Skip to main content

How Database Vault really works

I was worried as I ran into a problem with the Database Vault security. I configured a new realm in a database where the Oracle E-Business Suite is running. The main idea was to have a user for the OBIEE that should have only limited access.

Together with some colleagues we made sure that the OBIEE user had the correct grants on some tables and views inside the EBS schema (APPS, AR, GMS, PA). I created the realm and added the OBIEE user as a participant.
Everything seemed to work. Then I disabled the realm and even removed the OBIEE user from the realm, but still Oracle Answers was capable of accessing the APPS schema objects.

Took me a day and finally I reread the manual. I understood my error.

The purpose of the DBV is to lockout users with system privileges, such as the SYS or SYSTEM user.
Now the account of the OBIEE user does not have these system privileges except CREATE SESSION.
In order to access any object the OBIEE user relies on discretionary grants (e.g. the AR user grants select on HZ_CUST_ACCOUNTS).
By this the OBIEE userR does not need the realm as this is granted.

The intention of the DBV is not focusing on users as OBIEE user but on all users who have system privileges.

From the Oracle manual:

... Oracle Database Vault does not replace the discretionary access control model in the existing Oracle database. It functions as a layer on top of this model for both realms and command rules. ...
Labels:

Comments

Post a Comment

Popular posts from this blog

Different silent install files WLS 10.3.2 and 10.3.3

Today I tried to cut some corners and use a silent.xml file for WLS 10.3.3 for a silent installation of 10.3.2. To my amazement on a clean machine I received the following error: oracle@xxx001:/opt/oracle$ java -Djava.io.tmpdir=/opt/oracle/tmp -jar /nfsstage/wls1032_generic.jar -mode=silent -silent_xml=./silent/wls_silent.xml -log=/tmp/wls.log Extracting 0%....................................................................................................100% The local BEA product registry is corrupted. Please select another Middleware Home or contact Oracle Support I checked the wls_silent.xml file and found that it includes Coherence, which was not bundled with the 10.3.2 version. So I modified the 10.3.3 silent_xml file from value="WebLogic Server/Core Application Server|WebLogic Server/Administration Console|WebLogic Server/Configuration Wizard and Upgrade Framework|WebLogic Server/Web 2.0 HTTP Pub-Sub Server|WebLogic Server/WebLogic JDBC Drivers|WebLogic Server/Third ...
4 comments
Read more

Unpacking Oracle cpio for AIX

When extracting a cpio file with Oracle software from OTN on AIX you might encounter the following problem: oracle@mymachine-app:/install/oracle/MRCA>cpio -idmv cpio: 0511-903 Out of phase! cpio attempting to continue... cpio: 0511-904 skipping 642010 bytes to get back in phase! One or more files lost and the previous file is possibly corrupt! Segmentation fault The solution is to use the option -idcmv oracle@mymachine-app:/install/oracle/MRCA>cpio -idcmv c Reads and writes header information in ASCII character form. If a cpio archive was created using the c flag, it must be extracted with c flag.
5 comments
Read more

Oracle VirtualBox - first (short) impressions

I am using Oracle VirtualBox now since a couple of weeks in order to establish if it can replace my VMWare Server. I want to put down a couple of quick impressions - which will hopefully be followed up by some more insight. Speed: It seems that Oracle VirtualBox is faster than the VMWare Server. Creating an image as well as starting it up and shutting it down are pretty fast. However if your machine is pushing the limits on memory the shutdown process of an image can easily take 5 minutes. FAT/NTFS: I have not yet found the possibility to create a disk file in chunks of 2GB. VMWare offered this OOTB. Now when I move my image from my Windows7 NTFS filesystem to the FAT external disk it complains about a 20GB file. More research is needed here. Distributing images: I copied the images and gave them to some colleagues during several trainings. My experience is that the different laptops we use are not handled well by VirtualBox. E.g. I had to remove a network from the vbox-file in order t...
4 comments
Read more