この他に参照した資料は以下です。
Azure AD (Entra ID) Tokens: 1. Entra ID App Registrations
Vijay Balebailさんの以下の記事：
Autonomous Databaseの作成
% sql -cloudconfig Wallet_SALESADB.zip admin@salesadb_low
SQLcl: 水 8月 13 11:58:23 2025のリリース25.2 Production
Copyright (c) 1982, 2025, Oracle. All rights reserved.
パスワード (**********?) **************
Last Successful login time: 水 8月 13 2025 11:58:31 +09:00
接続先:
Oracle Database 23ai Enterprise Edition Release 23.0.0.0.0 - for Oracle Cloud and Engineered Systems
Version 23.9.0.25.08
SQL> exit
Oracle Database 23ai Enterprise Edition Release 23.0.0.0.0 - for Oracle Cloud and Engineered Systems
Version 23.9.0.25.08から切断されました
%
Microsoft Entra IDの設定
Oracle Databaseの構成
begin
dbms_cloud_admin.enable_external_authentication(
type => 'AZURE_AD',
params => json_object(
'tenant_id' valiue 'ディレクトリ（テナント）ID',
'application_id' value 'アプリケーション（クライアント）ID',
'application_id_uri' value 'アプリケーションIDのURL'
),
force => true
);
end;
/% sql -cloudconfig Wallet_SALESADB.zip admin@salesadb_low
SQLcl: 水 8月 13 15:07:21 2025のリリース25.2 Production
Copyright (c) 1982, 2025, Oracle. All rights reserved.
パスワード (**********?) **************
Last Successful login time: 水 8月 13 2025 15:07:27 +09:00
接続先:
Oracle Database 23ai Enterprise Edition Release 23.0.0.0.0 - for Oracle Cloud and Engineered Systems
Version 23.9.0.25.08
SQL> begin
2 dbms_cloud_admin.enable_external_authentication(
3 type => 'AZURE_AD',
4 params => json_object(
5 'tenant_id' value '3940511e-****-****-****-01b080952758',
6 'application_id' value '18f462e6-****-****-****-81bc4c70bf64',
7 'application_id_uri' value 'api://18f462e6-****-****-****-81bc4c70bf64'
8 ),
9 force => true
10 );
11 end;
12* /
PL/SQLプロシージャが正常に完了しました。
SQL>
SQL> select name, value from v$parameter where name = 'identity_provider_type';
NAME VALUE
_________________________ ___________
identity_provider_type AZURE_AD
SQL>
alter user mcpuser quota 25m on data;
grant create session to mcpuser;
SQL> create user mcpuser identified globally as 'AZURE_ROLE=MCPUSER_ROLE';
User MCPUSERは作成されました。
SQL> alter user mcpuser quota 25m on data ;
User MCPUSERが変更されました。
QL> grant create table, create view, create sequence, create synonym to mcpuser;
Grantが正常に実行されました。
SQL> grant create session to mcpuser;
Grantが正常に実行されました。
SQL>
begin
ords_admin.enable_schema(
p_enabled => true,
p_schema => 'MCPUSER',
p_url_mapping_type => 'BASE_PATH',
p_url_mapping_pattern => 'mcpuser',
p_auto_rest_auth => false
);
end;
/SQL> begin
2 ords_admin.enable_schema(
3 p_enabled => true,
4 p_schema => 'MCPUSER',
5 p_url_mapping_type => 'BASE_PATH',
6 p_url_mapping_pattern => 'mcpuser',
7 p_auto_rest_auth => false
8 );
9 end;
10* /
PL/SQLプロシージャが正常に完了しました。
SQL>
https://login.windows.net/common/discovery/keys
begin
dbms_network_acl_admin.append_host_ace(
host => '*',
ace => xs$ace_type(
privilege_list => xs$name_list('connect'),
principal_name => 'MCPUSER',
principal_type => xs_acl.ptype_db
)
);
end;
/SQL> begin
2 dbms_network_acl_admin.append_host_ace(
3 host => '*',
4 ace => xs$ace_type(
5 privilege_list => xs$name_list('connect'),
6 principal_name => 'MCPUSER',
7 principal_type => xs_acl.ptype_db
8 )
9 );
10 end;
11* /
PL/SQLプロシージャが正常に完了しました。
SQL> exit
Oracle Database 23ai Enterprise Edition Release 23.0.0.0.0 - for Oracle Cloud and Engineered Systems
Version 23.9.0.25.08から切断されました
%
以上でOracle Databaseの構成は完了です。
MCPサーバーを実行するコンテナの作成
curl -OL https://download.oracle.com/otn_software/java/sqldeveloper/sqlcl-latest.zip
コンテナ・イメージを作成します。
% curl -OL https://download.oracle.com/otn_software/java/sqldeveloper/sqlcl-latest.zip
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 87.8M 100 87.8M 0 0 9.7M 0 0:00:08 0:00:08 --:--:-- 9765k
% podman build -f Dockerfile -t sqlcl-mcp-az
STEP 1/11: FROM oraclelinux:9
STEP 2/11: RUN dnf update -y && dnf install -y sudo passwd unzip ncurses java-21-openjdk-headless && rpm --import https://packages.microsoft.com/keys/microsoft.asc && dnf install -y https://packages.microsoft.com/config/rhel/9.0/packages-microsoft-prod.rpm && dnf install -y azure-cli && dnf clean all
Oracle Linux 9 BaseOS Latest (aarch64) 9.4 MB/s | 91 MB 00:09
Oracle Linux 9 Application Stream Packages (aar 9.3 MB/s | 38 MB 00:04
Last metadata expiration check: 0:00:06 ago on Thu Aug 14 08:30:56 2025.
Dependencies resolved.
==========================================================================================
Package Arch Version Repository Size
==========================================================================================
Upgrading:
alternatives aarch64 1.24-2.0.1.el9 ol9_baseos_latest 36 k
audit-libs aarch64 3.1.5-4.0.1.el9 ol9_baseos_latest 125 k
bzip2-libs aarch64 1.0.8-10.el9_5 ol9_baseos_latest 40 k
chkconfig aarch64 1.24-2.0.1.el9 ol9_baseos_latest 233 k
coreutils aarch64 8.32-39.0.1.el9 ol9_baseos_latest 1.2 M
coreutils-common aarch64 8.32-39.0.1.el9 ol9_baseos_latest 2.1 M
crypto-policies noarch 20250128-1.git5269e22.el9 ol9_baseos_latest 178 k
curl aarch64 7.76.1-31.el9_6.1 ol9_baseos_latest 300 k
dnf noarch 4.14.0-25.0.1.el9 ol9_baseos_latest 532 k
dnf-data noarch 4.14.0-25.0.1.el9 ol9_baseos_latest 46 k
dnf-plugins-core noarch 4.3.0-20.0.1.el9 ol9_baseos_latest 55 k
elfutils-default-yama-scope noarch 0.192-6.el9_6 ol9_baseos_latest 8.4 k
[中略]
inflating: /opt/oracle/sqlcl/lib/antlr-runtime.jar
inflating: /opt/oracle/sqlcl/lib/dbtools-net.jar
inflating: /opt/oracle/sqlcl/lib/reactive-streams.jar
inflating: /opt/oracle/sqlcl/lib/xdb.jar
inflating: /opt/oracle/sqlcl/lib/oci-java-sdk-common.jar
inflating: /opt/oracle/sqlcl/lib/orajsoda.jar
inflating: /opt/oracle/sqlcl/lib/quartz.jar
inflating: /opt/oracle/sqlcl/lib/javassist.jar
--> 3a923251c0a0
STEP 11/11: CMD ["/opt/oracle/sqlcl/bin/sql","-mcp"]
COMMIT sqlcl-mcp-az
--> 00832d5028d3
Successfully tagged localhost/sqlcl-mcp-az:latest
00832d5028d3ee88a07c8ff16429b86c4602ccbb9d73f011cee0e5ca9567ed35
%
podman volume create mcp-az-conf
% podman volume create mcp-az-conf
mcp-az-conf
%
プラットフォームがARMの場合、以下のような警告が表示されることがあります。
OpenJDK 64-Bit Server VM warning: Unable to get SVE vector length on this system. Disabling SVE. Specify -XX:UseSVE=0 to shun this warning.
警告を回避するには-e JAVA_TOOL_OPTIONS="-XX:UseSVE=0"の指定を追加します。
% podman run --rm --name mcp-az -v mcp-az-conf:/home/oracle -v $PWD:/opt/oracle/wallets sqlcl-mcp-az:latest
OpenJDK 64-Bit Server VM warning: Unable to get SVE vector length on this system. Disabling SVE. Specify -XX:UseSVE=0 to shun this warning.
---------- MCP SERVER STARTUP ----------
MCP Server started successfully on Thu Aug 14 08:37:47 UTC 2025
Press Ctrl+C to stop the server
----------------------------------------
podman exec -it mcp-az bash
% podman exec -it mcp-az bash
[oracle@5e225a402c67 ~]$
unzip -d tns_admin /opt/oracle/wallets/Wallet_SALESADB.zip
[oracle@5e225a402c67 ~]$ cd
[oracle@5e225a402c67 ~]$ unzip -d tns_admin /opt/oracle/wallets/Wallet_SALESADB.zip
Archive: /opt/oracle/wallets/Wallet_SALESADB.zip
inflating: tns_admin/ewallet.pem
inflating: tns_admin/README
inflating: tns_admin/cwallet.sso
inflating: tns_admin/tnsnames.ora
inflating: tns_admin/truststore.jks
inflating: tns_admin/ojdbc.properties
inflating: tns_admin/sqlnet.ora
inflating: tns_admin/ewallet.p12
inflating: tns_admin/keystore.jks
[oracle@5e225a402c67 ~]$
(TOKEN_AUTH=OAUTH)(TOKEN_LOCATION=/home/oracle/token.txt)
salesadb_high = (description= (retry_count=20)(retry_delay=3)(address=(protocol=tcps)(port=1522)(host=adb.ca-toronto-1.oraclecloud.com))(connect_data=(service_name=ge15xxxxxxxx7f_salesadb_high.adb.oraclecloud.com))(security=(ssl_server_dn_match=yes)(TOKEN_AUTH=OAUTH)(TOKEN_LOCATION=/home/oracle/token.txt)))
salesadb_low = (description= (retry_count=20)(retry_delay=3)(address=(protocol=tcps)(port=1522)(host=adb.ca-toronto-1.oraclecloud.com))(connect_data=(service_name=ge15xxxxxxxx7f_salesadb_low.adb.oraclecloud.com))(security=(ssl_server_dn_match=yes)(TOKEN_AUTH=OAUTH)(TOKEN_LOCATION=/home/oracle/token.txt)))
salesadb_medium = (description= (retry_count=20)(retry_delay=3)(address=(protocol=tcps)(port=1522)(host=adb.ca-toronto-1.oraclecloud.com))(connect_data=(service_name=ge15xxxxxxxx7f_salesadb_medium.adb.oraclecloud.com))(security=(ssl_server_dn_match=yes)(TOKEN_AUTH=OAUTH)(TOKEN_LOCATION=/home/oracle/token.txt)))[oracle@5e225a402c67 ~]$ az login --tenant "3940511e-****-****-****-01b080952758" --scope "api://bf8221de-****-****-****-220e08ef7cf7/session:scope:connect"
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code NTUMDPZ8P to authenticate.
[oracle@5e225a402c67 ~]$ az login --tenant "3940511e-****-****-****-01b080952758" --scope "api://bf8221de-****-****-****-220e08ef7cf7/session:scope:connect"
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code NTUMDPZ8P to authenticate.
Retrieving subscriptions for the selection...
[Tenant and subscription selection]
No Subscription name Subscription ID Tenant
----- -------------------- ------------------------------------ ------------------------------------
[1] * Azure subscription 1 7adac3cb-****-****-****-2db0b2827b71 3940511e-****-****-****-01b080952758
The default is marked with an *; the default tenant is '3940511e-****-****-****-01b080952758' and subscription is 'Azure subscription 1' (7adac3cb-****-****-****-2db0b2827b71).
Select a subscription and tenant (Type a number or Enter for no changes):
Tenant: 3940511e-****-****-****-01b080952758
Subscription: Azure subscription 1 (7adac3cb-****-****-****-2db0b2827b71)
[Announcements]
With the new Azure CLI login experience, you can select the subscription you want to use more easily. Learn more about it and its configuration at https://go.microsoft.com/fwlink/?linkid=2271236
If you encounter any problem, please open an issue at https://aka.ms/azclibug
[Warning] The login output has been updated. Please be aware that it no longer displays the full list of available subscriptions by default.
[oracle@5e225a402c67 ~]$
az account get-access-token --scope "api://アプリケーションID URL/session:scope:connect" --query accessToken -o tsv > /home/oracle/token.txt
[oracle@5e225a402c67 ~]$ az account get-access-token --scope "api://bf8221de-****-****-****-220e08ef7cf7/session:scope:connect" --query accessToken -o tsv > /home/oracle/token.txt
[oracle@5e225a402c67 ~]$
connect -save salesadb -savepwd /@salesadb_low
[oracle@5e225a402c67 ~]$ /opt/oracle/sqlcl/bin/sql /nolog
OpenJDK 64-Bit Server VM warning: Unable to get SVE vector length on this system. Disabling SVE. Specify -XX:UseSVE=0 to shun this warning.
SQLcl: Release 25.2 Production on Thu Aug 14 08:58:47 2025
Copyright (c) 1982, 2025, Oracle. All rights reserved.
SQL> connect -save salesadb -savepwd /@salesadb_low
Name: salesadb
Connect String: salesadb_low
User:
Password: not saved
Connected.
SQL>
select
sys_context('userenv','session_user') as session_user,
sys_context('userenv','current_user') as current_user,
sys_context('userenv','authenticated_identity') as azure_user
from dual;SQL> select
2 sys_context('userenv','session_user') as session_user,
3 sys_context('userenv','current_user') as current_user,
4 sys_context('userenv','authenticated_identity') as azure_user
5* from dual;
SESSION_USER CURRENT_USER AZURE_USER
_______________ _______________ _____________________________________________________________
MCPUSER MCPUSER yuji.n****_outlook.com_EXT_@*******soutlook.onmicrosoft.com
SQL>
データベース・ユーザーMCPUSERとして接続されています。Entra IDで認証されたユーザーは、システム・コンテキストのUSERENVにAUTHENTICATED_IDENTITYとして設定されています。
podman stop mcp-az
% podman stop mcp-az
mcp-az
%
このMCPサーバーをClaude Desktopに追加する記述です。
{
"mcpServers": {
"sqlcl": {
"command": "podman",
"args": [
"run",
"-i",
"--rm",
"-v",
"mcp-az-conf:/home/oracle",
"localhost/sqlcl-mcp-az:latest"
]
}
}
}
