Add support to configure system password for Oracle database by cetindogu · Pull Request #10601 · testcontainers/testcontainers-java

cetindogu · 2025-08-12T11:35:49Z

…; fix ORACLE_PASSWORD mapping

Introduce an independent system user password for Oracle containers and map it correctly to the ORACLE_PASSWORD env.

Add withOraclePassword(String) to configure SYSTEM/SYS password independently from the app user password
Use system password in SID connections (getPassword returns system password in SID mode)
Keep backward compatibility: withPassword also sets system password unless withOraclePassword was called
Update Oracle XE and Oracle Free containers to use the new internal oraclePassword
Add OracleContainerTest to verify system vs app password behavior in SID and non-SID modes

This resolves the issue where ORACLE_PASSWORD was effectively bound to the app user password, making it impossible to set the system user password correctly.

Summary

Fix Oracle container password handling so ORACLE_PASSWORD configures the system user (SYSTEM/SYS) password, not the app user’s password. Add withOraclePassword(String) to configure it independently while keeping backward compatibility.

Problem

ORACLE_PASSWORD was populated from the application user password.
In SID mode, getUsername() returns system, but getPassword() returned the app user’s password, causing authentication mismatches and preventing a distinct system user password.

Changes

Add a dedicated system user password field and API:
- New: withOraclePassword(String oraclePassword) for SYSTEM/SYS.
- Existing: withPassword(String password) continues to set the application user password.
Correct container env mapping:
- ORACLE_PASSWORD ← system user password.
- APP_USER_PASSWORD ← app user password.
In SID mode, use the system credentials:
- getUsername() returns system.
- getPassword() now returns the system password.
Backward compatibility:
- If withOraclePassword(...) is not used, withPassword(...) sets both the app and system passwords (preserving previous behavior).

Why `getPassword()` changed

return isUsingSid() ? oraclePassword : password;

In SID mode we authenticate as system. Returning the app user’s password was incorrect and led to login failures. Now the password matches the user being used.

Affected modules

testcontainers-oracle-xe
testcontainers-oracle-free

Tests

Extended existing SimpleOracleTest (no new test classes):
- SID tests run a system-level statement to validate the system password.
- Non-SID tests validate the app user password.
- Added cases verifying independent system vs app passwords.

Usage examples

// Different passwords for SYSTEM and app user
new OracleContainer(IMAGE)
  .withOraclePassword("SysP@ss1!")
  .withPassword("AppP@ss1!")
  .start();

// SID mode (connects as SYSTEM → uses system password)
new OracleContainer(IMAGE)
  .usingSid()
  .withOraclePassword("SysOnly")
  .start();

Migration / Compatibility

No breaking change.
Existing usage of .withPassword(...) continues to work (sets both passwords unless .withOraclePassword(...) is used).
Use .withOraclePassword(...) to set a distinct system password.

How to verify locally

Style and formatting:
- Unix/macOS: ./gradlew checkstyleMain checkstyleTest spotlessApply
- Windows: .\gradlew.bat checkstyleMain checkstyleTest spotlessApply
Run module tests:
- ./gradlew :testcontainers-oracle-xe:test :testcontainers-oracle-free:test

Documentation

Clarify:
- ORACLE_PASSWORD configures the SYSTEM/SYS password.
- APP_USER_PASSWORD configures the app user’s password.

Changelog entry

feat(oracle): add withOraclePassword and fix ORACLE_PASSWORD mapping to system user; use system password in SID mode; maintain backward compatibility with withPassword.

Related issues

(If applicable) Fixes: #

…; fix ORACLE_PASSWORD mapping Introduce an independent system user password for Oracle containers and map it correctly to the ORACLE_PASSWORD env. - Add withOraclePassword(String) to configure SYSTEM/SYS password independently from the app user password - Use system password in SID connections (getPassword returns system password in SID mode) - Keep backward compatibility: withPassword also sets system password unless withOraclePassword was called - Update Oracle XE and Oracle Free containers to use the new internal oraclePassword - Add OracleContainerTest to verify system vs app password behavior in SID and non-SID modes This resolves the issue where ORACLE_PASSWORD was effectively bound to the app user password, making it impossible to set the system user password correctly.

eddumelendez

Hi, thanks for your contribution. Rename the new method to withSystemPassword instead to make it more aligned with the Oracle database user instead of the env var. Regarding to the comments, please revisit it.

eddumelendez · 2025-08-13T02:27:40Z

modules/oracle-free/src/main/java/org/testcontainers/oracle/OracleContainer.java

+     * Password for Oracle system user (e.g. SYSTEM/SYS). Defaults to {@link #APP_USER_PASSWORD}
+     * for backwards compatibility, but can be customized independently via {@link #withOraclePassword(String)}.
+     */
+    private String oraclePassword = APP_USER_PASSWORD;


Suggested change

private String oraclePassword = APP_USER_PASSWORD;

private String systemPassword = APP_USER_PASSWORD;

eddumelendez · 2025-08-13T02:27:56Z

modules/oracle-free/src/main/java/org/testcontainers/oracle/OracleContainer.java

+     * @param oraclePassword password for SYSTEM/SYS users inside the container
+     * @return this container instance
+     */
+    public OracleContainer withOraclePassword(String oraclePassword) {


Suggested change

public OracleContainer withOraclePassword(String oraclePassword) {

public OracleContainer withSystemPassword(String oraclePassword) {

eddumelendez · 2025-08-13T02:28:13Z

modules/oracle-free/src/main/java/org/testcontainers/oracle/OracleContainer.java

+     * Tracks whether {@link #withOraclePassword(String)} was called to avoid overriding
+     * the system password when {@link #withPassword(String)} is used for the application user only.
+     */
+    private boolean oraclePasswordExplicitlySet = false;


Suggested change

private boolean oraclePasswordExplicitlySet = false;

private boolean systemPasswordExplicitlySet = false;

eddumelendez · 2025-08-13T02:29:48Z

modules/oracle-xe/src/test/java/org/testcontainers/junit/oracle/SimpleOracleTest.java


+    private void runTestSystemUser(OracleContainer container, String databaseName, String username, String password)
+        throws SQLException {
+        //Test config was honored


remove the comment

eddumelendez · 2025-08-13T02:29:54Z

modules/oracle-xe/src/test/java/org/testcontainers/junit/oracle/SimpleOracleTest.java

+        assertThat(container.getUsername()).isEqualTo(username);
+        assertThat(container.getPassword()).isEqualTo(password);
+
+        //Test we can get a connection and execute a system-level command


remove the comment

eddumelendez · 2025-08-13T02:30:00Z

modules/oracle-xe/src/test/java/org/testcontainers/junit/oracle/SimpleOracleTest.java

+
+    @Test
+    public void testSeparateSystemAndAppPasswords() throws SQLException {
+        // SID mode should use system password


remove the comment

eddumelendez · 2025-08-13T02:30:07Z

modules/oracle-xe/src/test/java/org/testcontainers/junit/oracle/SimpleOracleTest.java

+            runTestSystemUser(oracleSid, "xepdb1", "system", "SysP@ss1!");
+        }
+
+        // Non-SID mode should use application user's password


remove the comment

eddumelendez · 2025-08-13T02:30:36Z

modules/oracle-xe/src/test/java/org/testcontainers/junit/oracle/SimpleOracleTest.java

+    }
+
+    @Test
+    public void testSeparateSystemAndAppPasswords() throws SQLException {


should have two tests instead?

eddumelendez · 2025-09-24T21:35:17Z

@cetindogu can you take a look at the comments I left?

cetindogu · 2025-09-25T09:35:56Z

Very nice suggestions, i will update PR. Thanks for the comments

@cetindogu can you take a look at the comments I left?

…ssword refactor (OracleContainer): oraclePassword rename to systemPassword refactor (OracleContainer): oraclePasswordExplicitlySet rename to systemPasswordExplicitlySet

cetindogu · 2025-09-26T12:39:17Z

@eddumelendez re-check plz

eddumelendez · 2025-09-30T00:36:27Z

@cetindogu tests are failing. can you check, please?

…DBA grant The test now checks the connected session's user rather than verifying DBA grant status, which provides a more direct validation of the system user connection.

cetindogu · 2025-11-20T12:40:37Z

@eddumelendez

commit: 63752c5

fyi.

cetindogu · 2025-11-20T12:51:25Z

development note1:

The purpose of this test is to prove that the SID connection is indeed logged in as SYSTEM/SYS. runTestSystemUser does just that by comparing the output of SELECT USER FROM DUAL from the session we're currently connected to with the expected username.

development note2:

runTestSystemUser previously used GRANT DBA TO …, a DDL statement that returns no ResultSet, so AbstractContainerDatabaseTest.performQuery()
hit a NullPointerException when calling resultSet.next() @modules/jdbc-test/src/main/java/org/testcontainers/db/AbstractContainerDatabaseTest.java#15-23.
The goal of the test is simply to ensure SID mode actually logs in as the system account. Switching to a side-effect-free query (SELECT USER FROM DUAL) lets us verify the connected user and avoids the NPE, fulfilling the same intent safely @modules/oracle-xe/src/test/java/org/testcontainers/junit/oracle/SimpleOracleTest.java#34-45.

cetindogu · 2026-01-12T08:33:33Z

@eddumelendez, anything left ?

Copilot

Pull request overview

This PR fixes Oracle container password handling by separating the Oracle system user (SYSTEM/SYS) password from the application user password, ensuring ORACLE_PASSWORD maps to the system password and SID-mode connections authenticate with the correct credentials.

Changes:

Introduces a dedicated system-user password field and uses it for ORACLE_PASSWORD and SID-mode getPassword().
Preserves backward compatibility by having withPassword(...) also set the system password unless explicitly overridden.
Extends Oracle XE/Free tests to validate system vs app password behavior in SID and non-SID modes.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
modules/oracle-xe/src/main/java/org/testcontainers/containers/OracleContainer.java	Adds separate system password handling and maps `ORACLE_PASSWORD` to it; uses system password in SID mode.
modules/oracle-free/src/main/java/org/testcontainers/oracle/OracleContainer.java	Same as XE, with an internal field for the system password and updated `ORACLE_PASSWORD` mapping.
modules/oracle-xe/src/test/java/org/testcontainers/junit/oracle/SimpleOracleTest.java	Adds SID-focused assertions to verify the connected user and password behavior.
modules/oracle-free/src/test/java/org/testcontainers/junit/oracle/SimpleOracleTest.java	Adds SID-focused tests for system/app password separation (but currently includes a failing SQL assertion approach).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot · 2026-03-12T22:53:10Z

modules/oracle-free/src/main/java/org/testcontainers/oracle/OracleContainer.java

+    /**
+     * Sets the password for the Oracle system user (SYSTEM/SYS). This is independent from the
+     * application user password set via {@link #withPassword(String)}.
+     *
+     * @param oraclePassword password for SYSTEM/SYS users inside the container
+     * @return this container instance
+     */
+    public OracleContainer withSystemPassword(String oraclePassword) {
+        if (StringUtils.isEmpty(oraclePassword)) {
+            throw new IllegalArgumentException("Oracle password cannot be null or empty");
+        }
+        this.oraclePassword = oraclePassword;
+        this.systemPasswordExplicitlySet = true;
        return self();


The PR description/docs mention withOraclePassword(String) as the new API, but this module adds withSystemPassword(String) instead. Because this is part of the public container API, please align the method name with the documented API (or update the docs/PR description to match), and consider an alias/deprecation plan to avoid confusing users.

Copilot · 2026-03-12T22:53:10Z

modules/oracle-free/src/main/java/org/testcontainers/oracle/OracleContainer.java

+    /**
+     * Password for Oracle system user (e.g. SYSTEM/SYS). Defaults to {@link #APP_USER_PASSWORD}
+     * for backwards compatibility, but can be customized independently via {@link #withSystemPassword(String)}.
+     */
+    private String oraclePassword = APP_USER_PASSWORD;
+
+    /**
+     * Tracks whether {@link #withSystemPassword(String)} was called to avoid overriding
+     * the system password when {@link #withPassword(String)} is used for the application user only.
+     */
+    private boolean systemPasswordExplicitlySet = false;


In this class the system-user password is stored in a field named oraclePassword, while related state is systemPasswordExplicitlySet and the other Oracle module uses systemPassword. This inconsistency makes it harder to reason about which password is which (system vs app) and increases the chance of future mapping bugs. Consider standardizing the field name (e.g., systemPassword) and updating references accordingly.

Copilot · 2026-03-12T22:53:10Z

modules/oracle-xe/src/main/java/org/testcontainers/containers/OracleContainer.java

+        // Maintain backwards compatibility: if oracle password wasn't set explicitly,
+        // align it with the application user's password.
+        if (!systemPasswordExplicitlySet) {
+            this.systemPassword = password;
+        }


The inline comment says "if oracle password wasn't set explicitly" but the code is tracking the system password via systemPasswordExplicitlySet. Updating the comment to refer to the system password would avoid confusion when maintaining this logic.

Copilot · 2026-03-12T22:53:10Z

modules/oracle-free/src/test/java/org/testcontainers/junit/oracle/SimpleOracleTest.java

+        //Test we can get a connection and execute a system-level command
+        container.start();
+        ResultSet resultSet = performQuery(container, "GRANT DBA TO " + username);
+        int resultSetInt = resultSet.getInt(1);
+        assertThat(resultSetInt).as("A basic system user query succeeds").isEqualTo(1);


performQuery(...) expects the SQL to produce a ResultSet (it calls Statement#getResultSet() and then resultSet.next()). GRANT DBA TO ... does not return a result set, so statement.getResultSet() will be null and this test will fail with a NullPointerException. Use a SELECT-based assertion (e.g., SELECT USER FROM DUAL) or change the helper to use executeUpdate/check update count for DDL/DCL statements.

Copilot · 2026-03-12T22:53:11Z

modules/oracle-xe/src/main/java/org/testcontainers/containers/OracleContainer.java

+    /**
+     * Sets the password for the Oracle system user (SYSTEM/SYS). This is independent from the
+     * application user password set via {@link #withPassword(String)}.
+     *
+     * @param oraclePassword password for SYSTEM/SYS users inside the container
+     * @return this container instance
+     */
+    public OracleContainer withSystemPassword(String oraclePassword) {
+        if (StringUtils.isEmpty(oraclePassword)) {
+            throw new IllegalArgumentException("Oracle password cannot be null or empty");
+        }
+        this.systemPassword = oraclePassword;
+        this.systemPasswordExplicitlySet = true;
        return self();


The PR description and usage examples refer to a new public API withOraclePassword(String), but the implementation introduces withSystemPassword(String) instead. Since this is a user-facing API, please either rename the method to match the documented API (and keep withSystemPassword as a deprecated alias if needed), or update the PR description/docs accordingly so users know which method to call.

github-actions bot added the modules/oracle label Aug 12, 2025

eddumelendez added the type/enhancement label Aug 12, 2025

eddumelendez changed the title ~~feat(oracle): add separate system password and withOraclePassword API…~~ Add support to configure system password for Oracle database Aug 13, 2025

eddumelendez requested changes Aug 13, 2025

View reviewed changes

eddumelendez requested a review from a team as a code owner August 19, 2025 16:51

Merge branch 'main' into main

1630f95

cetindogu added 2 commits September 26, 2025 14:16

Merge remote-tracking branch 'upstream/main'

ec95b8f

refactor (OracleContainer): withOraclePassword rename to withSystemPa…

6e0ac92

…ssword refactor (OracleContainer): oraclePassword rename to systemPassword refactor (OracleContainer): oraclePasswordExplicitlySet rename to systemPasswordExplicitlySet

cetindogu requested a review from eddumelendez September 26, 2025 12:39

cetindogu added 2 commits November 20, 2025 15:28

fix (test)(oracle-xe): update test to verify current user instead of …

63752c5

…DBA grant The test now checks the connected session's user rather than verifying DBA grant status, which provides a more direct validation of the system user connection.

Merge branch 'testcontainers:main' into main

3e63f05

eddumelendez force-pushed the main branch from b45c488 to 5f96a1b Compare December 2, 2025 21:09

Merge branch 'main' into main

bf19086

Merge branch 'main' into main

5171d96

eddumelendez requested a review from Copilot March 12, 2026 22:49

Copilot started reviewing on behalf of eddumelendez March 12, 2026 22:50 View session

Copilot AI reviewed Mar 12, 2026

View reviewed changes

	private String oraclePassword = APP_USER_PASSWORD;
	private String systemPassword = APP_USER_PASSWORD;

	public OracleContainer withOraclePassword(String oraclePassword) {
	public OracleContainer withSystemPassword(String oraclePassword) {

	private boolean oraclePasswordExplicitlySet = false;
	private boolean systemPasswordExplicitlySet = false;

Uh oh!

Conversation

cetindogu commented Aug 12, 2025

Summary

Problem

Changes

Why getPassword() changed

Affected modules

Tests

Usage examples

Migration / Compatibility

How to verify locally

Documentation

Changelog entry

Related issues

Uh oh!

eddumelendez left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

eddumelendez commented Sep 24, 2025

Uh oh!

cetindogu commented Sep 25, 2025

Uh oh!

cetindogu commented Sep 26, 2025

Uh oh!

eddumelendez commented Sep 30, 2025

Uh oh!

cetindogu commented Nov 20, 2025

Uh oh!

cetindogu commented Nov 20, 2025

development note1:

development note2:

Uh oh!

cetindogu commented Jan 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Why `getPassword()` changed