{"id":32117,"date":"2024-03-27T17:29:34","date_gmt":"2024-03-27T16:29:34","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/?p=32117"},"modified":"2025-01-24T10:42:07","modified_gmt":"2025-01-24T09:42:07","slug":"clone-oracle-database-configured-with-oracle-key-vault-okv","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/","title":{"rendered":"Clone Oracle Database configured with Oracle Key Vault (OKV)"},"content":{"rendered":"\n<p>by Alexandre Nestor<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-introduction\">Introduction<\/h2>\n\n\n\n<p>This post is to describe the process of cloning an Oracle Database which is configured to store the TDE (encryption keys) in the Oracle Key Vault (OKV)<\/p>\n\n\n\n<p>If the source database is configured with Oracle key Vault, than we can clone the database withouth having to transport the key files on the destination server.<\/p>\n\n\n\n<p>In this exemple the clone will be made on the same host.<\/p>\n\n\n\n<p>To install the RESTFul API and add a database as endpoint to OKV check my previous BLOG <a href=\"https:\/\/www.dbi-services.com\/blog\/add-oracle-database-server-to-oracle-key-vault-okv-from-scratch-only-with-restfull-api\/\">Add Oracle database server to Oracle Key vault (OKV) from scratch, only with RESTfull API.<\/a><\/p>\n\n\n\n<p>The initial configuration is :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The source database name is <code>CDB01<\/code><\/li>\n\n\n\n<li>The target database name will be <code>CDB02<\/code><\/li>\n\n\n\n<li>The <code>wallet_root<\/code> database parameter on source database, <code>CDB01<\/code>, is set to <code>\/opt\/oracle\/admin\/CDB01\/wallet<\/code><\/li>\n\n\n\n<li>The <code>tde_configuration<\/code> parameter on source database, <code>CDB01<\/code>, is set to <code>KEYSTORE_CONFIGURATION=OKV|FILE<\/code>. That means that the keystore is in OKV server and the auto login file is on local filesystem in <code>\/opt\/oracle\/admin\/CDB01\/wallet\/tde<\/code> path.<\/li>\n\n\n\n<li>The source database is enrolled as an endpoint. A wallet was defined for the <code>CDB01<\/code> endpoint, and the TDE keys are uploaded in this wallet.<\/li>\n\n\n\n<li>On <code>CDB01<\/code> the SYS password is tagged as <em>sys_pwd<\/em><\/li>\n\n\n\n<li>The endpoint password is tagged as <em>endpoint_pwd<\/em><\/li>\n\n\n\n<li>The RESTFul API is installed on the server in the path <code>$HOME\/okv<\/code><\/li>\n\n\n\n<li>Finally, the name of the wallet defined in OKV which contains the TDE keys for <code>CDB01<\/code> database is <code>ORA_DB<\/code><\/li>\n<\/ul>\n\n\n\n<p>The schema is something like this: <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"672\" height=\"552\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2024\/03\/2024-03-27_17-43-51.png\" alt=\"\" class=\"wp-image-32126\" srcset=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2024\/03\/2024-03-27_17-43-51.png 672w, https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2024\/03\/2024-03-27_17-43-51-300x246.png 300w\" sizes=\"auto, (max-width: 672px) 100vw, 672px\" \/><\/figure>\n\n\n\n<p>The <code>CDB01<\/code> database store his keys in <code>ORA_DB<\/code> wallet. Normally it has the rights to read\/write in this wallet. At enrol time, we are going to give the rights ro read the <code>ORA_DB<\/code> wallet to <code>CDB02<\/code> endpoint (database). <\/p>\n\n\n\n<p>I also use a simple sql script to check the wallet status at the database level:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\n&#x5B;oracle@db ~]$ cat $HOME\/tde.sql\n\nset pages 200\nset line 300\ncol WRL_PARAMETER format a50\ncol status forma a10\ncol pdb_name  format a20\nselect pdb_id, pdb_name, guid from dba_pdbs;\nselect * from v$encryption_wallet where con_id != 2;\n\n<\/pre><\/div>\n\n\n<h2 class=\"wp-block-heading\" id=\"h-declare-and-enrol-the-endpoint-for-cdb02\">Declare and enrol the endpoint for CDB02<\/h2>\n\n\n\n<p>The first step is the enrolment of the destination database, CDB02, and grant the rights to read the keys from OKV server.<\/p>\n\n\n\n<p>Create the destination directory structure for CDB02.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n&#x5B;oracle@db ~]$ cat $HOME\/okv\/set_okv_rest_env.sh\nexport OKV_RESTCLI_CONFIG=$HOME\/okv\/conf\nexport JAVA_HOME=\/usr\/java\/jdk-11.0.10\nexport OKV_HOME=$HOME\/okv\n\n# source the RESFul API environnement file \n&#x5B;oracle@db ~]$ source $HOME\/okv\/set_okv_rest_env.sh\n<\/pre><\/div>\n\n\n<p>Create the database endpoint, for <code>CDB02<\/code>,  using a JSON parameter file:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n# create the JSON file for endpoint creation\n&#x5B;oracle@db ~]$ cat 01.create_endpoint_CDB02.json\n{\n  &quot;service&quot; : {\n    &quot;category&quot; : &quot;admin&quot;,\n    &quot;resource&quot; : &quot;endpoint&quot;,\n    &quot;action&quot; : &quot;create&quot;,\n    &quot;options&quot; : {\n      &quot;endpoint&quot; : &quot;DB_CDB02&quot;,\n      &quot;description&quot; : &quot;DB server CDB02&quot;,\n      &quot;platform&quot; : &quot;LINUX64&quot;,\n      &quot;type&quot; : &quot;ORACLE_DB&quot;,\n      &quot;strictIpCheck&quot; : &quot;FALSE&quot;\n    }\n  }\n}\n\n# create the endpoint on OKV\n&#x5B;oracle@db ~]$ $OKV_HOME\/bin\/okv admin endpoint create --from-json 01.create_endpoint_CDB02.json\n{\n  &quot;result&quot; : &quot;Success&quot;\n}\n<\/pre><\/div>\n\n\n<p>Enrol the CDB02 endpoint.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n# create the enroll endpoint JSON file  \n&#x5B;oracle@db ~]$ cat 02.provision_endpoint_CDB02.json\n{\n  &quot;service&quot; : {\n    &quot;category&quot; : &quot;admin&quot;,\n    &quot;resource&quot; : &quot;endpoint&quot;,\n    &quot;action&quot; : &quot;provision&quot;,\n    &quot;options&quot; : {\n      &quot;endpoint&quot; : &quot;DB_CDB02&quot;,\n      &quot;location&quot; : &quot;\/opt\/oracle\/admin\/CDB02\/wallet\/okv&quot;,\n      &quot;autoLogin&quot; : &quot;FALSE&quot;\n    }\n  }\n}\n\n# enroll the endopoint\n&#x5B;oracle@db ~]$ $OKV_HOME\/bin\/okv admin endpoint provision --from-json 02.provision_endpoint_CDB02.json\nEnter Oracle Key Vault endpoint password: endpoint_pwd\n{\n  &quot;result&quot; : &quot;Success&quot;\n}\n<\/pre><\/div>\n\n\n<p>Grant the access to the new <code>CDB02<\/code> endpoint to read the wallet <code>ORA_DB<\/code> which keep the <code>CDB01<\/code> TDE keys.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n# create the grant access file to the wallet Keeping the source CDB01 Keys. \n&#x5B;oracle@db ~]$ cat 04_grant_access_wallet_CDB02.json\n{\n  &quot;service&quot; : {\n    &quot;category&quot; : &quot;manage-access&quot;,\n    &quot;resource&quot; : &quot;wallet&quot;,\n    &quot;action&quot; : &quot;add-access&quot;,\n    &quot;options&quot; : {\n      &quot;wallet&quot; : &quot;ORA_DB&quot;,\n      &quot;endpoint&quot; : &quot;DB_CDB02&quot;,\n      &quot;access&quot; : &quot;RM_MW&quot;\n    }\n  }\n}\n\n# grant the access to the ORA_DB wallet for the endpoint.\n&#x5B;oracle@db ~]$ $OKV_HOME\/bin\/okv manage-access wallet add-access --from-json 04_grant_access_wallet_CDB02.json\n{\n  &quot;result&quot; : &quot;Success&quot;\n}\n<\/pre><\/div>\n\n\n<p>Check that <code>CDB02<\/code> endpoint can read the keys from <code>CDB01<\/code> wallet.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n# Test \n&#x5B;oracle@db ~]$ \/opt\/oracle\/admin\/CDB02\/wallet\/okv\/bin\/okvutil list\nEnter Oracle Key Vault endpoint password: endpoint_pwd\nEnter Oracle Key Vault endpoint password:\nUnique ID                               Type            Identifier\n600D0743-01D9-4F2F-BF6F-C9E8AC74FF2A\tSymmetric Key\tTDE Master Encryption Key: TAG CDB:CDB01 MEK first\n6A752388-F93D-4F14-BF35-39E674CAAFED\tSymmetric Key\tTDE Master Encryption Key: TAG REKEY CDB01\nAB294686-1FC4-4FE8-BFAD-F56BAD0A124B\tSymmetric Key\tTDE Master Encryption Key: TAG REKEY CDB01\nBB0CC77A-10AD-4F55-BF0A-9F5A4C7F98C1\tSymmetric Key\tTDE Master Encryption Key: TAG CDB:DBTDEOKV:PDB1 MEK first\n\n<\/pre><\/div>\n\n\n<p>At this level  <code>okvutil list<\/code> for <code>CDB02<\/code> endpoint, command return the keys available for <code>CDB01<\/code> source database.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-clone-the-cdb01-to-cdb02\">Clone the CDB01 to CDB02<\/h2>\n\n\n\n<p>Create an temporary init file with the TDE OKV parameters.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n&#x5B;oracle@db ~]$ cat \/tmp\/init.ora\ndb_name=&#039;CDB02&#039;\nwallet_root=&#039;\/opt\/oracle\/admin\/CDB02\/wallet&#039;\ntde_configuration=&#039;KEYSTORE_CONFIGURATION=OKV|FILE&#039;;\nenable_pluggable_database=true\n<\/pre><\/div>\n\n\n<p>Copy the Oracle password file <code>\/opt\/oracle\/product\/19c\/dbhome_1\/dbs\/orapwdCDB01<\/code> to <code>\/opt\/oracle\/product\/19c\/dbhome_1\/dbs\/orapdwCDB02<\/code>.<\/p>\n\n\n\n<p>Add the <code>CDB02<\/code> as static identifier to the listener.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n&#x5B;oracle@db ~]$ cat $ORACLE_HOME\/network\/admin\/listener.ora\nLISTENER = (ADDRESS_LIST= (ADDRESS=(PROTOCOL=tcp)(HOST=db.sub05191447261.vcn01.oraclevcn.com)(PORT=1521)))\n\nSID_LIST_LISTENER=\n(SID_LIST=\n.....\n    (SID_DESC=\n        (GLOBAL_DBNAME=CDB02)\n        (SID_NAME=CDB02)\n        (ORACLE_HOME=\/opt\/oracle\/product\/19c\/dbhome_1)\n    )\n)\n\n# restart the listener\n&#x5B;oracle@db ~]$ lsnrctl start listener\n.....\nServices Summary...\nService &quot;CDB01&quot; has 1 instance(s).\n  Instance &quot;CDB01&quot;, status UNKNOWN, has 1 handler(s) for this service...\nService &quot;CDB02&quot; has 1 instance(s).\n  Instance &quot;CDB02&quot;, status UNKNOWN, has 1 handler(s) for this service...\nThe command completed successfully\n<\/pre><\/div>\n\n\n<p>Set the <code>CDB02<\/code> environnement and start the database using the temporary init file.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n&#x5B;oracle@db ~]$ . oraenv &lt;&lt;&lt; CDB02\n\n&#x5B;oracle@db ~]$ sqlplus \/ as sysdba\nSQL&gt; startup nomount pfile=&#039;\/tmp\/init.ora&#039;\nSQL&gt; exit;\n\n&#x5B;oracle@db ~]$ rman target sys\/sys_pwd@CDB01 auxiliary sys\/sys_pwd@CDB02\n\nconnected to target database: CDB01 (DBID=1690718290)\nconnected to auxiliary database: CDB02 (not mounted)\n\nRMAN&gt; run {\n  allocate auxiliary channel aux1 device type disk;\n  allocate auxiliary channel aux2 device type disk;\n\n  duplicate target database to CDB02 from active database\n  SPFILE \n  PARAMETER_VALUE_CONVERT &#039;CDB01&#039; &#039;CDB02&#039;\n  NOFILENAMECHECK;\n}\n\nusing target database control file instead of recovery catalog\nallocated channel: aux1\nchannel aux1: SID=180 device type=DISK\n\nallocated channel: aux2\nchannel aux2: SID=21 device type=DISK\n\nStarting Duplicate Db at 26-MAR-24\ncurrent log archived\n\ncontents of Memory Script:\n{\n   restore clone from service  &#039;CDB01&#039; spfile to\n &#039;\/opt\/oracle\/product\/19c\/dbhome_1\/dbs\/spfileCDB02.ora&#039;;\n   sql clone &quot;alter system set spfile= &#039;&#039;\/opt\/oracle\/product\/19c\/dbhome_1\/dbs\/spfileCDB02.ora&#039;&#039;&quot;;\n}\n.....\ncontents of Memory Script:\n{\n   Alter clone database open resetlogs;\n}\nexecuting Memory Script\n\ndatabase opened\n\ncontents of Memory Script:\n{\n   sql clone &quot;alter pluggable database all open&quot;;\n}\nexecuting Memory Script\n\nsql statement: alter pluggable database all open\nFinished Duplicate Db at 26-MAR-24\n\n<\/pre><\/div>\n\n\n<p>The clone is finished. Test the WALLET configuration<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\n&#x5B;oracle@db ~]$ . oraenv &lt;&lt;&lt; CDB02\n\n&#x5B;oracle@db ~]$ sqlplus \/ as sysdba\n\nSQL&gt; @$HOME\/tde\n\n    PDB_ID PDB_NAME\t\tGUID\n---------- -------------------- --------------------------------\n\t 3 PDB01\t\t0AE3AEC4EE5ACDB1E063A001A8ACB8BB\n\t 2 PDB$SEED\t\t0AE38C7FF01EC651E063A001A8AC821E\n\n\nWRL_TYPE  WRL_PARAMETER                         STATUS         WALLET_TYPE  WALLET_OR KEYSTORE FULLY_BAC CON_ID\n--------- ------------------------------------- -------------- ------------ --------- -------- --------- ----------\nFILE      \/opt\/oracle\/admin\/CDB02\/wallet\/tde\/   NOT_AVAILABLE  UNKNOWN        SINGLE   NONE     UNDEFINED    1\nOKV                                             CLOSED         UNKNOWN        SINGLE   NONE     UNDEFINED    1\nFILE                                            NOT_AVAILABLE  UNKNOWN        SINGLE   UNITED   UNDEFINED    3\nOKV                                             CLOSED         UNKNOWN        SINGLE   UNITED   UNDEFINED    3\n\n-- the wallet is closed. Open it: \n\nSQL&gt; administer key management set keystore open identified by &quot;endpoint_pwd&quot; container=all;\n\nkeystore altered.\n\nSQL&gt; @$HOME\/tde\n\n    PDB_ID PDB_NAME\t\tGUID\n---------- -------------------- --------------------------------\n\t 3 PDB01\t\t0AE3AEC4EE5ACDB1E063A001A8ACB8BB\n\t 2 PDB$SEED\t\t0AE38C7FF01EC651E063A001A8AC821E\n\n\nWRL_TYPE  WRL_PARAMETER                        STATUS       WALLET_TYPE  WALLET_OR KEYSTORE FULLY_BAC  CON_ID\n--------- ------------------------------------ ---------- -------------- --------- -------- --------- ----------\nFILE      \/opt\/oracle\/admin\/CDB02\/wallet\/tde\/  OPEN_NO_MA    AUTOLOGIN    SINGLE    NONE    UNDEFINED    1\n                                               STER_KEY\nOKV                                            OPEN          OKV          SINGLE    NONE    UNDEFINED    1\nFILE                                           OPEN_NO_MA    AUTOLOGIN    SINGLE    UNITED  UNDEFINED    3\n                                               STER_KEY\nOKV                                            OPEN          OKV          SINGLE    UNITED  UNDEFINED    3\n<\/pre><\/div>\n\n\n<p>Finally create the auto login wallet, and restart the cloned database to validate the configuration.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\n&#x5B;oracle@db ~]$ . oraenv &lt;&lt;&lt; CDB02\n\n&#x5B;oracle@db ~]$ sqlplus \/ as sysdba\n-- &quot;OKV_PASSWORD&quot; is used to open the wallet. \n-- &quot;HSM_PASSWORD&quot; is used to access the OKV server(s).\nSQL&gt; ADMINISTER KEY MANAGEMENT ADD SECRET &#039;endpoint_pwd&#039; FOR CLIENT &#039;HSM_PASSWORD&#039; TO AUTO_LOGIN KEYSTORE &#039;\/opt\/oracle\/admin\/CDB02\/wallet\/tde&#039;;\n\n-- check that the autologin wallet was created \nSQL&gt; !ls \/opt\/oracle\/admin\/CDB02\/wallet\/tde\ncwallet.sso \n\nSQL&gt; startup force\n\nSQL&gt; show pdbs\n\n    CON_ID CON_NAME\t\t\t  OPEN MODE  RESTRICTED\n---------- ------------------------------ ---------- ----------\n\t 2 PDB$SEED\t\t\t  READ ONLY  NO\n\t 3 PDB01\t\t\t  MOUNTED\n\nSQL&gt; alter pluggable database PDB01 open;\n\nPluggable database altered.\n\nSQL&gt; @$HOME\/tde\n\n    PDB_ID PDB_NAME\t\tGUID\n---------- -------------------- --------------------------------\n\t 3 PDB01\t\t0AE3AEC4EE5ACDB1E063A001A8ACB8BB\n\t 2 PDB$SEED\t\t0AE38C7FF01EC651E063A001A8AC821E\n\n\nWRL_TYPE  WRL_PARAMETER                        STATUS       WALLET_TYPE  WALLET_OR KEYSTORE FULLY_BAC  CON_ID\n--------- ------------------------------------ ---------- -------------- --------- -------- --------- ----------\nFILE      \/opt\/oracle\/admin\/CDB02\/wallet\/tde\/  OPEN_NO_MA    AUTOLOGIN    SINGLE    NONE    UNDEFINED    1\n                                               STER_KEY\nOKV                                            OPEN          OKV          SINGLE    NONE    UNDEFINED    1\nFILE                                           OPEN_NO_MA    AUTOLOGIN    SINGLE    UNITED  UNDEFINED    3\n                                               STER_KEY\nOKV                                            OPEN          OKV          SINGLE    UNITED  UNDEFINED    3\n<\/pre><\/div>\n\n\n<p>All PDB are correctly opened and the wallet are opened too.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-conclusion\">Conclusion<\/h2>\n\n\n\n<p>The clone process can be fully automatised, and no wallet file must be transfered between the source and the destination server. With the keys in OKV the clone process is identically as withouth OKV. Keeping the keys in OKV is more secure as the principle &#8220;Zero touch keys&#8221; is respected, and DBA do not manipulate the keys.<\/p>\n\n\n\n<p>Finally if we want to configure the database <code>CDB02<\/code> to use another keys as the keys from <code>CDB01<\/code>, we can execute a REKEY operation.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>How to clone an Oracle Database which is configured to store the TDE (encryption keys) in the Oracle Key Vault (OKV)<\/p>\n","protected":false},"author":27,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[198,59,149],"tags":[3153,96],"type_dbi":[],"class_list":["post-32117","post","type-post","status-publish","format-standard","hentry","category-database-management","category-oracle","category-security","tag-okv","tag-oracle"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.2 (Yoast SEO v27.2) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Clone Oracle Database configured with Oracle Key Vault (OKV) - dbi Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Clone Oracle Database configured with Oracle Key Vault (OKV)\" \/>\n<meta property=\"og:description\" content=\"How to clone an Oracle Database which is configured to store the TDE (encryption keys) in the Oracle Key Vault (OKV)\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2024-03-27T16:29:34+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-01-24T09:42:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2024\/03\/2024-03-27_17-43-51.png\" \/>\n\t<meta property=\"og:image:width\" content=\"672\" \/>\n\t<meta property=\"og:image:height\" content=\"552\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Oracle Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Oracle Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/\"},\"author\":{\"name\":\"Oracle Team\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee\"},\"headline\":\"Clone Oracle Database configured with Oracle Key Vault (OKV)\",\"datePublished\":\"2024-03-27T16:29:34+00:00\",\"dateModified\":\"2025-01-24T09:42:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/\"},\"wordCount\":532,\"commentCount\":3,\"image\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2024\/03\/2024-03-27_17-43-51.png\",\"keywords\":[\"OKV\",\"Oracle\"],\"articleSection\":[\"Database management\",\"Oracle\",\"Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/\",\"name\":\"Clone Oracle Database configured with Oracle Key Vault (OKV) - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2024\/03\/2024-03-27_17-43-51.png\",\"datePublished\":\"2024-03-27T16:29:34+00:00\",\"dateModified\":\"2025-01-24T09:42:07+00:00\",\"author\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/#primaryimage\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2024\/03\/2024-03-27_17-43-51.png\",\"contentUrl\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2024\/03\/2024-03-27_17-43-51.png\",\"width\":672,\"height\":552},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/www.dbi-services.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Clone Oracle Database configured with Oracle Key Vault (OKV)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee\",\"name\":\"Oracle Team\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g\",\"caption\":\"Oracle Team\"},\"url\":\"https:\/\/www.dbi-services.com\/blog\/author\/oracle-team\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Clone Oracle Database configured with Oracle Key Vault (OKV) - dbi Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/","og_locale":"en_US","og_type":"article","og_title":"Clone Oracle Database configured with Oracle Key Vault (OKV)","og_description":"How to clone an Oracle Database which is configured to store the TDE (encryption keys) in the Oracle Key Vault (OKV)","og_url":"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/","og_site_name":"dbi Blog","article_published_time":"2024-03-27T16:29:34+00:00","article_modified_time":"2025-01-24T09:42:07+00:00","og_image":[{"width":672,"height":552,"url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2024\/03\/2024-03-27_17-43-51.png","type":"image\/png"}],"author":"Oracle Team","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Oracle Team","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/"},"author":{"name":"Oracle Team","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee"},"headline":"Clone Oracle Database configured with Oracle Key Vault (OKV)","datePublished":"2024-03-27T16:29:34+00:00","dateModified":"2025-01-24T09:42:07+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/"},"wordCount":532,"commentCount":3,"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2024\/03\/2024-03-27_17-43-51.png","keywords":["OKV","Oracle"],"articleSection":["Database management","Oracle","Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/","url":"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/","name":"Clone Oracle Database configured with Oracle Key Vault (OKV) - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/#primaryimage"},"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2024\/03\/2024-03-27_17-43-51.png","datePublished":"2024-03-27T16:29:34+00:00","dateModified":"2025-01-24T09:42:07+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee"},"breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/#primaryimage","url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2024\/03\/2024-03-27_17-43-51.png","contentUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2024\/03\/2024-03-27_17-43-51.png","width":672,"height":552},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/clone-oracle-database-configured-with-oracle-key-vault-okv\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Clone Oracle Database configured with Oracle Key Vault (OKV)"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee","name":"Oracle Team","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g","caption":"Oracle Team"},"url":"https:\/\/www.dbi-services.com\/blog\/author\/oracle-team\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/32117","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=32117"}],"version-history":[{"count":10,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/32117\/revisions"}],"predecessor-version":[{"id":36865,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/32117\/revisions\/36865"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=32117"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=32117"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=32117"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=32117"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}