Skip to content

Commit 4ceb62b

Browse files
lzwjavalzwjava
committed
docs(notes): add oracle, mysql, and websphere docs
1 parent bb357a1 commit 4ceb62b

3 files changed

+322
-0
lines changed

‎notes/2025-03-25-oracle-account-en.md

+145
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
---
2+
title: Oracle Database - User Account
3+
lang: en
4+
layout: post
5+
audio: false
6+
translated: false
7+
generated: true
8+
---
9+
10+
The `ORA-28000: The account is locked` error occurs when attempting to connect to an Oracle database (e.g., via a thin JDBC driver) and the user account you’re trying to use has been locked. This typically happens due to too many failed login attempts, manual locking by an administrator, or an account expiration policy. To resolve this, you need to unlock the account, and if necessary, reset the password or check the account status. Below are the steps to fix this issue when connecting to an Oracle database.
11+
12+
---
13+
14+
### Steps to Fix ORA-28000
15+
16+
#### 1. **Verify the Error**
17+
When you encounter this error in a JDBC connection, it might look like this:
18+
```
19+
java.sql.SQLException: ORA-28000: The account is locked
20+
```
21+
This confirms the issue is with the database account, not the JDBC configuration itself (e.g., URL, driver, or WebSphere datasource settings).
22+
23+
#### 2. **Log in as a Privileged User**
24+
To unlock the account, you need access to a database user with administrative privileges (e.g., `SYS`, `SYSTEM`, or a user with `DBA` role). Connect to the database using a tool like SQL*Plus, SQL Developer, or a JDBC client:
25+
```bash
26+
sqlplus / as sysdba
27+
```
28+
OR
29+
```bash
30+
sqlplus system/<password>@<service_name>
31+
```
32+
Replace `<password>` and `<service_name>` with your actual credentials and database service name (e.g., `ORCL`).
33+
34+
#### 3. **Check the Account Status**
35+
Run the following SQL query to check the status of the locked account:
36+
```sql
37+
SELECT username, account_status, lock_date
38+
FROM dba_users
39+
WHERE username = 'YOUR_USERNAME';
40+
```
41+
- Replace `YOUR_USERNAME` with the username you’re trying to connect with (e.g., `myuser`).
42+
- Look at the `ACCOUNT_STATUS` column. If it says `LOCKED` or `LOCKED(TIMED)`, the account is locked.
43+
44+
Example output:
45+
```
46+
USERNAME ACCOUNT_STATUS LOCK_DATE
47+
---------- ---------------- -------------------
48+
MYUSER LOCKED 24-MAR-25 10:00:00
49+
```
50+
51+
#### 4. **Unlock the Account**
52+
To unlock the account, execute this SQL command as the privileged user:
53+
```sql
54+
ALTER USER your_username ACCOUNT UNLOCK;
55+
```
56+
Example:
57+
```sql
58+
ALTER USER myuser ACCOUNT UNLOCK;
59+
```
60+
61+
#### 5. **(Optional) Reset the Password**
62+
If the password might have expired or you suspect it’s incorrect, reset it while you’re at it:
63+
```sql
64+
ALTER USER your_username IDENTIFIED BY new_password;
65+
```
66+
Example:
67+
```sql
68+
ALTER USER myuser IDENTIFIED BY mynewpass123;
69+
```
70+
- After resetting, update the password in your WebSphere `server.xml` (or wherever the JDBC datasource is configured) and re-encrypt it if necessary (see your previous question for AES encoding steps).
71+
72+
#### 6. **Commit Changes (If Required)**
73+
In most cases, `ALTER USER` commands take effect immediately and don’t require a `COMMIT`. However, if you’re in a transaction-heavy environment, ensure no rollback occurs by restarting the session or the database if needed.
74+
75+
#### 7. **Test the Connection**
76+
Try connecting again using your JDBC application or a simple test:
77+
```java
78+
import java.sql.Connection;
79+
import java.sql.DriverManager;
80+
81+
public class TestJDBC {
82+
public static void main(String[] args) throws Exception {
83+
String url = "jdbc:oracle:thin:@//localhost:1521/ORCL";
84+
String user = "myuser";
85+
String password = "mynewpass123";
86+
Connection conn = DriverManager.getConnection(url, user, password);
87+
System.out.println("Connection successful!");
88+
conn.close();
89+
}
90+
}
91+
```
92+
- Update the `url`, `user`, and `password` to match your environment.
93+
- If this works, update your WebSphere datasource configuration accordingly.
94+
95+
#### 8. **Check for Profile Policies (Prevent Future Locks)**
96+
The account might have locked due to a security policy in the user’s profile (e.g., `FAILED_LOGIN_ATTEMPTS` or `PASSWORD_LOCK_TIME`). Check the profile assigned to the user:
97+
```sql
98+
SELECT profile
99+
FROM dba_users
100+
WHERE username = 'YOUR_USERNAME';
101+
```
102+
Then, inspect the profile’s limits:
103+
```sql
104+
SELECT resource_name, limit
105+
FROM dba_profiles
106+
WHERE profile = 'YOUR_PROFILE_NAME';
107+
```
108+
Look for:
109+
- `FAILED_LOGIN_ATTEMPTS`: Number of failed attempts before locking (e.g., `10`).
110+
- `PASSWORD_LOCK_TIME`: Duration of the lock (e.g., `1` day).
111+
112+
To relax these settings (if appropriate), modify the profile:
113+
```sql
114+
ALTER PROFILE your_profile_name LIMIT
115+
FAILED_LOGIN_ATTEMPTS UNLIMITED
116+
PASSWORD_LOCK_TIME UNLIMITED;
117+
```
118+
Example:
119+
```sql
120+
ALTER PROFILE DEFAULT LIMIT FAILED_LOGIN_ATTEMPTS UNLIMITED;
121+
```
122+
123+
#### 9. **Restart WebSphere (If Needed)**
124+
If you’re using WebSphere and updated the datasource password, restart the application server to ensure the changes take effect:
125+
- For Liberty: `./bin/server stop` and `./bin/server start`.
126+
- For traditional WebSphere: Use the Admin Console or `stopServer.sh`/`startServer.sh`.
127+
128+
---
129+
130+
### Common Causes of ORA-28000
131+
- **Too Many Failed Login Attempts**: Check application logs or WebSphere logs (e.g., `SystemOut.log`) for prior connection errors.
132+
- **Manual Lock**: An admin might have locked the account intentionally (`ALTER USER myuser ACCOUNT LOCK`).
133+
- **Expired Account**: Some environments lock accounts when passwords expire. Check `EXPIRY_DATE` in `dba_users`.
134+
135+
---
136+
137+
### Troubleshooting Tips
138+
- If you don’t have `SYS` or `SYSTEM` access, contact your database administrator to unlock the account.
139+
- Ensure the JDBC URL, username, and password in `server.xml` are correct before retrying.
140+
- If the issue persists, verify the Oracle listener is running:
141+
```bash
142+
lsnrctl status
143+
```
144+
145+
Let me know if you encounter additional errors or need help with a specific step!

‎notes/2025-03-25-oracle-mysql-en.md

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
---
2+
title: General Differences Between Oracle DB and MySQL
3+
lang: en
4+
layout: post
5+
audio: false
6+
translated: false
7+
generated: true
8+
---
9+
10+
Oracle Database and MySQL are both powerful relational database management systems (RDBMS), but they differ significantly in architecture, features, and use cases. Below, I’ll outline their general differences and then dive into how they compare in terms of schema design and database design.
11+
12+
1. **Ownership and Licensing**:
13+
- **Oracle DB**: A commercial product owned by Oracle Corporation. It’s enterprise-grade, with licensing costs that can be substantial, though it offers a free tier (Oracle Database Express Edition).
14+
- **MySQL**: Open-source under the GNU General Public License, with a community edition that’s free. There’s also a commercial version supported by Oracle Corporation, but it’s far less expensive than Oracle DB.
15+
16+
2. **Performance and Scalability**:
17+
- **Oracle DB**: Designed for high-performance, large-scale enterprise applications. It excels in handling complex transactions, massive datasets, and high concurrency.
18+
- **MySQL**: Lightweight and optimized for simpler, web-based applications. It scales well horizontally (e.g., with replication), but it’s less suited for extremely complex enterprise workloads compared to Oracle.
19+
20+
3. **Features**:
21+
- **Oracle DB**: Offers advanced features like Real Application Clusters (RAC) for high availability, partitioning, advanced analytics, and extensive security options.
22+
- **MySQL**: Simpler feature set, focusing on ease of use, speed, and replication. It supports fewer advanced enterprise features out of the box but has plugins/extensions (e.g., InnoDB for transactions).
23+
24+
4. **Architecture**:
25+
- **Oracle DB**: Multi-process, multi-threaded architecture with a shared-everything design (memory and disk). Highly configurable.
26+
- **MySQL**: Simpler, multi-threaded architecture, typically using a shared-nothing design in replication setups. Less configurable but easier to set up.
27+
28+
5. **Use Case**:
29+
- **Oracle DB**: Preferred for mission-critical enterprise systems (e.g., banking, telecom).
30+
- **MySQL**: Popular for web applications, startups, and small-to-medium-sized businesses (e.g., WordPress, e-commerce platforms).
31+
32+
---
33+
34+
### Schema Design and Database Design Differences
35+
36+
Schema design and database design refer to how data is structured, stored, and managed within the database. Here’s how Oracle DB and MySQL differ in these areas:
37+
38+
#### 1. **Data Types**:
39+
- **Oracle DB**: Offers a richer set of data types, including proprietary ones like `VARCHAR2` (preferred over `VARCHAR`), `CLOB` (Character Large Object), `BLOB` (Binary Large Object), and `RAW`. It also supports user-defined types and object-relational features.
40+
- **MySQL**: Has a simpler, more standard set of data types (e.g., `VARCHAR`, `TEXT`, `BLOB`, `INT`). It lacks some of Oracle’s advanced or proprietary types but supports JSON and spatial data types in newer versions.
41+
42+
**Impact on Design**: Oracle’s flexibility with data types allows for more complex schema designs, especially in applications requiring custom objects or large binary data. MySQL’s simpler types favor straightforward designs.
43+
44+
#### 2. **Schema Structure**:
45+
- **Oracle DB**: Uses a schema tied to a user by default (e.g., each user has their own schema). It supports multiple schemas within a single database instance, making it ideal for multi-tenant applications. You can also create tablespaces for physical storage management.
46+
- **MySQL**: Treats a "database" as a schema (one database = one schema). Multiple databases can exist on a server, but they’re logically separate, with no inherent multi-tenant structure like Oracle’s schemas.
47+
48+
**Impact on Design**: Oracle’s schema-user model and tablespaces allow for more granular control over data organization and storage, which is useful for complex systems. MySQL’s simpler database-per-schema approach is easier for smaller, isolated applications.
49+
50+
#### 3. **Constraints and Integrity**:
51+
- **Oracle DB**: Enforces strict data integrity with extensive support for primary keys, foreign keys, unique constraints, and check constraints. It also supports deferred constraints (checked at commit time rather than immediately).
52+
- **MySQL**: Supports similar constraints, but enforcement depends on the storage engine (e.g., InnoDB supports foreign keys, MyISAM does not). Deferred constraints are not natively supported.
53+
54+
**Impact on Design**: Oracle’s robust constraint system suits designs requiring high data integrity (e.g., financial systems). MySQL’s flexibility with engines allows trade-offs between speed and integrity, affecting schema complexity.
55+
56+
#### 4. **Indexing**:
57+
- **Oracle DB**: Offers advanced indexing options like B-tree, bitmap, function-based, and domain indexes. It also supports index-organized tables (IOTs) where the table itself is an index.
58+
- **MySQL**: Primarily uses B-tree indexes (InnoDB) and full-text indexes (MyISAM). Fewer advanced options but sufficient for most web-scale needs.
59+
60+
**Impact on Design**: Oracle’s indexing capabilities allow for optimized performance in complex queries, influencing schema design toward normalized structures. MySQL’s simpler indexing may push designs toward denormalization for performance.
61+
62+
#### 5. **Partitioning**:
63+
- **Oracle DB**: Native support for partitioning (range, list, hash, composite) at the table and index level, improving performance and manageability for large datasets.
64+
- **MySQL**: Introduced partitioning later (range, list, hash, key), but it’s less mature and not as widely used. It’s also engine-dependent (e.g., InnoDB only).
65+
66+
**Impact on Design**: Oracle’s partitioning encourages designs that split large tables for scalability, while MySQL’s limitations might lead to simpler, smaller tables or reliance on sharding.
67+
68+
#### 6. **Transactions and Concurrency**:
69+
- **Oracle DB**: Uses multi-version concurrency control (MVCC) with a "read-consistent" model, avoiding dirty reads entirely. Supports complex, long-running transactions.
70+
- **MySQL**: Also uses MVCC (with InnoDB), but concurrency control varies by engine. MyISAM, for example, uses table-level locking, which can limit concurrency.
71+
72+
**Impact on Design**: Oracle’s transaction model supports intricate designs with heavy relational dependencies. MySQL’s engine variability might influence designers to prioritize simplicity or choose InnoDB for transactional integrity.
73+
74+
#### 7. **Stored Procedures and Triggers**:
75+
- **Oracle DB**: Robust support for PL/SQL, a powerful procedural language for stored procedures, functions, and triggers. It’s deeply integrated into the database.
76+
- **MySQL**: Supports stored procedures and triggers in a simpler SQL-based language, but it’s less feature-rich than PL/SQL.
77+
78+
**Impact on Design**: Oracle’s PL/SQL encourages embedding business logic in the database, affecting schema complexity. MySQL’s lighter approach pushes logic to the application layer.
79+
80+
---
81+
82+
### Summary for Schema/Database Design
83+
- **Oracle DB**: Suited for complex, highly relational, and normalized designs with advanced features like partitioning, custom types, and strict integrity. It’s ideal for enterprise systems where scalability, performance, and control are paramount.
84+
- **MySQL**: Favors simpler, often denormalized designs for speed and ease of use. It’s better for applications where rapid development and lightweight deployment trump advanced features.
85+
86+
If you’re designing a schema, Oracle gives you more tools to optimize and fine-tune, while MySQL keeps things lean and straightforward. The choice depends on your project’s scale, budget, and complexity requirements. Let me know if you’d like examples of schema designs for either!

‎notes/2025-03-25-websphere-aes-en.md

+91
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
---
2+
title: Websphere AES Password
3+
lang: en
4+
layout: post
5+
audio: false
6+
translated: false
7+
generated: true
8+
---
9+
10+
In WebSphere Application Server, passwords in configuration files like `server.xml` (for Liberty) or other XML configuration files (e.g., `resources.xml`, `security.xml` in traditional WebSphere) are often encrypted using AES (Advanced Encryption Standard) when security utilities are employed. If the password in your `server.xml` file for an Oracle JDBC datasource is in AES-encrypted format, it typically appears with an `{aes}` prefix, such as `{aes}YSPuwMQqjeo/DlSNYnUZ3E6z6WLVmEaAtDmMaFg6JCY=`. To decode this password, you need to use WebSphere's built-in tools or APIs, as the encryption is tied to a specific encryption key managed by the server.
11+
12+
Here’s how you can decode an AES-encrypted password from a WebSphere `server.xml` file:
13+
14+
### Steps to Decode the Password
15+
16+
1. **Understand the Encryption Context**
17+
WebSphere Liberty (and traditional WebSphere) uses an encryption key stored in the server's configuration to encrypt and decrypt sensitive data like passwords. In Liberty, this key is typically managed via the `securityUtility` tool or embedded in the server's configuration. The AES-encrypted password cannot be decrypted without access to this key, which is unique to the WebSphere instance.
18+
19+
2. **Locate the Encrypted Password**
20+
In your `server.xml` file, find the Oracle JDBC datasource configuration. It might look something like this:
21+
```xml
22+
<dataSource id="oracleDS" jndiName="jdbc/oracleDS">
23+
<jdbcDriver libraryRef="OracleLib"/>
24+
<properties.oracle url="jdbc:oracle:thin:@//localhost:1521/ORCL"
25+
user="myuser"
26+
password="{aes}YSPuwMQqjeo/DlSNYnUZ3E6z6WLVmEaAtDmMaFg6JCY="/>
27+
</dataSource>
28+
```
29+
The `password` attribute contains the AES-encrypted value.
30+
31+
3. **Use WebSphere Liberty’s `securityUtility` Tool**
32+
WebSphere Liberty provides the `securityUtility` command-line tool to encode and decode passwords. To decode an AES-encrypted password:
33+
- Navigate to your WebSphere Liberty installation directory (e.g., `/opt/ibm/wlp`).
34+
- Run the `securityUtility` command with the `decode` option:
35+
```bash
36+
bin/securityUtility decode --encoding=aes "YSPuwMQqjeo/DlSNYnUZ3E6z6WLVmEaAtDmMaFg6JCY="
37+
```
38+
- **Important Note**: You must run this command from the specific Liberty server instance where the password was originally encrypted, as it relies on the server’s encryption key (stored in files like `bootstrap.properties` or `server.xml` under the `keyStore` configuration). If the key has been customized, you may need to specify the `--key` parameter with the encryption key value.
39+
40+
If successful, the tool will output the decrypted password.
41+
42+
4. **Alternative: Use a Java Program with WebSphere APIs**
43+
If you’re working with a traditional WebSphere Application Server or need programmatic access, you can use the `com.ibm.websphere.crypto.PasswordUtil` class to decode the password. Here’s an example:
44+
```java
45+
import com.ibm.websphere.crypto.PasswordUtil;
46+
47+
public class DecodePassword {
48+
public static void main(String[] args) {
49+
String encodedPassword = "{aes}YSPuwMQqjeo/DlSNYnUZ3E6z6WLVmEaAtDmMaFg6JCY=";
50+
try {
51+
String decodedPassword = PasswordUtil.decode(encodedPassword);
52+
System.out.println("Decoded Password: " + decodedPassword);
53+
} catch (Exception e) {
54+
System.err.println("Error decoding password: " + e.getMessage());
55+
}
56+
}
57+
}
58+
```
59+
- **Requirements**:
60+
- This must be run in an environment with WebSphere libraries (e.g., `ws_runtime.jar`) in the classpath.
61+
- The program must execute within the WebSphere server context or have access to the encryption key used by the server.
62+
- For traditional WebSphere, you can find the required JARs in `<WAS_HOME>/AppServer/plugins/`.
63+
64+
5. **Handling Key Management**
65+
- In Liberty, the default AES key is derived from the server’s configuration. If a custom key was used (e.g., specified in `server.xml` via `<variable name="wlp.password.encryption.key" value="yourCustomKey"/>`), you’ll need to provide it to the `securityUtility` tool or your Java code.
66+
- In traditional WebSphere, the encryption key is tied to the `SerializedSystemIni` service, and decoding must occur within the server’s runtime environment.
67+
68+
6. **Verify the Decoded Password**
69+
Once decoded, test the password by connecting to the Oracle database using a tool like SQL*Plus or a simple JDBC test program to ensure it works:
70+
```java
71+
import java.sql.Connection;
72+
import java.sql.DriverManager;
73+
74+
public class TestJDBC {
75+
public static void main(String[] args) throws Exception {
76+
String url = "jdbc:oracle:thin:@//localhost:1521/ORCL";
77+
String user = "myuser";
78+
String password = "decoded_password_here";
79+
Connection conn = DriverManager.getConnection(url, user, password);
80+
System.out.println("Connection successful!");
81+
conn.close();
82+
}
83+
}
84+
```
85+
86+
### Key Considerations
87+
- **Security**: Decoding passwords exposes sensitive information, so perform this operation in a secure environment and avoid logging or storing the plaintext password unnecessarily.
88+
- **Server-Specific Encryption**: The AES encryption is tied to the specific WebSphere instance. You cannot decode the password on a different server unless you replicate the encryption key and configuration.
89+
- **Liberty vs. Traditional WebSphere**: The process differs slightly between Liberty and traditional WebSphere. Liberty relies on `securityUtility`, while traditional WebSphere often uses the `PasswordDecoder` class or similar utilities.
90+
91+
If you’re unable to decode the password (e.g., due to missing keys or incorrect server context), you may need to re-encrypt a new password using the same WebSphere instance and update the `server.xml` file accordingly. Let me know if you need further assistance with your specific setup!

0 commit comments

Comments
 (0)