Oracle ATP Private Endpoint & Wallet: Secure Database Access

Overview: Securing Oracle PeopleSoft with Autonomous Transaction Processing and Private Endpoints

In the dynamic landscape of enterprise resource planning, Oracle PeopleSoft remains a cornerstone for many organizations, managing critical HR, finance, and campus solutions. As these systems evolve, the underlying infrastructure must keep pace, offering not just performance and scalability but also uncompromising security. Oracle Autonomous Transaction Processing (ATP) on Oracle Cloud Infrastructure (OCI) presents a compelling solution for PeopleSoft's database needs, providing a fully managed, self-driving, self-securing, and self-repairing database service.

While ATP inherently offers robust security features, deploying it with a private endpoint significantly elevates the security posture, especially for sensitive applications like PeopleSoft. A private endpoint ensures that all network traffic between your PeopleSoft application servers and the ATP database remains entirely within your Virtual Cloud Network (VCN) and OCI's private network backbone, never traversing the public internet. This architecture is paramount for compliance, data privacy, and mitigating external threat vectors.

Coupled with the use of mTLS (mutual Transport Layer Security) wallets, this setup creates a highly secure communication channel. The wallet contains the necessary connection credentials and certificates, ensuring that only authenticated and authorized clients can establish a connection to the ATP database. For PeopleSoft environments, where data integrity and confidentiality are non-negotiable, this combination of ATP, private endpoints, and mTLS wallets provides an enterprise-grade, secure, and performant foundation.

This article, targeted at Oracle DBAs, cloud architects, and PeopleSoft administrators, will delve into the practical implementation of Oracle Autonomous Transaction Processing with a private endpoint, leveraging the security benefits of mTLS wallets. We will walk through the entire process, from setting up the necessary OCI network components to configuring your PeopleSoft application servers for secure, private connectivity, ensuring your PeopleSoft environment is both performant and impenetrable.

Prerequisites for a Secure PeopleSoft ATP Deployment

Before embarking on the journey of deploying Oracle Autonomous Transaction Processing with a private endpoint for your PeopleSoft application, several foundational elements must be in place within your Oracle Cloud Infrastructure tenancy. Adhering to these prerequisites ensures a smooth implementation and a robust, secure environment.

• Oracle Cloud Infrastructure (OCI) Tenancy and Compartment

  You must have an active OCI tenancy with appropriate administrative privileges. It is highly recommended to create a dedicated compartment for your PeopleSoft ATP database and related network resources. This adheres to the principle of least privilege and simplifies resource management and access control policies.

  
  # Example OCI CLI command to create a compartment
  oci identity compartment create --name "PeopleSoft_Prod_Compartment" \
      --description "Compartment for PeopleSoft Production Resources" \
      --compartment-id ocid1.compartment.oc1..aaaaaaaalexmpleparentcompartmentid
          

• Virtual Cloud Network (VCN)

  A VCN is the fundamental building block for your cloud network. You'll need a VCN with a non-overlapping CIDR block. For a PeopleSoft deployment, you'll typically have several subnets within this VCN: one for your PeopleSoft application servers, one for your ATP private endpoint, and potentially others for load balancers, web servers, etc. Ensure the VCN is properly configured with an Internet Gateway (for outbound access if needed) and, critically, a Service Gateway.

  
  # Example OCI CLI command to create a VCN
  oci network vcn create --compartment-id ocid1.compartment.oc1..aaaaaaaalexmplecompartmentid \
      --cidr-block "10.0.0.0/16" \
      --display-name "PeopleSoft_VCN" \
      --dns-label "peoplesoftvcn" \
      --wait-for-state AVAILABLE
          

• Subnets

  You will need at least two private subnets within your VCN:

  • PeopleSoft Application Subnet: This subnet will host your PeopleSoft application servers (e.g., PSAPPSRV, PSQASRV, PSPRCSRV). It should be a private subnet. Example CIDR: `10.0.1.0/24`.
  • ATP Private Endpoint Subnet: This subnet will host the private endpoint for your Autonomous Transaction Processing database. It must also be a private subnet. Example CIDR: `10.0.2.0/24`.

  
  # Example OCI CLI command to create a private subnet for PeopleSoft App Servers
  oci network subnet create --compartment-id ocid1.compartment.oc1..aaaaaaaalexmplecompartmentid \
      --vcn-id ocid1.vcn.oc1.iad.aaaaaaaalexmplevcnid \
      --cidr-block "10.0.1.0/24" \
      --display-name "PeopleSoft_App_Subnet" \
      --prohibit-public-ip-on-vnic true \
      --wait-for-state AVAILABLE
  
  # Example OCI CLI command to create a private subnet for ATP Private Endpoint
  oci network subnet create --compartment-id ocid1.compartment.oc1..aaaaaaaalexmplecompartmentid \
      --vcn-id ocid1.vcn.oc1.iad.aaaaaaaalexmplevcnid \
      --cidr-block "10.0.2.0/24" \
      --display-name "ATP_Private_Endpoint_Subnet" \
      --prohibit-public-ip-on-vnic true \
      --wait-for-state AVAILABLE
          

• Service Gateway

  A Service Gateway is essential for privately connecting your VCN to other OCI services, such as Oracle Object Storage (where ATP stores backups and where the wallet is retrieved from) without routing traffic over the public internet. This is a critical component for a private endpoint setup.

  
  # Example OCI CLI command to create a Service Gateway
  # First, get the VCN's service CIDR block for OCI services
  oci network service-gateway create --compartment-id ocid1.compartment.oc1..aaaaaaaalexmplecompartmentid \
      --vcn-id ocid1.vcn.oc1.iad.aaaaaaaalexmplevcnid \
      --services '[{"serviceId": "ocid1.service.oc1.iad.aaaaaaaalexmpleserviceid", "serviceName": "All IAD Services in Oracle Services Network"}]' \
      --display-name "PeopleSoft_Service_Gateway" \
      --wait-for-state AVAILABLE
          

  You'll also need a corresponding Route Rule in your private subnets' route tables to direct traffic for OCI services through this Service Gateway.

• Security Lists or Network Security Groups (NSGs)

  Properly configured security rules are vital. You'll need rules to allow:

  • Ingress on TCP port 1522 (or 1521, depending on your ATP configuration) from the PeopleSoft Application Subnet to the ATP Private Endpoint Subnet.
  • Egress from the PeopleSoft Application Subnet to the ATP Private Endpoint Subnet on TCP port 1522.
  • Egress from the ATP Private Endpoint Subnet to OCI Object Storage via the Service Gateway.

• OCI CLI Configured

  Ensure you have the Oracle Cloud Infrastructure CLI installed and configured on your local machine or a bastion host, with appropriate authentication credentials (API Key). This will be used for creating and managing resources.

Step-by-Step Implementation: Deploying ATP with Private Endpoint for PeopleSoft

This section will guide you through the detailed steps to set up Oracle Autonomous Transaction Processing with a private endpoint, specifically tailored for a PeopleSoft environment. We'll use OCI CLI commands for precision and automation.

1. Create Network Security Groups (NSGs)

Instead of Security Lists, we will leverage Network Security Groups (NSGs) for more granular control, especially when dealing with private endpoints. NSGs allow you to define security rules directly on the VNICs of your ATP database and PeopleSoft application servers, making it easier to manage.

# Get VCN OCID (assuming you created it earlier)
VCN_OCID=$(oci network vcn list --compartment-id ocid1.compartment.oc1..aaaaaaaalexmplecompartmentid --display-name "PeopleSoft_VCN" --query "data[0].id" --raw-output)

# NSG for ATP Private Endpoint
oci network nsg create --compartment-id ocid1.compartment.oc1..aaaaaaaalexmplecompartmentid \
    --vcn-id $VCN_OCID \
    --display-name "NSG_ATP_Private_Endpoint" \
    --wait-for-state AVAILABLE

# NSG for PeopleSoft Application Servers
oci network nsg create --compartment-id ocid1.compartment.oc1..aaaaaaaalexmplecompartmentid \
    --vcn-id $VCN_OCID \
    --display-name "NSG_PeopleSoft_App_Servers" \
    --wait-for-state AVAILABLE

2. Configure NSG Rules

Now, let's add the necessary ingress and egress rules to these NSGs. The key is to allow traffic on port 1522 (or 1521, depending on your ATP's service port) between the PeopleSoft App Server NSG and the ATP Private Endpoint NSG.

# Get NSG OCIDs
NSG_ATP_PE_OCID=$(oci network nsg list --compartment-id ocid1.compartment.oc1..aaaaaaaalexmplecompartmentid --vcn-id $VCN_OCID --display-name "NSG_ATP_Private_Endpoint" --query "data[0].id" --raw-output)
NSG_PS_APP_OCID=$(oci network nsg list --compartment-id ocid1.compartment.oc1..aaaaaaaalexmplecompartmentid --vcn-id $VCN_OCID --display-name "NSG_PeopleSoft_App_Servers" --query "data[0].id" --raw-output)

# Ingress rule for ATP NSG: Allow TCP 1522 from PeopleSoft App Servers NSG
oci network nsg rule add --nsg-id $NSG_ATP_PE_OCID \
    --ingress-security-rules '[
        {
            "protocol": "6",
            "sourceType": "NSG",
            "source": "'$NSG_PS_APP_OCID'",
            "tcpOptions": {
                "destinationPortRange": {
                    "max": 1522,
                    "min": 1522
                }
            },
            "description": "Allow PeopleSoft App Servers to connect to ATP"
        }
    ]'

# Egress rule for ATP NSG: Allow all outbound (for OCI services like Object Storage)
# A more restrictive rule could target specific service CIDRs if known.
oci network nsg rule add --nsg-id $NSG_ATP_PE_OCID \
    --egress-security-rules '[
        {
            "protocol": "all",
            "destinationType": "CIDR_BLOCK",
            "destination": "0.0.0.0/0",
            "description": "Allow all outbound from ATP (e.g., to OCI services via Service Gateway)"
        }
    ]'

# Egress rule for PeopleSoft App Servers NSG: Allow TCP 1522 to ATP Private Endpoint NSG
oci network nsg rule add --nsg-id $NSG_PS_APP_OCID \
    --egress-security-rules '[
        {
            "protocol": "6",
            "destinationType": "NSG",
            "destination": "'$NSG_ATP_PE_OCID'",
            "tcpOptions": {
                "destinationPortRange": {
                    "max": 1522,
                    "min": 1522
                }
            },
            "description": "Allow PeopleSoft App Servers to connect to ATP"
        }
    ]'

# Ingress rule for PeopleSoft App Servers NSG: Allow SSH from a bastion host or management subnet (example)
# Adjust source CIDR to your management network or bastion host IP
oci network nsg rule add --nsg-id $NSG_PS_APP_OCID \
    --ingress-security-rules '[
        {
            "protocol": "6",
            "sourceType": "CIDR_BLOCK",
            "source": "192.168.10.0/24",
            "tcpOptions": {
                "destinationPortRange": {
                    "max": 22,
                    "min": 22
                }
            },
            "description": "Allow SSH from Management Subnet"
        }
    ]'

3. Create Autonomous Transaction Processing (ATP) Database with Private Endpoint

Now, we'll create the ATP instance, explicitly specifying the private endpoint configuration using the subnets and NSGs we prepared.

# Get Subnet OCIDs
PS_APP_SUBNET_OCID=$(oci network subnet list --compartment-id ocid1.compartment.oc1..aaaaaaaalexmplecompartmentid --vcn-id $VCN_OCID --display-name "PeopleSoft_App_Subnet" --query "data[0].id" --raw-output)
ATP_PE_SUBNET_OCID=$(oci network subnet list --compartment-id ocid1.compartment.oc1..aaaaaaaalexmplecompartmentid --vcn-id $VCN_OCID --display-name "ATP_Private_Endpoint_Subnet" --query "data[0].id" --raw-output)

# Create ATP instance with private endpoint
oci db autonomous-database create --compartment-id ocid1.compartment.oc1..aaaaaaaalexmplecompartmentid \
    --db-version "19c" \
    --db-name "PEOPLEDB" \
    --display-name "peoplesoft_atp_db" \
    --cpu-core-count 2 \
    --data-storage-size-in-tbs 1 \
    --admin-password "MySecureDBAdminPass123" \
    --is-free-tier false \
    --db-workload "OLTP" \
    --is-auto-scaling-enabled true \
    --is-mtls-connection-required true \
    --subnet-id $ATP_PE_SUBNET_OCID \
    --private-endpoint-label "peoplesoft_atp_pe" \
    --nsg-ids '["'$NSG_ATP_PE_OCID'"]' \
    --wait-for-state AVAILABLE

# Get ATP OCID for later use
ATP_OCID=$(oci db autonomous-database list --compartment-id ocid1.compartment.oc1..aaaaaaaalexmplecompartmentid --display-name "peoplesoft_atp_db" --query "data[0].id" --raw-output)

Note the use of `--is-mtls-connection-required true`. This enforces the use of mTLS wallets for all connections, a critical security measure.

4. Download the Wallet

Once the ATP database is provisioned and in an AVAILABLE state, you need to download the client credentials (wallet). This wallet contains the necessary certificates and connection information for your PeopleSoft application servers to connect securely.

# Download the wallet for the ATP database
# Replace 'MySecureWalletPass123' with a strong password for the wallet ZIP file
oci db autonomous-database generate-wallet --autonomous-database-id $ATP_OCID \
    --file "Wallet_peoplesoft_atp_db.zip" \
    --password "MySecureWalletPass123" \
    --wait-for-state AVAILABLE

Transfer this `Wallet_peoplesoft_atp_db.zip` file securely to your PeopleSoft application server instances.

5. Configure PeopleSoft Application Server for Wallet Connectivity

On each PeopleSoft application server (e.g., PSAPPSRV, PSPRCSRV, PSQASRV) that needs to connect to the ATP database, perform the following steps:

a. Install Oracle Instant Client

Ensure Oracle Instant Client (or a full Oracle Client) is installed. PeopleSoft typically requires this for database connectivity. Download the appropriate version (e.g., 19c) from Oracle's website.

# Example for Linux (adjust paths as needed)
sudo mkdir -p /opt/oracle/instantclient_19_18
cd /opt/oracle/instantclient_19_18
# Download and unzip basic, sqlplus, and sdk packages here
unzip instantclient-basic-linux.x64-19.18.0.0.0dbru.zip
unzip instantclient-sqlplus-linux.x64-19.18.0.0.0dbru.zip
unzip instantclient-sdk-linux.x64-19.18.0.0.0dbru.zip

# Update environment variables (e.g., in .bashrc or PeopleSoft environment script)
export LD_LIBRARY_PATH=/opt/oracle/instantclient_19_18:$LD_LIBRARY_PATH
export PATH=/opt/oracle/instantclient_19_18:$PATH
export TNS_ADMIN=/opt/oracle/instantclient_19_18/network/admin # This is where the wallet will go

b. Unzip the Wallet

Unzip the downloaded `Wallet_peoplesoft_atp_db.zip` into the `$TNS_ADMIN` directory (e.g., `/opt/oracle/instantclient_19_18/network/admin`).

# On your PeopleSoft application server
mkdir -p $TNS_ADMIN
unzip Wallet_peoplesoft_atp_db.zip -d $TNS_ADMIN

This will extract several files, including `tnsnames.ora`, `sqlnet.ora`, `cwallet.sso`, `ewallet.p12`, and `keystore.jks`.

c. Verify sqlnet.ora

The `sqlnet.ora` file extracted from the wallet should look something like this. Crucially, it must point to the correct wallet location.

# sqlnet.ora content
WALLET_LOCATION = (SOURCE = (METHOD = mTLS) (METHOD_DATA = (DIRECTORY="/opt/oracle/instantclient_19_18/network/admin")))
SSL_SERVER_DN_MATCH = yes

Ensure the `DIRECTORY` path matches your `$TNS_ADMIN` environment variable or the actual path where you unzipped the wallet.

d. Configure PeopleSoft Database Connectivity

PeopleSoft uses a connect string defined in configuration files like `psappsrv.cfg` (for application servers) or `psprcsrv.cfg` (for process schedulers). You will use the service names provided in the `tnsnames.ora` file from the wallet.

Open `tnsnames.ora`. You'll find entries like `peoplesoft_atp_db_high`, `peoplesoft_atp_db_medium`, `peoplesoft_atp_db_low`. These correspond to different service levels (high, medium, low concurrency and performance). For PeopleSoft, `_medium` is often a good starting point, or `_high` for critical production environments.

# Example tnsnames.ora snippet (truncated)
PEOPLEDB_high = (description= (address=(protocol=tcps)(port=1522)(host=peoplesoft_atp_db.adb.us-ashburn-1.oraclecloud.com))(connect_data=(service_name=oc1.adb.oraclecloud.com_peoplesoft_atp_db_high.adb.oraclecloud.com))(security=(ssl_server_cert_dn="CN=peoplesoft_atp_db.adb.us-ashburn-1.oraclecloud.com,OU=Oracle ADB-S,O=Oracle Corporation,L=Redwood City,ST=California,C=US")))

PEOPLEDB_medium = (description= (address=(protocol=tcps)(port=1522)(host=peoplesoft_atp_db.adb.us-ashburn-1.oraclecloud.com))(connect_data=(service_name=oc1.adb.oraclecloud.com_peoplesoft_atp_db_medium.adb.oraclecloud.com))(security=(ssl_server_cert_dn="CN=peoplesoft_atp_db.adb.us-ashburn-1.oraclecloud.com,OU=Oracle ADB-S,O=Oracle Corporation,L=Redwood City,ST=California,C=US")))

PEOPLEDB_low = (description= (address=(protocol=tcps)(port=1522)(host=peoplesoft_atp_db.adb.us-ashburn-1.oraclecloud.com))(connect_data=(service_name=oc1.adb.oraclecloud.com_peoplesoft_atp_db_low.adb.oraclecloud.com))(security=(ssl_server_cert_dn="CN=peoplesoft_atp_db.adb.us-ashburn-1.oraclecloud.com,OU=Oracle ADB-S,O=Oracle Corporation,L=Redwood City,ST=California,C=US")))

In your `psappsrv.cfg` (or equivalent), locate the `DbConnectionString` parameter and update it to use the appropriate service name. For example:

# In psappsrv.cfg
DbConnectionString=PEOPLEDB_medium

Ensure your `ORACLE_HOME` and `TNS_ADMIN` environment variables are correctly set in the PeopleSoft environment setup script (`ps_setenv.sh` or similar).

6. Test Connectivity

From your PeopleSoft application server, use `sqlplus` to test the connection. This confirms that the wallet is correctly configured and network paths are open.

# On the PeopleSoft application server
sqlplus admin@PEOPLEDB_medium

# You will be prompted for the ADMIN password you set during ATP creation.
# If successful, you'll see:
# SQL>

You can also use `tnsping` to verify the service name resolution and reachability:

tnsping PEOPLEDB_medium

A successful `tnsping` indicates that the client can resolve the service name and reach the ATP database's private endpoint. An "OK" message is what you're looking for.

Security Considerations for PeopleSoft on ATP Private Endpoint

The decision to deploy Oracle PeopleSoft on ATP with a private endpoint and mTLS wallets is fundamentally a security-driven one. This architecture provides several layers of defense that are critical for safeguarding sensitive HR, financial, and student data.

• Network Isolation

  The primary benefit of a private endpoint is network isolation. By preventing database traffic from traversing the public internet, you eliminate a significant attack surface. This means no public IP addresses for your database, making it invisible to external scanners and malicious actors. All communication stays within your OCI VCN, secured by OCI's robust network infrastructure.

• Mutual TLS (mTLS) Authentication

  The use of mTLS wallets enforces mutual authentication. This means both the client (your PeopleSoft application server) and the server (ATP database) must present and validate cryptographic certificates. This ensures that:

  • The PeopleSoft application server is connecting to the legitimate ATP database (server authentication).
  • The ATP database is only accepting connections from authorized PeopleSoft application servers (client authentication via the wallet's client certificate).

  This prevents impersonation and ensures that only trusted entities can communicate.

• Data Encryption in Transit

  All data exchanged between the PeopleSoft application server and the ATP database over the private endpoint is encrypted using TLS 1.2 or higher. This protects sensitive PeopleSoft data from eavesdropping and tampering as it moves across the network.

• Principle of Least Privilege with NSGs

  Network Security Groups (NSGs) allow you to enforce the principle of least privilege at the network level. By defining specific ingress and egress rules, you ensure that only the necessary traffic (e.g., TCP 1522 from PeopleSoft App Server NSG to ATP Private Endpoint NSG) is permitted. Any other traffic is implicitly denied, significantly reducing the potential for unauthorized access.

• Wallet Security

  The security of the mTLS wallet is paramount. The wallet file (`Wallet_peoplesoft_atp_db.zip`) contains sensitive credentials. Best practices dictate:

  • Secure Storage: Store the unzipped wallet files in a protected directory on your PeopleSoft application servers with strict file system permissions, readable only by the PeopleSoft user and `oracle` user.
  • Password Protection: The wallet ZIP file itself is password-protected during download. Ensure this password is strong and managed securely.
  • Regular Rotation: While ATP wallets don't expire in the traditional sense, OCI allows you to rotate the wallet (generate a new one), which can be a good security practice in case of suspected compromise.
  • No Public Exposure: Never expose the wallet files to public networks or insecure storage locations.

• Audit Trails and Monitoring

  ATP provides comprehensive auditing capabilities. Ensure auditing is configured to track database access, changes, and security-relevant events. Integrate these audit logs with OCI Logging Analytics or your SIEM solution for real-time monitoring and threat detection, crucial for compliance requirements specific to PeopleSoft data.

• Patching and Updates

  As an autonomous service, ATP automatically handles database patching and updates, including security patches, without downtime. This ensures your database always runs on the latest secure version, removing a significant operational burden and security risk for PeopleSoft administrators.

Best Practices for PeopleSoft on ATP Private Endpoint

To maximize the benefits of this secure and performant architecture for your Oracle PeopleSoft deployment, consider these best practices:

• Dedicated Subnets and NSGs

  Always use dedicated private subnets for your PeopleSoft application servers and the ATP private endpoint. Leverage NSGs over security lists for finer-grained control, associating NSGs directly with the database and server VNICs rather than entire subnets. This simplifies rule management and enhances security.

• Service Gateway for Private Access

  Ensure your VCN is configured with a Service Gateway and corresponding route rules in your private subnets. This allows your ATP database (and other OCI resources in private subnets) to securely access OCI services like Object Storage (for backups, wallet retrieval) without needing an Internet Gateway or public IPs.

• Wallet Management

  • Centralized Wallet Storage: While each PeopleSoft app server needs its own copy, consider a secure, centralized location (e.g., a shared file system accessible only by authorized hosts) for wallet distribution, reducing manual effort and ensuring consistency.
  • Automation: Automate the deployment and configuration of the wallet on new PeopleSoft application servers using configuration