mk-oracle: use the ASM credentials when connecting to an ASM instance

The `asm_*` fields were parsed but never read, so ASM instances were
contacted with the regular database credentials.

`Target::connection_auth()` now picks the `asm_*` values for ASM
targets and the regular ones for everything else; the per-field
fallbacks are unchanged, so a config without `asm_*` behaves as
before. The wallet setup is decided per target too, so
`asm_type: wallet` works with standard database credentials.

CMK-37729

Change-Id: I14084b1633dcd7e8d357bdcc6b2463c1a162add1

Author: AnvarU

packages/mk-oracle/README.md

@@ -166,10 +166,54 @@ authentication:
   password: 'secret' # mandatory for standard auth
   role: 'sysdba' # optional, e.g. sysdba, sysasm
   type: 'standard' # optional, default: "standard", values: standard, wallet
+  asm_username: 'asm_user' # optional, only used for ASM instances
+  asm_password: 'asm_pass' # optional, only used for ASM instances
+  asm_role: 'sysasm' # optional, only used for ASM instances
+  asm_type: 'standard' # optional, only used for ASM instances
 ```
 
 Set `type: wallet` to use Oracle Wallet authentication instead of username/password (see [Oracle Wallet Authentication](#oracle-wallet-authentication) below).
 
+#### ASM Authentication
+
+ASM instances (a SID or instance name starting with `+`, e.g. `+ASM`) are usually
+reached with different credentials than a normal database. The `asm_*` fields
+hold those credentials and replace their regular counterparts whenever the plugin
+connects to an ASM instance; normal database connections ignore them. This
+mirrors `ASMUSER` of the legacy `mk_oracle` plugin.
+
+Each field falls back to its regular counterpart when it is not set:
+
+| Field          | Replaces   | Fallback when unset                                                                     |
+| -------------- | ---------- | --------------------------------------------------------------------------------------- |
+| `asm_username` | `username` | `username`                                                                              |
+| `asm_password` | `password` | `password` (only when `asm_username` is unset, so an ASM user never reuses a DB secret) |
+| `asm_role`     | `role`     | `role`                                                                                  |
+| `asm_type`     | `type`     | derived from `asm_username`/`asm_password`, see below                                   |
+
+When `asm_type` is omitted it is derived: `asm_username: '/'` or an
+`asm_username` without `asm_password` means external authentication (`wallet`),
+an ASM user with a password means `standard`, and without any `asm_username` the
+regular `type` applies.
+
+Set `asm_role` (typically `sysasm`, `sysdba` also works) — an ASM instance has no
+data dictionary reachable from an unprivileged session.
+
+```yaml
+oracle:
+  main:
+    authentication:
+      username: 'checkmk'
+      password: 'secret'
+      role: 'sysdba'
+      asm_username: 'asm_user'
+      asm_password: 'asm_pass'
+      asm_role: 'sysasm'
+    instances:
+      - sid: 'ORCL' # connects as checkmk/secret as sysdba
+      - sid: '+ASM' # connects as asm_user/asm_pass as sysasm
+```
+
 ### Connection
 
 Defines the network-level connection parameters shared by all instances unless overridden.
@@ -926,7 +970,7 @@ The generated file is a single YAML document consisting of:
 | ------------------------------------------ | ------------------------------------------------------------------------------------------------- |
 | `DBUSER` (required)                        | Top-level `connection:` (hostname, port) and `authentication:`, plus the first `instances:` entry |
 | `DBUSER_<SID>`                             | An `instances:` entry with per-instance `connection:` and `authentication:`                       |
-| `ASMUSER`                                  | `asm_username`, `asm_password`, `asm_role` under `authentication:`                                |
+| `ASMUSER`                                  | `asm_username`, `asm_password`, `asm_role`, `asm_type` under `authentication:`                    |
 | `REMOTE_INSTANCE_<ID>`                     | An `instances:` entry including `piggyback_host:` (Linux/AIX only)                                |
 | `SYNC_SECTIONS` / `ASYNC_SECTIONS`         | `sections:` entries with `is_async: false` / `true`                                               |
 | `SYNC_ASM_SECTIONS` / `ASYNC_ASM_SECTIONS` | `sections:` entries with `affinity: "asm"` (`"all"` if the section is also a normal section)      |

packages/mk-oracle/src/config/authentication.rs

@@ -280,6 +280,35 @@ impl Authentication {
     pub fn asm_role(&self) -> Option<&Role> {
         self.asm_role.as_ref().or(self.role.as_ref())
     }
+
+    pub fn db_auth(&self) -> ConnectionAuth {
+        ConnectionAuth {
+            auth_type: self.auth_type.clone(),
+            username: self.username().to_owned(),
+            password: self.password().map(str::to_owned),
+            role: self.role().cloned(),
+        }
+    }
+
+    pub fn asm_auth(&self) -> ConnectionAuth {
+        ConnectionAuth {
+            auth_type: self.asm_auth_type(),
+            username: self.asm_username().to_owned(),
+            password: self.asm_password().map(str::to_owned),
+            role: self.asm_role().cloned(),
+        }
+    }
+}
+
+/// The credentials, role and auth type used to open one connection, resolved
+/// out of an [`Authentication`] by [`Authentication::db_auth`] /
+/// [`Authentication::asm_auth`].
+#[derive(PartialEq, Debug, Clone)]
+pub struct ConnectionAuth {
+    pub auth_type: AuthType,
+    pub username: String,
+    pub password: Option<String>,
+    pub role: Option<Role>,
 }
 
 fn _extract_username_if_env_var<T: AsRef<str> + Sized>(value: T) -> String {
@@ -448,6 +477,16 @@ authentication:
   username: "foo"
   _password: "bar"
   _type: "system"
+"#;
+        pub const AUTHENTICATION_ASM: &str = r#"
+authentication:
+  username: "foo"
+  password: "bar"
+  type: "standard"
+  role: sysdba
+  asm_username: "asm_user"
+  asm_password: "asm_pass"
+  asm_role: sysasm
 "#;
     }
 
@@ -516,22 +555,67 @@ authentication:
 
     #[test]
     fn test_authentication_from_yaml_asm_fields() {
-        let yaml_str = r#"
+        let a = Authentication::from_yaml(&create_yaml(data::AUTHENTICATION_ASM))
+            .unwrap()
+            .unwrap();
+        assert_eq!(a.asm_username(), "asm_user");
+        assert_eq!(a.asm_password(), Some("asm_pass"));
+        assert_eq!(a.asm_role(), Some(&Role::SysASM));
+    }
+
+    #[test]
+    fn test_asm_auth_uses_asm_fields() {
+        let a = Authentication::from_yaml(&create_yaml(data::AUTHENTICATION_ASM))
+            .unwrap()
+            .unwrap();
+        assert_eq!(
+            a.asm_auth(),
+            ConnectionAuth {
+                auth_type: AuthType::Standard,
+                username: "asm_user".to_owned(),
+                password: Some("asm_pass".to_owned()),
+                role: Some(Role::SysASM),
+            }
+        );
+        // The regular connection is unaffected by the `asm_*` fields.
+        assert_eq!(
+            a.db_auth(),
+            ConnectionAuth {
+                auth_type: AuthType::Standard,
+                username: "foo".to_owned(),
+                password: Some("bar".to_owned()),
+                role: Some(Role::SysDba),
+            }
+        );
+    }
+
+    #[test]
+    fn test_asm_auth_falls_back_to_regular_fields() {
+        let a = Authentication::from_yaml(&create_yaml(data::AUTHENTICATION_NO_ASM))
+            .unwrap()
+            .unwrap();
+        assert_eq!(a.asm_auth(), a.db_auth());
+    }
+
+    #[test]
+    fn test_asm_auth_wallet_with_standard_regular_auth() {
+        let a = Authentication::from_yaml(&create_yaml(
+            r#"
 authentication:
   username: "foo"
   password: "bar"
   type: "standard"
   role: sysdba
-  asm_username: "asm_user"
-  asm_password: "asm_pass"
+  asm_username: "/"
   asm_role: sysasm
-"#;
-        let a = Authentication::from_yaml(&create_yaml(yaml_str))
-            .unwrap()
-            .unwrap();
-        assert_eq!(a.asm_username(), "asm_user");
-        assert_eq!(a.asm_password(), Some("asm_pass"));
-        assert_eq!(a.asm_role(), Some(&Role::SysASM));
+"#,
+        ))
+        .unwrap()
+        .unwrap();
+        // `asm_username: "/"` is external auth: no password is passed on.
+        assert_eq!(a.asm_auth().auth_type, AuthType::Wallet);
+        assert_eq!(a.asm_auth().role, Some(Role::SysASM));
+        assert_eq!(a.db_auth().auth_type, AuthType::Standard);
     }
 
     #[test]

packages/mk-oracle/src/ora_sql/backend.rs

@@ -63,19 +63,24 @@ impl OraDbEngine for StdEngine {
         let connection_string = target
             .make_connection_string(instance_name, ConnectionStringType::Tns)
             .context("Target is not defined")?;
+        // An ASM instance is reached with the `asm_*` credentials from the config.
+        let auth = target.connection_auth();
         log::info!(
-            "Connection string: {}, auth type {:?}",
+            "Connection string: {}, asm {}, auth type {:?}",
             connection_string,
-            target.auth.auth_type()
+            target.is_asm(),
+            auth.auth_type
         );
 
-        let mut connector = match target.auth.auth_type() {
+        let mut connector = match &auth.auth_type {
             AuthType::Standard => {
                 // Standard authentication with username and password
-                let username = target.auth.username();
-                let password = target.auth.password().unwrap_or("");
-                log::info!("Using standard authentication with user: {}", username);
-                Connector::new(username, password, &connection_string)
+                log::info!("Using standard authentication with user: {}", auth.username);
+                Connector::new(
+                    &auth.username,
+                    auth.password.as_deref().unwrap_or(""),
+                    &connection_string,
+                )
             }
             AuthType::Os | AuthType::Wallet => {
                 // OS/Wallet authentication - use external auth with empty credentials
@@ -86,7 +91,7 @@ impl OraDbEngine for StdEngine {
             }
         };
 
-        if let Some(role) = target.auth.role() {
+        if let Some(role) = &auth.role {
             log::info!("Using role: {}", role);
             connector.privilege(_to_privilege(role));
         }

packages/mk-oracle/src/ora_sql/instance.rs

@@ -85,16 +85,6 @@ pub async fn generate_data(
         // we need to set TNS_ADMIN for Oracle client for the case alias is used
         add_tns_admin_to_env(ora_sql.conn());
 
-        // Set up wallet environment (creates sqlnet.ora with wallet location)
-        // Only if tns_admin is NOT explicitly set in config
-        let tns_admin_explicitly_set = ora_sql.conn().tns_admin().is_some();
-        if ora_sql.auth().auth_type() == &AuthType::Wallet && !tns_admin_explicitly_set {
-            if let Err(e) = setup_wallet_environment(None) {
-                log::error!("Failed to setup wallet environment: {}", e);
-                return Err(e).context("Failed to setup wallet environment");
-            }
-        }
-
         // TODO: detect instances
         // TODO: apply to config detected instances
         // TODO: customize instances
@@ -103,6 +93,22 @@ pub async fn generate_data(
         let all = calc_all_spots(vec![ora_sql.endpoint()], ora_sql.instances());
         let all = filter_spots(all, ora_sql.discovery());
 
+        // Set up wallet environment (creates sqlnet.ora with wallet location)
+        // Only if tns_admin is NOT explicitly set in config.
+        // The auth type is asked per spot: an ASM instance may use wallet auth
+        // (`asm_type`) while the regular credentials are standard, and vice versa.
+        let tns_admin_explicitly_set = ora_sql.conn().tns_admin().is_some();
+        let uses_wallet = ora_sql.auth().auth_type() == &AuthType::Wallet
+            || all
+                .iter()
+                .any(|spot| spot.target().connection_auth().auth_type == AuthType::Wallet);
+        if uses_wallet && !tns_admin_explicitly_set {
+            if let Err(e) = setup_wallet_environment(None) {
+                log::error!("Failed to setup wallet environment: {}", e);
+                return Err(e).context("Failed to setup wallet environment");
+            }
+        }
+
         let sections = ora_sql
             .product()
             .sections()

packages/mk-oracle/src/ora_sql/types.rs

@@ -19,7 +19,10 @@ use crate::types::{
     ServiceType, Sid,
 };
 
-use crate::config::{authentication::Authentication, target::TargetId};
+use crate::config::{
+    authentication::{Authentication, ConnectionAuth},
+    target::TargetId,
+};
 use std::time::Duration;
 
 #[derive(Debug, Clone)]
@@ -89,6 +92,16 @@ impl Target {
                 .map(|sid| InstanceName::from(sid).is_asm())
                 .unwrap_or(false)
     }
+
+    /// Credentials to connect to this target with: an ASM instance is reached
+    /// with the `asm_*` credentials, everything else with the regular ones.
+    pub fn connection_auth(&self) -> ConnectionAuth {
+        if self.is_asm() {
+            self.auth.asm_auth()
+        } else {
+            self.auth.db_auth()
+        }
+    }
 }
 
 impl Target {
@@ -221,7 +234,7 @@ impl Target {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::config::authentication::Authentication;
+    use crate::config::authentication::{AuthType, Authentication, Role};
     use crate::config::target::TargetIdBuilder;
     use crate::config::yaml::test_tools::create_yaml;
     use crate::types::HostName;
@@ -256,6 +269,67 @@ authentication:
         assert!(!target_with_target_id(TargetIdBuilder::new().build()).is_asm());
     }
 
+    const ASM_AUTH_YAML: &str = r"
+authentication:
+    username: 'user'
+    password: 'pass'
+    type: 'standard'
+    role: 'sysdba'
+    asm_username: 'asm_user'
+    asm_password: 'asm_pass'
+    asm_role: 'sysasm'
+    asm_type: 'standard'";
+
+    fn target_with_asm_auth(sid: &str) -> Target {
+        Target {
+            host: HostName::from("localhost".to_owned()),
+            timeout: Duration::from_secs(0),
+            target_id: TargetIdBuilder::new().sid(Some(sid)).build(),
+            port: Port(1521),
+            auth: Authentication::from_yaml(&create_yaml(ASM_AUTH_YAML))
+                .unwrap()
+                .unwrap(),
+        }
+    }
+
+    #[test]
+    fn test_connection_auth_for_asm_instance() {
+        let target = target_with_asm_auth("+ASM");
+        let auth = target.connection_auth();
+        assert_eq!(auth.username, "asm_user");
+        assert_eq!(auth.password.as_deref(), Some("asm_pass"));
+        assert_eq!(auth.role, Some(Role::SysASM));
+        assert_eq!(auth.auth_type, AuthType::Standard);
+    }
+
+    #[test]
+    fn test_connection_auth_for_db_instance_ignores_asm_fields() {
+        let target = target_with_asm_auth("ORCL");
+        let auth = target.connection_auth();
+        assert_eq!(auth.username, "user");
+        assert_eq!(auth.password.as_deref(), Some("pass"));
+        assert_eq!(auth.role, Some(Role::SysDba));
+        assert_eq!(auth.auth_type, AuthType::Standard);
+    }
+
+    #[test]
+    fn test_connection_auth_without_asm_fields_stays_regular() {
+        // No `asm_*` in the config: an ASM instance uses the regular credentials.
+        let target = Target {
+            host: HostName::from("localhost".to_owned()),
+            timeout: Duration::from_secs(0),
+            target_id: TargetIdBuilder::new().sid(Some("+ASM")).build(),
+            port: Port(1521),
+            auth: Authentication::from_yaml(&create_yaml(AUTH_YAML))
+                .unwrap()
+                .unwrap(),
+        };
+        let auth = target.connection_auth();
+        assert_eq!(auth.username, "user");
+        assert_eq!(auth.password.as_deref(), Some("pass"));
+        assert_eq!(auth.auth_type, AuthType::Standard);
+    }
+
     #[test]
     fn test_make_connection_string_service_type_instance() {
         let target = Target {