Repository: hashicorp/terraform-provider-vault

Issue:
[Bug]: plugin not found in the catalog: oracle-database-plugin - terraform
### Terraform Core Version

1.8.0

### Terraform Vault Provider Version

4.8.0

### Vault Server Version

1.18.1

### Affected Resource(s)

i try to use vault wit aws rds oracle , but when i run the code terraform to create the vault_database_secret_backend_connection i got this error :
module.db.vault_database_secret_backend_connection.backend_connection_db[0]: Creating...
╷
│ Error: error configuring database connection "database_d/config/XXXXXXXXXXXX_base1": Error making API request.
│ 
│ URL: PUT http://127.0.0.1:8200/v1/database/config/XXXXXXXXXXXX_base1
│ Code: 400. Errors:
│ 
│ * error creating database object: invalid database version: 2 errors occurred:
│       * plugin not found in the catalog: oracle-database-plugin
│       * plugin not found in the catalog: oracle-database-plugin
│ 
│ 
│ 
│   with module.db.vault_database_secret_backend_connection.backend_connection_db[0],
│   on ../vault.tf line 77, in resource "vault_database_secret_backend_connection" "backend_connection_db":
│   77: resource "vault_database_secret_backend_connection" "backend_connection_db" {

and when i checkd on the vault server i found that the oracle plugin name is "vault-plugin-database-oracle " but the vault provider try to find a plugin with the name "oracle-database-plugin" . 
i try to use the option "pluin name" on the ressource vault_database_secret_backend_connection but stil got the same error.
 

### Expected Behavior

The vault provider select the correct plugin name and create the resources

### Actual Behavior

the vault provider try to find the oracle plugin with the name "oracle-database-plugin"  but it found another plugin with name "vault-plugin-database-oracle" .
so it crash the terraform 

### Relevant Error/Panic Output Snippet

```shell
╷
│ Error: error configuring database connection "database_d/config/XXXXXXXXXXXX_base1": Error making API request.
│ 
│ URL: PUT http://127.0.0.1:8200/v1/database_d/config/XXXXXXXXXXXX_base1
│ Code: 400. Errors:
│ 
│ * error creating database object: invalid database version: 2 errors occurred:
│       * plugin not found in the catalog: oracle-database-plugin
│       * plugin not found in the catalog: oracle-database-plugin
│ 
│ 
│ 
│   with module.db.vault_database_secret_backend_connection.backend_connection_db[0],
│   on ../vault.tf line 77, in resource "vault_database_secret_backend_connection" "backend_connection_db":
│   77: resource "vault_database_secret_backend_connection" "backend_connection_db" {
```

### Terraform Configuration Files

resource "vault_database_secret_backend_connection" "backend_connection_db" {
  backend       = "database_${local.vault_environment}"
  name          = "XXXXXXXXXXXXXX_${local.database_name}"
  allowed_roles = ["*"]
  # plugin_name   = "vault-plugin-database-oracle" # i tired this solution but it dosen't work
  oracle {
    connection_url    = "{{username}}/{{password}}@${aws_db_instance.default.endpoint}/${local.database_name}"
    username          = "admin_vault"
    password          = random_password.password_admin_vault[count.index].result
    username_template = "{{ printf \"v_prefix_%s_%s\" (unix_time | truncate 12) (uuid | truncate 8) | truncate 63 }}"
  }
}

### Steps to Reproduce

- I add the rds oracle plugin using this code :
wget -O ${scriptpath}/vault/plugins/plugin_database_oracle_0.10.1.zip  https://releases.hashicorp.com/vault-plugin-database-oracle/0.10.1/vault-plugin-database-oracle_0.10.1_linux_amd64.zip
    cd ${scriptpath}/vault/plugins
    unzip ${scriptpath}/vault/plugins/plugin_database_oracle_0.10.1.zip
- Then i run the terraform  code with a Vault server

### Debug Output

_No response_

### Panic Output

_No response_

### Important Factoids

 # vault plugin list -detailed
Name                                 Type        Version                  Container    Deprecation Status
----                                 ----        -------                  ---------    ------------------
alicloud                             auth        v0.19.0+builtin          false        supported
approle                              auth        v1.18.1+builtin.vault    false        supported
aws                                  auth        v1.18.1+builtin.vault    false        supported
azure                                auth        v0.19.1+builtin          false        supported
cert                                 auth        v1.18.1+builtin.vault    false        supported
cf                                   auth        v0.19.0+builtin          false        supported
gcp                                  auth        v0.19.1+builtin          false        supported
github                               auth        v1.18.1+builtin.vault    false        supported
jwt                                  auth        v0.22.0+builtin          false        supported
kerberos                             auth        v0.13.0+builtin          false        supported
kubernetes                           auth        v0.20.0+builtin          false        supported
ldap                                 auth        v1.18.1+builtin.vault    false        supported
oci                                  auth        v0.17.0+builtin          false        supported
oidc                                 auth        v1.18.1+builtin.vault    false        supported
okta                                 auth        v1.18.1+builtin.vault    false        supported
pcf                                  auth        v1.18.1+builtin.vault    false        deprecated
radius                               auth        v1.18.1+builtin.vault    false        supported
userpass                             auth        v1.18.1+builtin.vault    false        supported
cassandra-database-plugin            database    v1.18.1+builtin.vault    false        supported
couchbase-database-plugin            database    v0.12.0+builtin          false        supported
elasticsearch-database-plugin        database    v0.16.0+builtin          false        supported
hana-database-plugin                 database    v1.18.1+builtin.vault    false        supported
influxdb-database-plugin             database    v1.18.1+builtin.vault    false        supported
mongodb-database-plugin              database    v1.18.1+builtin.vault    false        supported
mongodbatlas-database-plugin         database    v0.13.0+builtin          false        supported
mssql-database-plugin                database    v1.18.1+builtin.vault    false        supported
mysql-aurora-database-plugin         database    v1.18.1+builtin.vault    false        supported
mysql-database-plugin                database    v1.18.1+builtin.vault    false        supported
mysql-legacy-database-plugin         database    v1.18.1+builtin.vault    false        supported
mysql-rds-database-plugin            database    v1.18.1+builtin.vault    false        supported
postgresql-database-plugin           database    v1.18.1+builtin.vault    false        supported
redis-database-plugin                database    v0.4.0+builtin           false        supported
redis-elasticache-database-plugin    database    v0.5.0+builtin           false        supported
redshift-database-plugin             database    v1.18.1+builtin.vault    false        supported
snowflake-database-plugin            database    v0.12.0+builtin          false        supported
vault-plugin-database-oracle         database    n/a                      false        n/a
ad                                   secret      v0.19.0+builtin          false        deprecated
alicloud                             secret      v0.18.0+builtin          false        supported
aws                                  secret      v1.18.1+builtin.vault    false        supported
azure                                secret      v0.20.1+builtin          false        supported
consul                               secret      v1.18.1+builtin.vault    false        supported
gcp                                  secret      v0.20.1+builtin          false        supported
gcpkms                               secret      v0.19.0+builtin          false        supported
kubernetes                           secret      v0.9.0+builtin           false        supported
kv                                   secret      v0.20.0+builtin          false        supported
ldap                                 secret      v1.18.1+builtin.vault    false        supported
mongodbatlas                         secret      v0.13.0+builtin          false        supported
nomad                                secret      v1.18.1+builtin.vault    false        supported
openldap                             secret      v0.14.3+builtin          false        supported
pki                                  secret      v1.18.1+builtin.vault    false        supported
rabbitmq                             secret      v1.18.1+builtin.vault    false        supported
ssh                                  secret      v1.18.1+builtin.vault    false        supported
terraform                            secret      v0.10.0+builtin          false        supported
totp                                 secret      v1.18.1+builtin.vault    false        supported
transit                              secret      v1.18.1+builtin.vault    false        supported



##############################################

### References

_No response_

### Would you like to implement a fix?

None

Discussion:

Solution patch:
diff --git a/vault/resource_database_secret_backend_connection.go b/vault/resource_database_secret_backend_connection.go
index 97d1923d..f6d5fc3a 100644
--- a/vault/resource_database_secret_backend_connection.go
+++ b/vault/resource_database_secret_backend_connection.go
@@ -1055,11 +1055,17 @@ func getDBEngineFromResp(engines []*dbEngine, r *api.Secret) (*dbEngine, error)
 	return nil, fmt.Errorf("no supported database engines found for plugin %q", pluginName)
 }
 
-func getDatabaseAPIDataForEngine(engine *dbEngine, idx int, d *schema.ResourceData, meta interface{}) (map[string]interface{}, error) {
+func getDatabaseAPIDataForEngine(engine *dbEngine, idx int, d *schema.ResourceData, meta interface{}, unifiedSchema bool) (map[string]interface{}, error) {
 	prefix := engine.ResourcePrefix(idx)
 	data := map[string]interface{}{}
 
-	pluginName, err := engine.GetPluginName(d, prefix)
+	var pluginPrefix string
+	if unifiedSchema {
+		pluginPrefix = prefix
+	} else {
+		pluginPrefix = ""
+	}
+	pluginName, err := engine.GetPluginName(d, pluginPrefix)
 	if err != nil {
 		return nil, err
 	}
@@ -2057,7 +2063,7 @@ func databaseSecretBackendConnectionCreateOrUpdate(
 }
 
 func writeDatabaseSecretConfig(ctx context.Context, d *schema.ResourceData, client *api.Client, engine *dbEngine, idx int, unifiedSchema bool, path string, meta interface{}) error {
-	data, err := getDatabaseAPIDataForEngine(engine, idx, d, meta)
+	data, err := getDatabaseAPIDataForEngine(engine, idx, d, meta, unifiedSchema)
 	if err != nil {
 		return err
 	}



Test patch:
diff --git a/vault/resource_database_secret_backend_connection_test.go b/vault/resource_database_secret_backend_connection_test.go
index d26183f1..c0bfbb5a 100644
--- a/vault/resource_database_secret_backend_connection_test.go
+++ b/vault/resource_database_secret_backend_connection_test.go
@@ -689,6 +689,25 @@ func TestAccDatabaseSecretBackendConnection_mysql(t *testing.T) {
 					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "mysql.0.max_connection_lifetime", "0"),
 				),
 			},
+		},
+	})
+}
+
+func TestAccDatabaseSecretBackendConnection_mysql_rds(t *testing.T) {
+	MaybeSkipDBTests(t, dbEngineMySQL)
+
+	// TODO: make these fatal once we auto provision the required test infrastructure.
+	values := testutil.SkipTestEnvUnset(t,
+		"MYSQL_CONNECTION_URL", "MYSQL_CONNECTION_USERNAME", "MYSQL_CONNECTION_PASSWORD")
+	connURL, username, password := values[0], values[1], values[2]
+
+	backend := acctest.RandomWithPrefix("tf-test-db")
+	name := acctest.RandomWithPrefix("db")
+	resource.Test(t, resource.TestCase{
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
+		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_mysql_rds(name, backend, connURL, username, password),
 				Check: testComposeCheckFuncCommonDatabaseSecretBackend(name, backend, dbEngineMySQLRDS.DefaultPluginName(),
@@ -705,6 +724,25 @@ func TestAccDatabaseSecretBackendConnection_mysql(t *testing.T) {
 					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "mysql_rds.0.max_connection_lifetime", "0"),
 				),
 			},
+		},
+	})
+}
+
+func TestAccDatabaseSecretBackendConnection_mysql_aurora(t *testing.T) {
+	MaybeSkipDBTests(t, dbEngineMySQL)
+
+	// TODO: make these fatal once we auto provision the required test infrastructure.
+	values := testutil.SkipTestEnvUnset(t,
+		"MYSQL_CONNECTION_URL", "MYSQL_CONNECTION_USERNAME", "MYSQL_CONNECTION_PASSWORD")
+	connURL, username, password := values[0], values[1], values[2]
+
+	backend := acctest.RandomWithPrefix("tf-test-db")
+	name := acctest.RandomWithPrefix("db")
+	resource.Test(t, resource.TestCase{
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
+		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_mysql_aurora(name, backend, connURL, username, password),
 				Check: testComposeCheckFuncCommonDatabaseSecretBackend(name, backend, dbEngineMySQLAurora.DefaultPluginName(),
@@ -721,6 +759,25 @@ func TestAccDatabaseSecretBackendConnection_mysql(t *testing.T) {
 					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "mysql_aurora.0.max_connection_lifetime", "0"),
 				),
 			},
+		},
+	})
+}
+
+func TestAccDatabaseSecretBackendConnection_mysql_legacy(t *testing.T) {
+	MaybeSkipDBTests(t, dbEngineMySQL)
+
+	// TODO: make these fatal once we auto provision the required test infrastructure.
+	values := testutil.SkipTestEnvUnset(t,
+		"MYSQL_CONNECTION_URL", "MYSQL_CONNECTION_USERNAME", "MYSQL_CONNECTION_PASSWORD")
+	connURL, username, password := values[0], values[1], values[2]
+
+	backend := acctest.RandomWithPrefix("tf-test-db")
+	name := acctest.RandomWithPrefix("db")
+	resource.Test(t, resource.TestCase{
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
+		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_mysql_legacy(name, backend, connURL, username, password),
 				Check: testComposeCheckFuncCommonDatabaseSecretBackend(name, backend, dbEngineMySQLLegacy.DefaultPluginName(),
@@ -951,6 +1008,54 @@ func TestAccDatabaseSecretBackendConnection_mysql_tls(t *testing.T) {
 	})
 }
 
+func TestAccDatabaseSecretBackendConnection_oracle(t *testing.T) {
+	MaybeSkipDBTests(t, dbEngineOracle)
+
+	// ORACLE_PLUGIN_NAME is required as not built-in plugin (already installed or installed during test, cf below)
+	//  if ORACLE_PLUGIN_INSTALL=true
+	//    plugin ORACLE_PLUGIN_NAME will be add to the catalog using vault_plugin resources:
+	//    resource "vault_plugin" "plugin" {
+	//       type    = "database"
+	//       name    = "$ORACLE_PLUGIN_NAME"
+	//       command = "$ORACLE_PLUGIN_NAME"
+	//       version = "$ORACLE_PLUGIN_VERSION"
+	//       sha256  = "$ORACLE_PLUGIN_SHA"
+	//    }
+	//
+	//  To work, it requires the oracle binary plugin in Vault plugin directory
+	//
+	values := testutil.SkipTestEnvUnset(t, "ORACLE_CONNECTION_URL", "ORACLE_CONNECTION_USERNAME", "ORACLE_CONNECTION_PASSWORD", "ORACLE_PLUGIN_NAME", "ORACLE_PLUGIN_INSTALL")
+	connURL, username, password, pluginName, pluginInstall := values[0], values[1], values[2], values[3], values[4]
+
+	var pluginVersion, pluginSHA string
+	if pluginInstall == "true" {
+		values2 := testutil.SkipTestEnvUnset(t, "ORACLE_PLUGIN_VERSION", "ORACLE_PLUGIN_SHA")
+		pluginVersion, pluginSHA = values2[0], values2[1]
+	}
+
+	backend := acctest.RandomWithPrefix("tf-test-db")
+	name := acctest.RandomWithPrefix("db")
+
+	resource.Test(t, resource.TestCase{
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDatabaseSecretBackendConnectionConfig_oracle(name, backend, pluginName, connURL, username, password, "*", pluginInstall, pluginVersion, pluginSHA),
+				Check: testComposeCheckFuncCommonDatabaseSecretBackend(name, backend, pluginName,
+					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "allowed_roles.#", "1"),
+					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "allowed_roles.0", "*"),
+					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "verify_connection", "true"),
+					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "oracle.0.connection_url", connURL),
+					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "oracle.0.username", username),
+					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "oracle.0.password", password),
+				),
+			},
+		},
+	})
+}
+
 func TestAccDatabaseSecretBackendConnection_postgresql(t *testing.T) {
 	MaybeSkipDBTests(t, dbEnginePostgres)
 
@@ -2281,6 +2386,56 @@ resource "vault_database_secret_backend_connection" "test" {
 `, path, name, connURL, authType, serviceAccountJSON)
 }
 
+func testAccDatabaseSecretBackendConnectionConfig_oracle(name, path, pluginName, connURL, username, password, allowedRoles, pluginInstall, pluginVersion, pluginSHA string) string {
+	config := fmt.Sprintf(`
+resource "vault_mount" "db" {
+  path = "%s"
+  type = "database"
+}
+`, path)
+
+	if pluginInstall == "true" {
+		config += fmt.Sprintf(`
+resource "vault_plugin" "plugin" {
+  type    = "database"
+  name    = "%s"
+  command = "%s"
+  version = "%s"
+  sha256  = "%s"
+}
+
+resource "vault_database_secret_backend_connection" "test" {
+  backend = vault_mount.db.path
+  plugin_name = vault_plugin.plugin.name
+  name = "%s"
+  allowed_roles = [%q]
+  oracle {
+    	connection_url = "%s"
+		username = "%s"
+		password = "%s"
+  }
+}
+`, pluginName, pluginName, pluginVersion, pluginSHA, name, allowedRoles, connURL, username, password)
+
+	} else {
+
+		config += fmt.Sprintf(`
+resource "vault_database_secret_backend_connection" "test" {
+  backend = vault_mount.db.path
+  plugin_name = "%s"
+  name = "%s"
+  allowed_roles = [%q]
+  oracle {
+    	connection_url = "%s"
+		username = "%s"
+		password = "%s"
+  }
+}`, pluginName, name, allowedRoles, connURL, username, password)
+	}
+
+	return config
+}
+
 func testAccDatabaseSecretBackendConnectionConfig_postgresql(name, path, userTempl, username, password, openConn, idleConn, maxConnLifetime string, parsedURL *url.URL) string {
 	return fmt.Sprintf(`
 resource "vault_mount" "db" {