Task
Version · 6.0
Create

Use SQL Plus and Oracle proxy user

Last updated: October 7, 2026

You can use the SQL Plus proxy user feature with Liquibase Secure 4.4.1 and later versions if multiple users share the same schema and do not want to provide the schema credentials to each user.

When using a proxy user to connect to a schema, you do not need to share the password, only the username. A proxy user is a user who connects to the database on behalf of another user, usually a client user. A proxy user connects with the username and password set for them without knowing the client user's password.

Note: For more information about the Oracle proxy user setup, see Proxy Authentication.

With Liquibase Secure, you can use the runwith:sqlplus attribute and connect to the environment that requires a proxy user. You can set URL properties that contain your proxy user configuration to deploy SQL Plus changesets to a database.

Procedure

Add an SQL Plus changeset to your changelog file.

--liquibase formatted sql
--changeset user:45679-runWith_sqlplus-example runwith:sqlplus
CREATE TABLE mytable (
id           NUMBER         NOT NULL,
description  VARCHAR2(50)   NOT NULL
);

Set proxy values as your username in the Liquibase properties file, environment variables, or on the command line at runtime.

url: jdbc:oracle:thin:proxy_user[client_user]/@host:port/servicename
username: proxy_username[client_username]
password: proxyuserpass

LIQUIBASE_COMMAND_URL="url=jdbc:oracle:thin:proxy_user[client_user]/@host:port/servicename"
LIQUIBASE_COMMAND_USERNAME="proxy_username[client_username]"
LIQUIBASE_COMMAND_PASSWORD="proxyuserpass"

liquibase update --url jdbc:oracle:thin:proxy_user[client_user]/@host:port/servicename --username proxy_username[client_username] --password proxyuserpass --changelog-file changelog.sql

url: jdbc:oracle:thin:proxy_user[client_user]/@host:port/servicename
username: proxy_username[client_username]
password: proxyuserpass

LIQUIBASE_COMMAND_URL="url=jdbc:oracle:thin:proxy_user[client_user]/@host:port/servicename"
LIQUIBASE_COMMAND_USERNAME="proxy_username[client_username]"
LIQUIBASE_COMMAND_PASSWORD="proxyuserpass"

liquibase update --url jdbc:oracle:thin:proxy_user[client_user]/@host:port/servicename --username proxy_username[client_username] --password proxyuserpass --changelog-file changelog.sql

Note: The proxy_user is the user that will initiate the connection and emulate the client_user. The client_user is the user whose privileges, schema, objects will be available for the session.

Run the update command to apply changes.

liquibase update --changelog-file changelog.sql

Examples

--liquibase formatted sql

--changeset myauthorname:2314 runWith:sqlplus

    DECLARE l_emp_name VARCHAR2(250);
    l_emp_no NUMBER;
    l_salary NUMBER;

    l_manager VARCHAR2(250);
    BEGIN
    INSERT INTO emp(emp_name,emp_no,salary,manager) VALUES('BBB',1000,25000,'AAA');

    ...
    END;
    /

<?xml version="1.0" encoding="UTF-8"?>

<databaseChangeLog
    xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:ext="http://www.liquibase.org/xml/ns/dbchangelog-ext"
    xmlns:pro="http://www.liquibase.org/xml/ns/pro"
    xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/dbchangelog-ext
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-ext.xsd
        http://www.liquibase.org/xml/ns/pro
        http://www.liquibase.org/xml/ns/pro/liquibase-pro-latest.xsd">

    <changeSet id="2" author="myauthorname" runWith="sqlplus"> 
        <sql>
            DECLARE l_emp_name VARCHAR2(250);
            l_emp_no NUMBER;
            l_salary NUMBER;
            l_manager VARCHAR2(250);
               BEGIN
            INSERT INTO emp(emp_name,emp_no,salary,manager) VALUES('BBB',1000,25000,'AAA');
            ...
            END;
            /
        </sql> 

    </changeSet>

</databaseChangeLog>

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
    xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:ext="http://www.liquibase.org/xml/ns/dbchangelog-ext"
    xmlns:pro="http://www.liquibase.org/xml/ns/pro"
    xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/dbchangelog-ext
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-ext.xsd
        http://www.liquibase.org/xml/ns/pro
        http://www.liquibase.org/xml/ns/pro/liquibase-pro-latest.xsd">					

    <changeSet id="2315" author="myauthorname" runWith="sqlplus">  
        <sqlFile
        path="my/path/file.sql"
    ... > 
    </changeSet>

</databaseChangeLog>

databaseChangeLog:
   - changeSet:
       id: 1-yaml
       author: myauthorname
       runWith: sqlplus
       changes:
       - sqlFile:
           path: person.sql
           relativeToChangelogFile: true

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "1-json",
        "author": "myauthorname",
        "runWith": "sqlplus",
        "changes": [
          {
            "sqlFile": {
              "path": "person.sql",
              "relativeToChangelogFile": "true"
            }
          }
        ]
      }
    ]
  }
}

####
##   Note about relative and absolute paths:
##      The liquibase.sqlplus.path must be a valid path to the SQLPlUS executable.
##      The liquibase.sqlplus.timeout value can be one of:
##      -1    - disable the timeout
##      Any integer value > 0 (measured in seconds)
##      
####

# The full path to the SQLPLUS executable.
# Sample Linux path
# liquibase.sqlplus.path=/apps/app/12.2.0.1.0/oracle/product/12.2.0.1.0/client_1/bin/sqlplus
# Sample Windows path
# liquibase.sqlplus.path=c:\\oracle\\product\\11.2.0\\client_1\\bin\\sqlplus.exe

# A valid timeout value for the execution of the SQLPLUS tool
liquibase.sqlplus.timeout=-1

# Flag to indicate whether or not to keep the temporary SQL file after execution of SQLPLUS.
# True = keep False = delete (default)
liquibase.sqlplus.keep.temp=true

# OPTIONAL Flag to designate the location to store temporary SQL file after execution of SQLPLUS.
# Liquibase will attempt to use path exactly as entered, so please ensure it complies with your OS requirements.
# liquibase.sqlplus.keep.temp.path=

# OPTIONAL Flag to designate the name of temporary SQL file after execution of SQLPLUS.
# Liquibase will attempt to use the name exactly as entered, so please ensure it complies with your OS requirements.
# liquibase.sqlplus.keep.temp.name=

# OPTIONAL Args to pass directly to SQLPLUS.
# Learn about SQLPLUS args at https://docs.oracle.com/cd/B10501_01/server.920/a90842/ch4.htm
# Note: The delimiter for args is a space eg:" " and not "," or ";" separated.
# liquibase.sqlplus.args=

PreviousUse native executors with Oracle database NextTroubleshoot running raw SQL using SQLPlus

Use SQL Plus and Oracle proxy user

Procedure

Add an SQL Plus changeset to your changelog file.

Set proxy values as your username in the Liquibase properties file, environment variables, or on the command line at runtime.

Example Liquibase properties file

Environment variables example

CLI example

Run the update command to apply changes.

Examples

Formatted SQL changeset using the runWith attribute

XML changelog with the inline SQL changeset using the runWith attribute

XML changelog pointing to a SQL file with raw SQL in it

YAML changelog pointing to an SQL file with raw SQL in it

JSON changelog pointing to an SQL file with raw SQL in it

Example liquibase.sqlplus.conf file