AWS transform documentation change
Summary
Added support for multiple Active Directory domains in Kerberos configuration, introduced Oracle database access documentation, updated server import CSV format to include Oracle credentials, and clarified SQL Server collection requirements.
Security assessment
The changes primarily document new Oracle database authentication features and multi-domain Kerberos support. While they involve credential management (security aspect), there's no evidence of addressing a specific vulnerability. The Kerberos/Oracle credential additions enhance security documentation by explaining authentication methods, but don't fix existing flaws.
Diff
diff --git a/transform/latest/userguide/discovery-tool-configure.md b/transform/latest/userguide/discovery-tool-configure.md index ffe96ceec..fbc3d3773 100644 --- a//transform/latest/userguide/discovery-tool-configure.md +++ b//transform/latest/userguide/discovery-tool-configure.md @@ -7 +7 @@ -Access the discovery tool consoleAccessing the discovery tool VMConfigure Kerberos authenticationConfigure vCenter accessConfigure Hyper-V accessImport serversImport a self-signed certificate authority into the discovery toolConfigure the discovery tool for OS accessUpdating the discovery toolRevoking access +Access the discovery tool consoleAccessing the discovery tool VMConfigure Kerberos authenticationConfigure vCenter accessConfigure Hyper-V accessImport serversImport a self-signed certificate authority into the discovery toolConfigure the discovery tool for OS accessConfigure Oracle database accessUpdating the discovery toolRevoking access @@ -102,0 +103,25 @@ Kerberos is case-sensitive. The realm name must be in uppercase (for example, `E +**Multiple Active Directory domains** + +The discovery tool supports multiple Kerberos credentials for different Active Directory domains. Each credential authenticates independently, so you can configure multiple credentials normally and isolation is automatic. + +If you have servers in multiple domains, add entries for each realm in your `/etc/krb5.conf` file: + + [libdefaults] + default_realm = DEV.COMPANY.COM + dns_lookup_realm = false + dns_lookup_kdc = true + + [realms] + DEV.COMPANY.COM = { + kdc = dc01.dev.company.com + } + PROD.COMPANY.COM = { + kdc = dc01.prod.company.com + } + + [domain_realm] + .dev.company.com = DEV.COMPANY.COM + dev.company.com = DEV.COMPANY.COM + .prod.company.com = PROD.COMPANY.COM + prod.company.com = PROD.COMPANY.COM + @@ -209 +234 @@ For Hyper-V failover clusters, you can add multiple hosts in the same cluster. T - 2. Prepare a CSV file with the following columns: `hostname_or_ip` (required) and `credential_name` (optional). + 2. Prepare a CSV file with the following columns: `hostname_or_ip` (required), `os_credential_name` (optional), and `oracle_credential_name` (optional). @@ -213 +238,3 @@ For Hyper-V failover clusters, you can add multiple hosts in the same cluster. T - * The `credential_name` value, if provided, must match the friendly name of an OS credential that you already configured (SSH or WinRM). + * The `os_credential_name` value, if provided, must match the friendly name of an OS credential that you already configured (SSH, WinRM, or SNMP). Leave empty for servers where you have not yet configured an OS credential. + + * The `oracle_credential_name` value, if provided, must match the friendly name of an Oracle credential that you already configured. @@ -319 +346 @@ WMI namespace | Used by -`root\cimv2` | OS metrics, Hyper-V host metadata, database collection +`root\cimv2` | OS metrics, Hyper-V host metadata, SQL Server collection @@ -322,2 +349,2 @@ WMI namespace | Used by -`root\Microsoft\SqlServer\ComputerManagement*` | Database collection (SQL Server) -`root\Microsoft\SqlServer\ReportServer\*` | Database collection (SSRS) +`root\Microsoft\SqlServer\ComputerManagement*` | SQL Server collection +`root\Microsoft\SqlServer\ReportServer\*` | SQL Server collection (SSRS) @@ -342 +369 @@ For network collection, ensure these conditions are met: -For database (SQL Server) collection, a Windows account (local or domain) belonging to the **Local Administrator Group** is required due to complex WMI objects permission requirements. +For SQL Server collection, a Windows account (local or domain) belonging to the **Local Administrator Group** is required because of complex WMI objects permission requirements. @@ -403,0 +431,46 @@ The discovery tool requires access to: +## Configure Oracle database access + +Configure Oracle database access to collect detailed Oracle database metadata directly through SQL connections. Collected metadata includes CDB and PDB topology, feature usage, and installed options. This data helps you plan Oracle database migrations more accurately. You can collect Oracle Database 12c Release 1 (12.1) and later through direct SQL connections. OS-level fallback detection works with all Oracle versions. + +**Configure Oracle credentials in the discovery tool** + + 1. On the **Discovery tool** page, in the sidebar, choose **Database access**. + + 2. Choose **Add Oracle credential**. + + 3. Provide the following information: + + * **Friendly name** – A descriptive name for this credential (for example, `Oracle Production`). + + * **Port** – The Oracle listener port (default 1521). + + * **Service name** – The Oracle service name for the target database. + + * **Username** – The Oracle service account username. + + * **Password** – The Oracle service account password. + + * **Auto-connect** – Turn on this option to try the credential against all servers in your inventory. Turn off this option to manually assign the credential to specific servers. + + 4. To add more credentials (for example, for different Oracle environments), choose **Add Oracle credential** again. + + 5. Choose **Save**. + + + + +**Credential modes** + +When you configure Oracle credentials, you can choose between two modes: + + * **Manual** – Pin a credential to a specific server. The discovery tool uses that credential exclusively for that server. If the connection fails, no fallback occurs. Fix the credential configuration to resolve the issue. + + * **Auto-connect** – The discovery tool tries each auto-connect credential against every server in your inventory. When a credential succeeds for a server, the discovery tool uses that credential for all subsequent collection rounds. + + + + +**Detection flow** + +When you configure Oracle credentials, the discovery tool first tries a direct SQL connection. If all database credentials fail, the tool falls back to OS-level detection through SSH or WinRM, so you can still discover Oracle installations without database access. +