How to Clone PDB with TDE

Before entering our topic, I assumed that you have already know how to clone a PDB to another CDB.

In this post, I will show how to clone a PDB from a Transparent Data Encryption (TDE) enabled database.

1. Make sure the wallet is open in the target CDB.

SQL> select con_id, wallet_type, status from v$encryption_wallet;

    CON_ID WALLET_TYPE          STATUS
---------- -------------------- --------------------
         1 AUTOLOGIN            OPEN
         2 AUTOLOGIN            OPEN
         3 AUTOLOGIN            OPEN

If the wallet is not open, you will see error ORA-28365: wallet is not open.

If the target CDB didn't have TDE, you should configure and enable the wallet for the database.

2. Enable ONE_STEP_PLUGIN_FOR_PDB_WITH_TDE

For reducing manual intervention during cloning, we can enable ONE_STEP_PLUGIN_FOR_PDB_WITH_TDE whitin both scope.

SQL> alter system set one_step_plugin_for_pdb_with_tde=TRUE scope=both sid='*';

System altered.

SQL> show parameter one_step_plugin_for_pdb_with_tde;

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
one_step_plugin_for_pdb_with_tde     boolean     TRUE

3. Specify KEYSTORE clause in the statement.

You have to provide the credential of the wallet in order to copy data files from one to another.

SQL> create pluggable database finance_pdb from finanpdb@link_to_test1 file_name_convert=('/u01/app/oracle/oradata/orcl/FINANPDB','/u01/app/oracle/oradata/orcl/FINANCE_PDB') keystore identified by "welcome1" parallel 8;

Pluggable database created.

If the patch level of the target container is higher than the source container, you should perform a datapatch to make the cloned PDB align with the container.