Then, I have to open the PDB, switch to it, and export the key:</p>\n<pre><code>\nSQL&gt; alter session set container=PDB6;\nSession altered.\n&nbsp;\nSQL&gt; administer key management set keystore open identified by \"k3yCDB1\";\nKey MANAGEMENT succeeded.\n&nbsp;\nSQL&gt; administer key management\n  2   export encryption keys with secret \"this is my secret password for the export\"\n  3   to '/var/tmp/PDB6.p12'\n  4   identified by \"k3yCDB1\"\n  5  /\n&nbsp;\nKey MANAGEMENT succeeded.\n</code></pre>\n<p>Note that I opened the keystore with a password. If you use an autologin wallet, you have to close it, in the CDB$ROOT, and open it with password.</p>\n<p>Now I can unplug the database:</p>\n<pre><code>\nSQL&gt; alter pluggable database PDB6 close immediate;\nPluggable database PDB6 altered.\n&nbsp;\nSQL&gt; alter pluggable database PDB6 unplug into '/var/tmp/PDB6.xml';\nPluggable database PDB6 altered.\n</code></pre>\n<h3>Plug PDB and Import keys</h3>\n<p>I&#8217;ll plug it in CDB2:</p>\n<pre><code>\nSQL&gt; connect /@CDB2 as sysdba\nConnected.\nSQL&gt; create pluggable database PDB6 using '/var/tmp/PDB6.xml' file_name_convert=('/CDB1/PDB6/','/CDB2/PDB6/');\nPluggable database PDB6 created.\n</code></pre>\n<p>When I open it, I get a warning:</p>\n<pre><code>\n18:05:45 SQL&gt; alter pluggable database PDB6 open;\nORA-24344: success with compilation error\n24344. 00000 -  \"success with compilation error\"\n*Cause:    A sql/plsql compilation error occurred.\n*Action:   Return OCI_SUCCESS_WITH_INFO along with the error code\n&nbsp;\nPluggable database PDB6 altered.\n</code></pre>\n<p>The PDB is opened in restricted mode and then I have to import the wallet:</p>\n<pre><code>\nSQL&gt; show pdbs\n&nbsp;\n  CON_ID CON_NAME   OPEN MODE    RESTRICTED\n  ------ --------   ---- ----    ----------\n       2 PDB$SEED   READ ONLY    NO\n       6 PDB6       READ WRITE   YES\n&nbsp;\nSQL&gt; select name,cause,type,status,message,action from pdb_plug_in_violations;\n&nbsp;\nNAME   CAUSE                   TYPE      STATUS     MESSAGE                                 ACTION\n----   -----                   ----      ------     -------                                 ------\nPDB6   Wallet Key Needed       ERROR     PENDING    PDB needs to import keys from source.   Import keys from source.\n</code></pre>\n<p>Then I open the destination CDB wallet and import the PDB keys into it:</p>\n<pre><code>\nSQL&gt; alter session set container=PDB6;\nSession altered.\n&nbsp;\nSQL&gt; administer key management set keystore open identified by \"k3yCDB2\";\nKey MANAGEMENT succeeded.\n&nbsp;\nSQL&gt; administer key management\n  2   import encryption keys with secret \"this is my secret password for the export\"\n  3   from '/var/tmp/PDB6.p12'\n  4   identified by \"k3yCDB2\"\n  5   with backup\n  6  /\n&nbsp;\nKey MANAGEMENT succeeded.\n</code></pre>\n<p>Now the PDB can be opened for all sessions</p>\n<pre><code>\nSQL&gt; alter session set container=CDB$ROOT;\nSession altered.\n&nbsp;\nSQL&gt; alter pluggable database PDB6 close;\nPluggable database PDB6 altered.\n&nbsp;\nSQL&gt; alter pluggable database PDB6 open;\nPluggable database PDB6 altered.\n</code></pre>\n<p>Here is a confirmation that the PDB has the same key as the in the origin CDB:</p>\n<pre><code>\nSQL&gt; select con_id,tag,substr(key_id,1,6)||'...' \"KEY_ID...\",creator,key_use,keystore_type,origin,creator_pdbname,activating_pdbname from v$encryption_keys;\n&nbsp;\n  CON_ID TAG    KEY_ID...   CREATOR   KEY_USE      KEYSTORE_TYPE       ORIGIN   CREATOR_PDBNAME   ACTIVATING_PDBNAME\n  ------ ---    ---------   -------   -------      -------------       ------   ---------------   ------------------\n       1 cdb2   AdTdo9...   SYS       TDE IN PDB   SOFTWARE KEYSTORE   LOCAL    CDB$ROOT          CDB$ROOT\n       4 pdb1   Adnhnu...   SYS       TDE IN PDB   SOFTWARE KEYSTORE   LOCAL    PDB6              PDB6\n</code></pre>\n",
    "protected": false
  }
}