oci-dbm-enable

name	oci-dbm-enable
description	Enables OCI Database Management on an Autonomous Database using the correct feature API with Private Endpoint connector and vault credentials. Handles the false-positive state from the old API. Trigger when a user says "enable DBM on my ADB", "enable database management", "DBM jobs not working", or when oci-dbm-commission directs here as the final step.

oci-dbm-enable

This skill is the final worker in the oci-dbm-commission chain. It does NOT generate scripts. It uses the OCI Python SDK directly to enable OCI Database Management on an Autonomous Database using the feature-based API (enable_autonomous_database_management_feature), which establishes real TCPS connectivity via a Private Endpoint and vault-stored credentials.

This skill must run after oci-dbm-network and oci-dbm-vault have completed successfully.

---

Inputs

These values are passed by oci-dbm-commission (collected from earlier skills in the chain):

Input	Description	Example
adb_ocid	OCID of the target Autonomous Database	ocid1.autonomousdatabase.oc1.iad.aaa...
dbm_pe_ocid	OCID of the DBM Private Endpoint (from oci-dbm-network)	ocid1.dbmgmtprivateendpoint.oc1...
secret_ocid	OCID of the vault secret holding the ADMIN password (from oci-dbm-vault)	ocid1.vaultsecret.oc1.iad.aaa...
full_service_name	Full qualified service name from connection_strings.medium (from oci-dbm-provision or retrieved fresh)	ep8c8t82piuc9mv_dbmdemo_medium.adb.oraclecloud.com
compartment_ocid	OCID of the compartment containing the ADB	ocid1.compartment.oc1..aaa...

---

What This Skill Executes

Step 0 (Conditional) — Detect and Clear False-Positive DBM State

Call DatabaseClient.get_autonomous_database(adb_id=adb_ocid) and inspect:

• adb.database_management_status
• adb.additional_details (specifically the key 'databasePorts')

If database_management_status == 'ENABLED' and additional_details.get('databasePorts') is empty, '[ ]', or absent:

This indicates DBM was previously enabled via the old DatabaseClient.enable_autonomous_database_management() API. That API marks the database as ENABLED but does not establish real TCPS connectivity. Jobs, performance hub, and SQL monitoring will not work.

Take the following action:

1. Print an explanation to the user:

   "DBM is currently shown as ENABLED, but was activated via the legacy API without a Private Endpoint connector. This does not establish real connectivity. Disabling now so we can re-enable correctly."

2. Call DatabaseClient.disable_autonomous_database_management(autonomous_database_id=adb_ocid).
3. Poll get_autonomous_database() every 30 seconds until database_management_status is 'NOT_ENABLED' or 'DISABLED'.
4. Confirm the disable completed before continuing.

If database_management_status is already 'NOT_ENABLED' or 'DISABLED', skip this step entirely.

Step 1 — Retrieve full_service_name If Not Provided

If full_service_name was not passed as input (or is empty):

Call DatabaseClient.get_autonomous_database(adb_id=adb_ocid) and extract adb.connection_strings.medium.

Print the retrieved value. Confirm it contains the expected db_name substring before proceeding.

Step 2 — Enable DBM via the Feature API

Call DbManagementClient.enable_autonomous_database_management_feature() with:

from oci.database_management.models import (
    EnableAutonomousDatabaseManagementFeatureDetails,
    AutonomousDatabaseDiagnosticsAndManagementFeatureDetails,
    DatabaseConnectionDetails,
    PrivateEndPointConnectorDetails,
    BasicDatabaseConnectionStringDetails,
    DatabaseConnectionCredentialsByDetails,
)

# The top-level wrapper takes a single `feature_details` field.
# `feature='DIAGNOSTICS_AND_MANAGEMENT'` is set automatically by the subclass.
feature_details = AutonomousDatabaseDiagnosticsAndManagementFeatureDetails(
    connector_details=PrivateEndPointConnectorDetails(
        connector_type='PE',
        private_end_point_id=dbm_pe_ocid
    ),
    database_connection_details=DatabaseConnectionDetails(
        connection_string=BasicDatabaseConnectionStringDetails(
            connection_type='BASIC',
            service=full_service_name,
            port=1522,
            protocol='TCPS'
        ),
        connection_credentials=DatabaseConnectionCredentialsByDetails(
            credential_type='DETAILS',
            user_name='ADMIN',
            password_secret_id=secret_ocid,
            role='NORMAL'
        )
    )
)

enable_details = EnableAutonomousDatabaseManagementFeatureDetails(
    feature_details=feature_details
)

dbm_client.enable_autonomous_database_management_feature(
    autonomous_database_id=adb_ocid,
    enable_autonomous_database_management_feature_details=enable_details
)

Key parameters:

• port=1522 — not 1521
• protocol='TCPS' — TLS-only
• service=full_service_name — the full qualified name, not the short db_name
• password_secret_id=secret_ocid — the vault secret OCID from oci-dbm-vault

Step 3 — Poll Until ENABLED

Poll DatabaseClient.get_autonomous_database(adb_id=adb_ocid) every 60 seconds.

Wait for database_management_status == 'ENABLED'.

After each poll print: [HH:MM:SS] database_management_status = <value>

Once ENABLED, call DbManagementClient.get_managed_database(managed_db_id) and check db.additional_details.get('databasePorts'). It should equal '[ 1522 ]'. This confirms the feature API was used (not the legacy path).

Note: databasePorts is in additional_details on the ManagedDatabase object (from get_managed_database), not on the ADB object from DatabaseClient.

Step 4 — Confirm in Managed Databases List

Call DbManagementClient.list_managed_databases(compartment_id=compartment_ocid) and filter for the database matching adb_ocid or the db_name.

Print:

• name
• database_type
• database_sub_type
• deployment_type

A successful enablement will show database_sub_type = 'ADB_S' (ADB Shared) and deployment_type = 'AUTONOMOUS'.

---

Confirmation Before Finishing

Before reporting success, verify:

• DatabaseClient.get_autonomous_database() returns database_management_status = ENABLED
• DbManagementClient.get_managed_database(id).additional_details['databasePorts'] is '[ 1522 ]' — confirms feature API path, not legacy API
• DbManagementClient.list_managed_databases() returns the ADB in the managed databases list

All three must pass.

---

What This Skill Hands Back

Final output to oci-dbm-commission:

adb_ocid: <ocid>
database_management_status: ENABLED
database_ports: [1522]
managed_database_name: <name>
dbm_enable_complete: true

---

Gotchas

Gotcha 1 — Do NOT call DatabaseClient.enable_autonomous_database_management() before this.

DatabaseClient.enable_autonomous_database_management() is the legacy single-API path. If it has been called (even by accident), the ADB will be in ENABLED state. Calling enable_autonomous_database_management_feature() on top of it produces a 409 IncorrectState error. Always check Step 0 first and disable the legacy state before using the feature API.

Gotcha 2 — Port 1522, full service name, not short name.

Using port 1521 or the short db_name (e.g. dbmdemo) instead of the full qualified name (e.g. ep8c8t82piuc9mv_dbmdemo_medium.adb.oraclecloud.com) will cause the enablement to fail with a connection error. The full service name must come from adb.connection_strings.medium.

Gotcha 3 — Named credentials for Jobs are a separate step.

After DBM enablement, if the user wants to run SQL Jobs via Database Management, named credentials must be created via DbManagementClient.create_named_credential(). That is NOT part of this skill. This skill only enables the DBM feature. Named credentials are created afterward.

Gotcha 4 — Use DatabaseConnectionCredentialsByDetails, not DatabaseNamedCredentialConnectionDetails.

The enablement call takes inline credentials (user_name + password_secret_id). Do NOT substitute DatabaseNamedCredentialConnectionDetails here — named credentials do not exist yet at this point and that class is for a different context (Job execution). Using the wrong credentials class produces a 400 or silent connectivity failure.