Skip to main content

Oracle

Oracle is an object-relational database management system that is widely used in enterprise applications.

User Impersonation​

The Oracle username provided in the connection is the default username when running queries. When queries are run against Oracle in Dremio, users use the privileges associated with the Oracle database username and run queries under that username.

You can change this default in Dremio by enabling user impersonation in the Advanced Options, which allows users to run queries under their own usernames and restricts their access. For example, user_1 can run queries as user_1 rather than oracle_svc. Before enabling user impersonation, some setup is required in Oracle to allow one user to impersonate another user, because the username of the user in Dremio must be the same as their username in Oracle and the user must be able to connect through the Oracle database username.

To set up user impersonation, follow these steps:

  1. Ensure the user's username in Oracle matches their username in Dremio. If the usernames do not match, modify one of the usernames or create a new user account with a matching username.

  2. Run an ALTER USER command in Oracle to allow the user to connect through the Oracle database username:

    Example of altering the user in Oracle 
    ALTER USER testuser1 GRANT CONNECT THROUGH proxyuser;

    In this example, the user can log in as testuser1 in Dremio and in Oracle, and they can connect through the proxyuser. The proxyuser is the Oracle database username provided in the connection configuration.

  3. Log in as an admin to Dremio.

  4. Follow the steps for Connect to Oracle using the Oracle database username and enable User Impersonation in the Advanced Options.

  5. Grant privileges to the user.

    Now that you have enabled user impersonation, a user logging in to Dremio with their username can access Oracle according to their privileges. The user also runs queries against Oracle under their username.

Connect to Oracle​

  1. In the Dremio console, click Add Data on the Home page.
  2. In the Add Data dialog, select Oracle.
  3. Configure the connection using the sections below, then click Save.

General​

The General tab contains the required fields to create an Oracle connection.

Perform these steps in the General tab:

  1. In the General tab, for Name, enter a name for the connection. The name cannot include the following special characters: /, :, [, or ].

  2. For Host, enter the Oracle host name.

  3. For Port, enter the Oracle port number. The default port is 1521.

  4. For Service Name, enter the service name of your Oracle database.

  5. (Optional) For Enable TLS encryption, enable encrypted connections to Oracle using TLS. You can only enable TLS encryption or Oracle native encryption.

  6. (Optional) For Oracle Native Encryption, the default encryption is Accepted. The other values are Required, Rejected, and Requested.

    To enable Oracle native encryption, you should also modify the SQLNET.ora file by adding the following lines:

    SQLNET.ENCRYPTION_SERVER = required  //Set the value to required or requested
    SQLNET.ENCRYPTION_TYPES_SERVER = (AES256)  //Set the value to the appropriate encryption; the value can be different
    SQLNET.CRYPTO_CHECKSUM_SERVER = required

    The Oracle native encryption values are described in the following table:

    Oracle Native Encryption ValuesDescription
    AcceptedThe client or server allows both encrypted and non-encrypted connections. This is the default if the parameter is not set.
    RejectedThe client or server refuses encrypted traffic.
    RequestedThe client or server requests encrypted traffic if it is possible, but accepts non-encrypted traffic if encryption is not possible.
    RequiredThe client or server only accepts encrypted traffic.

  7. For Authentication, you must choose one of the following authentication options:

    • Master Authentication: This is the default option. Provide the username and password of a master database user with permissions to read required objects:
      • For Username, enter your Oracle database username.
      • For Password, enter your Oracle database password.
    • Secret Resource URL:
      • For Username, enter your Oracle database username.
      • For Secret Resource Url, enter the Secret Resource URL that allows Dremio to fetch the password from AWS Secrets Manager. The Secret Resource URL is the Amazon Resource Name (ARN) for the secret (for example, arn:aws:secretsmanager:us-west-2:123456789012:secret:my-rds-secret-VNenFy).
    • For Kerberos, choose this option when Oracle has Kerebros configured.

Advanced Options​

Click Advanced Options in the sidebar. All advanced options are optional.

Advanced OptionDescription
Use timezone as connection regionIf selected, uses timezone to set connection region.
Include synonymsIf selected, includes synonyms as datasets.
Map Oracle DATE columns to TIMESTAMPIf checked, Oracle DATE columns are exposed as TIMESTAMP.
Record fetch sizeNumber of records to fetch at once. Set to 0 (zero) to have Dremio automatically decide. The default record fetch size is 200.
Maximum Idle ConnectionsThe total number of connections allowed to be idle at a given time. The default maximum idle connections is 8.
Connection Idle TimeThe amount of time (in seconds) allowed for a connection to remain idle before the connection is terminated. The default connection idle time is 60 seconds.
Use LDAP Naming ServicesTo use LDAP rather than locally configured users within Oracle. If checked, enter a domain name in the Set DN for LDAP Naming Services text box.
User ImpersonationAllows users to run queries using their credentials rather than the username provided in the connection. Some setup is required in Oracle to allow one user to impersonate another user. See User Impersonation.
EncryptionProvide the SSL/TLS server certificate distinguished name, otherwise leave it blank to disable the DN match.
Connection PropertiesCustom key-value pairs for the connection. To add a connection property, click Add property and add the property name and value.

Reflection Refresh​

The Reflection Refresh tab in the sidebar allows you to set time intervals for Reflections to refresh or expire.

  • Never refresh: Select to prevent automatic Reflection refresh; otherwise, the default is to refresh automatically.
  • Refresh every: Define how often to refresh Reflections, specified in hours, days, or weeks. This option is ignored if Never refresh is selected.
  • Set refresh schedule: Specify the daily or weekly schedule.
  • Never expire: Select to prevent Reflections from expiring; otherwise, the default is to expire automatically after the time limit specified in Expire after.
  • Expire after: The time limit after which Reflections expire and are removed from Dremio, specified in hours, days, or weeks. This option is ignored if Never expire is selected.

Metadata​

You can configure settings to refresh metadata and handle datasets. Click Metadata in the sidebar.

You can configure Dataset Handling and Metadata Refresh parameters.

Dataset Handling​

These are the Dataset Handling parameters. All Dataset Handling parameters are optional.

ParameterDescription
Remove dataset definitions if underlying data is unavailableBy default, Dremio removes dataset definitions if underlying data is unavailable. Useful when files are temporarily deleted and added back in the same location with new sets of files.

Metadata Refresh​

These are the Metadata Refresh parameters:

  • Dataset Discovery: The refresh interval for fetching top-level object names such as databases and tables. Set the time interval using this parameter.

    ParameterDescription
    (Optional) Fetch everyYou can choose to set the frequency to fetch object names in minutes, hours, days, or weeks. The default frequency to fetch object names is 1 hour.

  • Dataset Details: The metadata that Dremio needs for query planning such as information required for fields, types, shards, statistics, and locality. These are the parameters to fetch the dataset information. All Dataset Details parameters are optional.

    ParameterDescription
    Fetch modeYou can choose to fetch only from queried datasets that are set by default. Dremio updates details for previously queried objects. Fetching from all datasets is deprecated.
    Fetch everyYou can choose to set the frequency to fetch dataset details in minutes, hours, days, or weeks. The default frequency to fetch dataset details is 1 hour.
    Expire afterYou can choose to set the expiry time of dataset details in minutes, hours, days, or weeks. The default expiry time of dataset details is 3 hours.

Privileges​

This connection inherits privileges from Project settings. To grant specific users or roles additional privileges in this connection:

  1. Enter the username or role name that you want to grant access to and click the Add to Privileges button. The added user or role is displayed in the USERS/ROLES table.
  2. For the users or roles in the USERS/ROLES table, toggle the checkmark for each privilege you want to grant on the Dremio source that is being created.
  3. Click Save after setting the configuration.

See Privileges for additional information about privileges.

Edit an Oracle Connection​

  1. On the Open Catalog page, under Connections, right-click the connection and select Settings.
  2. Update the connection configuration as needed.
  3. Click Save.

Delete an Oracle Connection​

  1. On the Open Catalog page, under Connections, right-click the connection and select Delete.
  2. Click Delete to confirm.

You can use AWS PrivateLink to connect Dremio to a customer-owned Oracle instance hosted in AWS through an interface VPC endpoint. Use these steps when Dremio has enabled private source connectivity for your organization.

In this configuration, you create a VPC endpoint service backed by a Network Load Balancer (NLB) in your AWS account. Dremio creates an interface VPC endpoint to that service from Dremio infrastructure.

note
PrivateLink endpoints created by Dremio are available only to projects that already exist in the organization when Dremio creates the endpoints. To enable a newly created project to use an existing PrivateLink endpoint, contact Dremio Support.

Prerequisites

Before you start, confirm that your Oracle instance and the Dremio organization are ready for private connectivity.

Confirm all of the following:

  • Your Dremio organization has private source connectivity enabled.
  • Your Oracle instance is hosted in AWS.
  • Your Dremio organization is in a region that supports private source connectivity. See Regions.
  • Your Oracle instance is in the same AWS Region as your Dremio organization.
  • You can create a Network Load Balancer and VPC endpoint service in the AWS account that hosts your Oracle instance.

Review the AWS documentation for creating a VPC endpoint service and managing endpoint service permissions before you proceed.

Create the PrivateLink Connection

Complete these steps in order. You perform the AWS setup steps in the account that hosts your Oracle instance. Dremio Support notifies you when the PrivateLink connection has been created.

Step 1: Create a VPC Endpoint Service

Create an AWS PrivateLink producer service in the AWS account that hosts your Oracle instance.

  1. Create a Network Load Balancer (NLB) in the same VPC as your Oracle instance. Configure the NLB to forward traffic to your Oracle instance on port 1521.
  2. Create a VPC endpoint service backed by the NLB. Record the service name, which has the format com.amazonaws.vpce.<region>.vpce-svc-....
  3. Confirm that the endpoint service is in the same AWS Region as your Dremio organization.

Step 2: Authorize the Dremio AWS Account

Grant the Dremio AWS account permission to create an interface endpoint to your VPC endpoint service. Use the account ARN that matches your Dremio organization's region.

Dremio RegionDremio AWS Account ARN
US (us-west-2, us-east-1, us-east-2)arn:aws:iam::602951639670:root
EMEA (eu-central-1, eu-west-1)arn:aws:iam::067773914317:root
Authorize the Dremio AWS account
aws ec2 modify-vpc-endpoint-service-permissions \
  --service-id vpce-svc-xxxxxxxx \
  --add-allowed-principals '["<DREMIO_ACCOUNT_ARN>"]'

Replace vpce-svc-xxxxxxxx with your endpoint service ID and <DREMIO_ACCOUNT_ARN> with the ARN for your Dremio region.

Step 3: Open a Dremio Support Request

Open a request with Dremio Support to complete the private source connectivity setup.

  1. Go to the Dremio Support Portal.
  2. Request private source connectivity for Oracle through AWS PrivateLink.
  3. Provide your Dremio Organization ID.
  4. Include the following details:
    ValueDescription
    VPC endpoint service nameThe service name in the format com.amazonaws.vpce.<region>.vpce-svc-....
    AWS RegionThe AWS Region where your endpoint service is hosted.
    Oracle hostnameThe hostname Dremio must use for TLS/SNI verification when connecting.
    PortThe port your Oracle instance listens on (default: 1521).

Step 4: Accept the Endpoint Connection (if required)

If your VPC endpoint service requires manual acceptance, you must accept Dremio's endpoint connection request. Dremio Support will notify you when the request is ready to accept.

Accept the endpoint connection request
# Only required if your endpoint service has manual acceptance enabled
aws ec2 accept-vpc-endpoint-connections \
  --service-id vpce-svc-xxxxxxxx \
  --vpc-endpoint-ids vpce-xxxxxxxx

Replace vpce-xxxxxxxx with the endpoint ID provided by Dremio Support.

Step 5: Configure the Oracle Source in Dremio

After Dremio Support confirms that the PrivateLink connection has been created, configure the Oracle source in Dremio. For source configuration steps, see Connect to Oracle.

Remove the PrivateLink Connection

Coordinate removal with Dremio before deleting your VPC endpoint service. Dremio must remove the interface endpoint and private source configuration from Dremio infrastructure.

  1. Open a Dremio Support request to remove the Oracle private source connection.
  2. Wait for Dremio to confirm that the interface endpoint is deleted.
  3. Delete the VPC endpoint service and NLB from your AWS account.

Predicate Pushdowns​

Dremio offloads these operations to Oracle:

*, +, -, /, %
<, <=, <>, =, >, >=, !=
AND, NOT, OR, ||
ABS
ACOS
ADD_MONTHS
ASIN
ATAN
ATAN2
AVG
CAST
CEIL
CEILING
CHAR_LENGTH
CHARACTER_LENGTH
CONCAT
COS
COSH
COT
COVAR_POP
COVAR_SAMP
DATE_ADD
DATE_SUB
DATE_TRUNC_DAY
DATE_TRUNC_HOUR
DATE_TRUNC_MINUTE
DATE_TRUNC_MONTH
DATE_TRUNC_QUARTER
DATE_TRUNC_WEEK
DATE_TRUNC_YEAR
DEGREES
E
EXP
EXTRACT_CENTURY
EXTRACT_DAY
EXTRACT_DOW
EXTRACT_DOY
EXTRACT_HOUR
EXTRACT_MINUTE
EXTRACT_MONTH
EXTRACT_QUARTER
EXTRACT_SECOND
EXTRACT_WEEK
EXTRACT_YEAR
FLOOR
IS DISTINCT FROM
IS NOT DISTINCT FROM
IS NOT NULL
IS NULL
LAST_DAY
LCASE
LEFT
LENGTH
LIKE
LN
LOCATE
LOG
LOG10
LOWER
LPAD
LTRIM
MAX
MEDIAN
MIN
MOD
PERCENT_CONT
PERCENT_DISC
PI
POSITION
POW
POWER
RADIANS
REGEXP_LIKE
REPLACE
REVERSE
RIGHT
ROUND
RPAD
RTRIM
SIGN
SIN
SINH
SQRT
STDDEV
STDDEV_POP
STDDEV_SAMP
SUBSTR
SUBSTRING
SUM
TAN
TANH
TO_CHAR
TO_DATE
TRIM
TRUNC
TRUNCATE
UCASE
UPPER
VAR_POP
VAR_SAMP

Data Type Map​

Dremio supports Oracle data types, as shown in the following table which provides the mappings from Oracle to Dremio data types. If there are additional Oracle types not listed in the table, then those types are not supported in Dremio.

Oracle Data TypeDremio Type
BINARY_DOUBLEDOUBLE
BINARY_FLOATFLOAT
BLOBVARBINARY
CHARVARCHAR
DATEDATE
FLOATDOUBLE
INTERVALDSINTERVAL (day to seconds)
INTERVALYMINTERVAL (years to months)
LONG RAWVARBINARY
LONGVARCHAR
NCHARVARCHAR
NUMBERDECIMAL
NVARCHAR2VARCHAR
RAWVARBINARY
TIMESTAMPTIMESTAMP
VARCHAR2VARCHAR