ODP.NET 23.26.4 brings production ready SQL scripting, stronger application security, updated monitoring, and cleaner pooled sessions

Key Takeaways

  • .NET applications can now run Oracle SQL and PL/SQL scripts from files, cloud storage, REST APIs, or other stream based sources.
  • A new ASP.NET Core provider automatically applies Deep Data Security context with minimal application changes.
  • ODP.NET Deep Data Security no longer requires a human user identity, supporting services and AI agents that operate independently.
  • The release also adds current OpenTelemetry conventions, session state resets, and performance improvements for EF Core and asynchronous operations.

Introduction

I’m proud to announce that ODP.NET 23.26.4 is now available on NuGet with these features:

  • Execute SQL and PL/SQL scripts from .NET
  • Use the Deep Data Security end-user security context provider with ASP.NET Core
  • Configure an optional user identity for Deep Data Security
  • Incorporate new ODP.NET OpenTelemetry attribute tags and semantic conventions
  • Reset each database session to the original application state
  • Benefit from ODP.NET performance improvements

Let’s explore these enhancements.

SQL Script Execution for .NET

As more workloads move to cloud environments and AI agents administer them, organizations need programmatic interfaces for executing SQL and PL/SQL scripts. Command-line tools were generally designed for human operators with privileged access to on-premises databases. AI workloads instead rely on automated processes with least-privilege access, while cloud environments often restrict direct administrative access to database resources.

ODP.NET Core SQL script execution addresses these requirements. .NET applications can execute SQL and PL/SQL commands programmatically from a stream. They can bind script parameters as JSON and receive results as a JSON string.

Now in production with ODP.NET 23.26.4, this capability helps .NET applications apply and automate database changes. Scripts can come from files, blob storage, REST APIs, or any other source that can be read by a .NET StreamReader.

At runtime, an application passes a StreamReader to the OracleCommand.ExecuteStatements extension method. Parameters can be supplied as a JSON document through OracleCommand.SetParametersForExecuteStatements or through the OracleCommand.Parameters collection.

I described ODP.NET SQL script execution in a previous blog post if you want more details.

In short, this feature gives .NET developers and DevOps teams a flexible scripting tool for modern cloud and AI applications.

Deep Data Security: End-User Security Context Provider in ASP.NET Core

The new ODP.NET Deep Data Security (DeepSec) provider model lets ASP.NET Core applications adopt Oracle DeepSec with minimal code changes.

After a one-time setup, existing applications can use DeepSec without explicitly creating or assigning an end-user security context.

Oracle AI Database version 23.26.2 first introduced the feature. I provided an overview of ODP.NET Deep Data Security and its benefits in a previous blog post. Here’s how to use the new provider with ASP.NET Core.

First, install the Oracle.ManagedDataAccess.DependencyInjection NuGet package, configure its settings, and call builder.Services.AddOracleEndUserSecurityContextProvider(builder.Configuration) before builder.Build().

Applications provide end-user security information through the authenticated request. When enabled, ODP.NET discovers and uses the provider implicitly. Immediately before an eligible database operation, the provider builds the security context from the current request and attaches it to the database operation. Requests must use JSON Web Token (JWT) bearer authentication so the provider can access the request context.

Configure the provider in appsettings.json or through the ASP.NET Core IConfiguration model under Oracle.ManagedDataAccess:EndUserSecurityContext. The provider is enabled by default because the EnableEndUserSecurityContextProvider option defaults to true.

Here’s a sample appsettings.json configuration for the end-user security context provider:

{
  "Oracle.ManagedDataAccess": {
    "EndUserSecurityContext": {
      "EnableEndUserSecurityContextProvider": true,
      "Type": "AZURE",
      "TokenUri": "https://<identity-provider-host>/<tenant>/oauth2/v2.0/token",
      "GrantType": "client_credentials",
      "ClientId": "<client-id>",
      "ClientSecret": "<client-secret>",
      "Scope": "<database-token-scope>",
      "TokenRenewalOffsetSeconds": 60,
      "SessionDataRoles": "<role-1>,<role-2>",
      "EndUserContextAttribute": "{\"<namespace>\":{\"<key>\":\"<value>\"}}",
      "FetchGroupsOnScope": "<optional-oci-groups-scope>",
      "RoleClaimType": "ORACLE_DATA_ROLE",
      "AttributeClaimType": "ORACLE_CONTEXT_ATTRIBUTE"
    }
  }
}

Note: In a production app, you would supply the client secret in a more secure manner, such as from vault storage.

Once configured, import Oracle.ManagedDataAccess.DependencyInjection.EndUserSecurityContext and call its registration API before building the host to enable the provider. Here’s a code snippet of what that looks like:

using Oracle.ManagedDataAccess.DependencyInjection.EndUserSecurityContext;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthentication(/* app authentication setup */);
builder.Services.AddAuthorization();

builder.Services.AddOracleEndUserSecurityContextProvider(builder.Configuration);

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();

app.MapGet("/health", () => Results.Ok("ok"));
app.Run();

For more information, see the Deep Data Security End-User Security Context Provider section in the ODP.NET Developer’s Guide. For database set up, review the configuration chapter in the Oracle Deep Data Security Guide.

Deep Data Security: Optional User Identity

Previously, DeepSec required an end-user identity: an access token or username. This release makes the identity optional.

Some services host multiple applications and AI agents in a single database. Each application or agent may use its own connection pool and perform work independently, without acting on behalf of a human user. By removing the identity requirement, DeepSec now supports these services alongside AI agents and human users.

Two new OracleEndUserSecurityContext methods create contexts without a user identity:

  • CreateWithDatabaseAccessToken(string) — creates an end-user security context using only a database access token.
  • CreateWithoutEndUser() — creates a new end-user security context with the same database access token, data role, and attribute values as the current instance except for the end user identity.

New OpenTelemetry Attribute Tags and Semantic Conventions

ODP.NET 23.26.4 supports the latest OpenTelemetry database semantic conventions and attribute names. Deprecated attributes remain available for compatibility.

Developers can configure ODP.NET to emit traces using the latest attributes, deprecated attributes, or both. The changes include:

  • db.name is deprecated; db.namespace replaces it.
  • db.odp.connection.id is deprecated; oracle.db.connection.id replaces it.
  • db.odp.sql_id is deprecated; oracle.db.sql.id replaces it.
  • db.statement is deprecated; db.query.text replaces it.
  • db.system is deprecated; db.system.name replaces it.
  • db.user is deprecated.

To configure the behavior, use one of these settings:

  • OTEL_SEMCONV_STABILITY_OPT_IN environment variable
  • OpenTelemetrySemconvStabilityOptIn .NET configuration setting, or
  • OracleConfiguration.OpenTelemetrySemconvStabilityOptIn property

The configuration sources support the same values. They are:

• database: emit the new tags only;

• database/dup: emit both the deprecated and new tags;

• any other value, or no value: emit the deprecated tags only.

Read more about ODP.NET OpenTelemetry in the ODP.NET Developer’s Guide.

Reset Each Database Session to the Original Application State

When an ODP.NET connection returns to the pool, ODP.NET can reset the client and database session state to the original login state. This prevents state from leaking to the next user who receives the connection. Enable this feature by setting the RESET_STATE database service attribute to LOGIN. ODP.NET Core, managed ODP.NET, and unmanaged ODP.NET support it starting with version 23.26.4.

With this setting, each pooled connection starts with the same session state, reducing artifacts that might persist after a failover.

To learn more about using the RESET_STATE attribute and LOGIN value, read the Application Continuity section of the Oracle Database Development Guide.

ODP.NET Performance Improvements

For this release, ODP.NET includes performance improvements across the provider, including faster EF Core SaveChanges operations and improved asynchronous execution. Performance remains a focus, and we plan to deliver further improvements in upcoming ODP.NET releases in 2027.

Coming Soon

In November, Microsoft will release .NET 11 and EF Core 11. ODP.NET will support both soon afterward, and I will announce availability in future blog posts.

Until then, read more about the ODP.NET 23.26.4 features in the ODP.NET Developer’s Guide and download ODP.NET packages from NuGet Gallery.

FAQs

How does SQL script execution exchange inputs and results?
Applications can bind parameters through JSON or the standard command parameter collection, while execution results are returned as JSON.

How is the Deep Data Security provider enabled?
Install the dependency injection package, configure the provider, and register it before building the ASP.NET Core application. The provider is enabled by default after setup.

Does the release remove older OpenTelemetry attributes?
No. It supports the latest attribute names and conventions while retaining deprecated attributes for compatibility.

What does the new session reset feature do?
It restores pooled database connections to their original login state, helping prevent one user’s session settings from affecting the next user.