Credential-less Oracle connections in SQL Developer with Oracle Wallet

Storing database passwords in SQL Developer connection profiles or in tnsnames.ora leaks credentials to local files and to any repo that tracks those settings. The practical fix is to use an Oracle Wallet so SQL Developer can authenticate with username only and no password prompt, while the secret lives in a client-side wallet directory protected by filesystem permissions.

How wallet authentication works for SQL Developer

SQL Developer uses the Oracle Net client configuration that it loads from the selected Oracle Home. When sqlnet.ora points to a wallet directory and SQLNET.WALLET_OVERRIDE is enabled, the client can present credentials stored in the wallet for a database alias. In SQL Developer this surfaces as a Connection Type: Wallet. You choose the wallet and the alias, supply the database user name, and the client supplies the password from the wallet entry.

Wallet authentication is supported only for Oracle Database connections. Third-party databases supported by SQL Developer do not use Oracle Net and cannot use a wallet.

Worked client configuration

The example below shows a single-machine setup with an auto-login wallet. Replace placeholders with your values and run commands as the OS user that owns the wallet directory.

sqlnet.ora, typically in $ORACLE_HOME/network/admin or a client config directory referenced by SQL Developer:

WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = /opt/oracle/wallet)
    )
  )

SQLNET.WALLET_OVERRIDE = TRUE
SSL_CLIENT_AUTHENTICATION = FALSE

WALLET_LOCATION tells the client where to find the wallet. SQLNET.WALLET_OVERRIDE allows the wallet to override credentials supplied elsewhere. SSL_CLIENT_AUTHENTICATION behavior is version-sensitive across Oracle client releases; verify the setting you need for your release.

Create and populate the wallet from a command prompt with permission to write to the wallet directory:

mkstore -wrl /opt/oracle/wallet -create
mkstore -wrl /opt/oracle/wallet -createCredential <db_alias> <db_user> <db_password>

mkstore creates the wallet files in the specified directory and stores a credential entry keyed by the database alias. The alias must match an entry in tnsnames.ora or an EZConnect name resolvable by the client.

To make the wallet usable without a password prompt, create an auto-login version. Auto-login wallets contain obfuscated material that is recoverable on the local machine and must be treated as secrets.

orapki wallet create -wallet /opt/oracle/wallet -auto_login

Restrict filesystem access to the wallet directory to the owning OS user only. Auto-login wallets are not encrypted on disk.

In SQL Developer, open Tools > Preferences > Database > Advanced and confirm the Oracle Home points to a client that loads the sqlnet.ora shown above. Create a new connection, set Connection Type to Wallet, select the wallet directory, choose the database alias, and enter the database user name. Leave the password field empty. A successful connection indicates the client retrieved credentials from the wallet.

Operational limits

Wallet entries are per client machine. Distributing a wallet to a team requires secure distribution of the wallet files and consistent sqlnet.ora settings. Changing a database password requires updating the credential entry in the wallet on each client where it is used.

SQL Developer stores connection metadata locally. Using a wallet removes the password from the profile, but the profile itself and the wallet location are still local configuration. Do not commit SQL Developer configuration files or wallet directories to version control.

Auto-login wallets rely on filesystem permissions for protection. They should not be used on laptops without full-disk encryption or on shared workstations.

Common mistakes

Placing the wallet in a world-readable directory exposes credentials to other OS users. Always check permissions after creation.

Forgetting SQLNET.WALLET_OVERRIDE can cause SQL Developer to ignore the wallet and prompt for a password, leading to the impression that the wallet is broken.

Mixing wallet authentication with password-based connections in the same sqlnet.ora can produce fallback behavior that is hard to diagnose. Keep the configuration consistent per Oracle Home.

Using an auto-login wallet on a machine without encryption increases exposure if the device is lost or imaged.

Practical verification

Verify the Oracle Home in SQL Developer Preferences points to the client with the configured sqlnet.ora and wallet directory.

Inspect sqlnet.ora for WALLET_LOCATION and SQLNET.WALLET_OVERRIDE and check wallet file permissions on the filesystem.

Create a new Wallet connection with the alias and user name only and confirm the connection succeeds without a password prompt. If a prompt appears, re-check wallet location, permissions, and the override flag.

Wallet configuration is version-sensitive. Behavior of SSL_CLIENT_AUTHENTICATION and wallet override flags can change between Oracle client releases, so confirm settings against the release documentation you are running.