Introduction
When attempting to open a plugged-in pluggable database (PDB) that contains encrypted tablespaces, the following error is raised: “TEST(5):ALTER PLUGGABLE DATABASE OPEN” detects that an encrypted tablespace has been restored but the master key has not been set for the database, or the database has been flashback’ed prior to first set key of the master key (pdb 5).
A corresponding entry appears in PDB_PLUG_IN_VIOLATIONS:
Cause: Wallet Key Needed
Message: PDB needs to import keys from source
The PDB typically opens in READ WRITE RESTRICTED mode.
Impact
Encrypted tablespaces are inaccessible
PDB remains in restricted mode
Application services may fail to start
Migration or plug-in operation is incomplete
Verification
Execute the following queries:
SELECT name, cause, type, message, status FROM pdb_plug_in_violations WHERE type = ‘ERROR’;
SELECT con_id, wrl_parameter, wrl_type, wallet_type, status FROM v$encryption_wallet;
CON_ID WRL_PARAMETER WRL_TYPE WALLET_TYPE STATUS
———- ——————————————— ——– ————-
1 /opt/oracle/dcs/commonstore/wallets/test/tde FILE PASSWORD OPEN
2 FILE UNKNOWN CLOSED
3 FILE AUTOLOGIN OPEN_NO_MASTER_KEY
Root Cause
The source database had Transparent Data Encryption (TDE) enabled and contained encrypted tablespaces. After the PDB was plugged into the target CDB, the required TDE master encryption key was not present in the target keystore.
Oracle requires the master key for each encrypted PDB to exist in the target keystore. Without it, the database cannot decrypt the datafiles and raises a PDB plug-in violation.
Resolution
The issue is resolved by opening the keystore, setting or recovering the master key, exporting the encryption keys from the source, and importing them into the affected PDB.
Procedure
Check wallet status
SELECT con_id, wrl_parameter, wrl_type, wallet_type, status FROM v$encryption_wallet;
(If required) Enable recovery from a missing master key. Use only if the original master key is unavailable.
ALTER SYSTEM SET “_db_discard_lost_masterkey” = TRUE SCOPE=MEMORY;
Set a new TDE master key
ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY “<keystore_password>” WITH BACKUP;
Export encryption keys
ADMINISTER KEY MANAGEMENT EXPORT ENCRYPTION KEYS WITH SECRET “<export_secret>” TO ‘/tmp/tde_wallet.exp’ IDENTIFIED BY <keystore_password>;
Switch to the affected PDB
ALTER SESSION SET CONTAINER = TEST;
Open the keystore in the PDB
ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY “<keystore_password>”
Import encryption keys
ADMINISTER KEY MANAGEMENT IMPORT KEYS WITH SECRET “<export_secret>” FROM ‘/tmp/tde_wallet.exp’IDENTIFIED BY <keystore_password> WITH BACKUP;
Restart the PDB
ALTER PLUGGABLE DATABASE TEST CLOSE IMMEDIATE;
ALTER PLUGGABLE DATABASE TEST OPEN;
Validation
SELECT name, cause, type, message, status FROM pdb_plug_in_violations WHERE type = ‘ERROR’;
Expected result:
No rows returned or the status shows RESOLVED.
Check wallet:
SELECT con_id, wallet_type, status FROM v$encryption_wallet;
Expected:
STATUS = OPEN
Verify PDB mode:
SHOW PDBS;
Expected: PDB in READ WRITE mode, not restricted.
Conclusion
The “Wallet Key Needed” PDB plug-in violation occurs when encrypted tablespaces exist without a corresponding master key in the target keystore. Importing the correct TDE keys resolves the violation and restores full access to the PDB.
