ArrowTTC — Compatibility
Which Oracle versions, cloud services, auth methods, and client platforms ArrowTTC is known to work with. Three support states are used across the Arpeio driver family:
| State | Meaning |
|---|---|
| ✅ Validated | Exercised directly — live testing and/or the CI test matrix. |
| 🟢 Supported | Expected to work and covered by the same protocol surface, but not run continuously. Report issues and they will be treated as bugs. |
| 🟡 Not yet validated | Should be compatible on protocol grounds, but unverified. No promise yet. |
ArrowTTC speaks TNS (Oracle Net) + TTC (Two-Task Common) natively over TCP
(+ optional TCPS/TLS or Native Network Encryption). The primary target is Oracle
19c and Oracle Cloud Autonomous Database; the type mapping is in
DATA_TYPES.md.
Oracle Database (on-premises / IaaS)
| Version | State | Notes |
|---|---|---|
| Oracle 19c | ✅ Validated | Primary development & CI target. Password, TLS, NNE, Kerberos, OCI IAM token, OAuth2/Entra all verified live. |
| Oracle 18c | ✅ Validated | Type-matrix round-trip verified live (18c XE). Same DESCRIBE_INFO surface as 19c. |
| Oracle 12c | ✅ Validated | Type-matrix round-trip verified live (Enterprise 12.2.0.1). The 12c O5LOGON PBKDF2 verifier and TTC field version are exercised end to end. |
| Oracle 21c | ✅ Validated | Type-matrix round-trip verified live (21c XE). Reports TTC field version 16 and parses cleanly. |
| Oracle 23ai | ✅ Validated | Type-matrix round-trip verified live. Native BOOLEAN, JSON, and VECTOR column types decode and round-trip over the field-version-23_4 FAST_AUTH handshake. |
| Oracle 26ai (23.26) | ✅ Validated | Oracle's rebrand of 23ai — same protocol family; full type-matrix and native BOOLEAN/JSON/VECTOR verified live. |
Oracle Spatial (MDSYS.SDO_GEOMETRY, on 19c EE + Spatial) is ✅ Validated end
to end: an SDO_GEOMETRY column reads as geoarrow.wkb, and a geoarrow.wkb
column ingests back as SDO_GEOMETRY — SRID included. See
Data types for the supported geometry
kinds (read handles 2D point / line / single-ring polygon; write additionally
supports interior rings and the multi-part kinds).
There is no z/OS / mainframe Oracle edition — that concept is specific to the Db2/DRDA sibling (ArrowDRDA) and does not apply to Oracle.
19c is the primary target; 12c, 18c, 21c, 23ai, and 26ai are all validated live — the type-matrix round-trip passes on each.
Oracle Cloud
| Service | State | Auth | Notes |
|---|---|---|---|
| Autonomous Database (ADB) | ✅ Validated | password, OCI IAM token, OAuth2/Entra | Verified live over mutual TLS with the downloaded instance wallet (ewallet.pem). Use a _low/_tp/… service on port 1522 and ssl_mode=verify-full. |
ADB requires mutual TLS — pair every ADB connection with the wallet
(wallet_location + wallet_password). See
CONNECTION.md.
Authentication methods
All verified live (on-prem 19c and/or Autonomous Database):
| Method | State | Notes |
|---|---|---|
| Password (O5LOGON, 12c PBKDF2-HMAC-SHA512 and 11g SHA-1 verifiers) | ✅ Validated | Password never crosses the wire in clear, even without TLS. |
Proxy authentication (CONNECT THROUGH) | ✅ Validated | Rides the O5LOGON login, no extra round trip. |
| Change-password-at-connect | ✅ Validated | The way in past an expired password. |
Kerberos (KERBEROS5) | ✅ Validated | ccache / keytab / password modes; composes with Native Network Encryption. Linux / MIT krb5 only. |
| OCI IAM database token | ✅ Validated | Oracle Cloud; token + RSA proof-of-possession signature. |
| OAuth2 / Microsoft Entra ID bearer token | ✅ Validated | Global user resolved from the token's upn claim. |
| TLS (TCPS), incl. downloaded ADB wallet | ✅ Validated | require / verify-ca / verify-full; mutual TLS with wallets. |
| Native Network Encryption (AES-256 + SHA-256/SHA-1) | ✅ Validated | No TCPS required; connects a SQLNET.ENCRYPTION_SERVER=REQUIRED server. |
Not implemented: NTS/NTLM and Windows SSPI. See
AUTHENTICATION.md.
Client platforms
| Platform | State | Notes |
|---|---|---|
| Linux x64 | ✅ Validated | Primary build & test target. MIT krb5 (optional) enables Kerberos. |
| Windows x64 | 🟢 Supported | Builds and runs under MSVC; the hermetic CTest suite runs on windows-latest every push, plus an optional live TLS connect to Autonomous Database. Password/O5LOGON, TLS, OCI IAM token, and OAuth2/Entra all work; Kerberos stays Linux-only (no SSPI). A prebuilt win-x64 .dll and the ArrowTtc.AdbcDriver NuGet package ship with every release. |
| macOS (arm64) | 🟡 Not yet validated | Staged; no released binary yet. |
ADBC conformance
ArrowTTC implements the ADBC 1.1.0 surface: query, prepared statements +
bound parameters, DML/DDL update, transactions (commit/rollback + autocommit),
bulk ingest, LOB streaming, query cancellation, and catalog/metadata (GetInfo,
GetObjects, GetTableSchema, GetTableTypes).
Correctness is guarded by two suites: an offline hermetic C tier (27 CTest
suites — error/SQLSTATE mapping, allocator, metadata builders, OAuth2 + OCI-IAM
auth builders, option mapping, session lifecycle, and the decoders — run under
gcc, clang, MSVC, and ASan/UBSan on every push), and the live Oracle
type-matrix. GetStatistics, ExecuteSchema, and
GetParameterSchema are not yet implemented.
See also
CONNECTION.md— connecting to each of the aboveDATA_TYPES.md— the type mapping the suites exerciseTROUBLESHOOTING.md— when a supported target does not connect