administering user security

9Copyright © 2005, Oracle. All rights reserved.

Administering User Security

9-2 Copyright © 2005, Oracle. All rights reserved.

Objectives

After completing this lesson, you should be able to do the following:

• Create and manage database user accounts

• Create and manage roles

• Grant and revoke privileges

• Control resource usage by users


User Management: Overview

• Create a user with an assigned storage area (tablespace).

• Assign quota to limit storage usage.

• Limit resource usage with profile.

• Authenticate a user with a password.

• Manage password rules with profiles (expire passwords and lock account).

• Assign privileges to roles and roles to users.

Users

Privileges

Roles HR_MGR

Jenny

Insert

employees


Database Users and Schemas

• A schema is the collection ofobjects owned by a user.

• Username and schema are often used interchangeably.

• A user can be associated with only one schema, but he or she can use objects from many schemas with the appropriate permissions.

Schema Objects

Tables

Triggers

Indexes

Views

Sequences

Stored program units

Synonyms

User-defined data types

Database links


Database User Accounts

Each database user account has:

• A unique username

• An authentication method

• A default tablespace

• A temporary tablespace

• A user profile

• A consumer group

• A lock status

> UserPrivilegeRoleProfile


Predefined Accounts: SYS and SYSTEM

• The SYS account:– Is granted the DBA role– Has all privileges with ADMIN OPTION– Is required for startup, shutdown, and some

maintenance commands– Owns the data dictionary– Owns the Automatic Workload Repository (AWR)

• The SYSTEM account is granted the DBA role.

• These accounts are not used for routine operations.


Creating a User

Select Administration > Schema > Users & Privileges > Users, and then click the Create button.


Privileges

There are two types of user privileges:

• System: Enables users to perform particular actions in the database

• Object: Enables users to access and manipulate a specific object

User > Privilege

RoleProfile

System privilege:

Create session

HR_DBA

Object privilege:

Update employees


System Privileges


Object Privileges

To grant object privileges:

1. Choose the object type.

2. Select objects.

3. Select privileges.


GRANT

REVOKE

Revoking System Privilegeswith ADMIN OPTION

REVOKE CREATE TABLE FROM jeff;

User

Privilege

Object

DBA Jeff Emi

Jeff EmiDBA


GRANT

REVOKE

Revoking Object Privileges with GRANT OPTION

Bob Jeff Emi

EmiJeffBob


Creating a Role

Select Administration > Schema > Users & Privileges > Roles.

User Privilege

> RoleProfile


Benefits of Roles

• Easier privilege management

• Dynamic privilege management

• Selective availability of privileges


Predefined Roles

CONNECT CREATE SESSION

RESOURCE CREATE CLUSTER, CREATE INDEXTYPE, CREATE OPERATOR, CREATE PROCEDURE, CREATE SEQUENCE, CREATE TABLE, CREATE TRIGGER, CREATE TYPE

SCHEDULER_ ADMIN

CREATE ANY JOB, CREATE EXTERNAL JOB, CREATE JOB, EXECUTE ANY CLASS, EXECUTE ANY PROGRAM, MANAGE SCHEDULER

DBA Most system privileges, several other roles. Do not grant to nonadministrators.

SELECT_

CATALOG_

ROLE

No system privileges, but HS_ADMIN_ROLE and over 1,700 object privileges on the data dictionary


CREATE ROLE secure_application_roleIDENTIFIED USING <security_procedure_name>;

Secure Roles

• Roles may also be secured programmatically.

• Roles may be nondefault.

SET ROLE vacationdba;

• Roles may be protected through authentication.


Profiles and Users

Users are assigned only one profile at any given time.

Profiles:• Control

resource consumption

• Manage account status and password expiration

UserPrivilegeRole

> Profile


Where We Are

Done:

Creating a user

Creating a role

Assigning system and object privileges to a role

Creating a profile

Limiting resource usage with a profile

To Do—Modifying user accounts:

• Assigning storage area (tablespace)

• Assigning quota to limit storage usage

• Authenticating users with passwords

• Managing password rules with profiles (expiring passwords and locking accounts)

• Assigning privileges to roles and roles to users


Modifying Users: Default and Temporary Tablespaces and Locking

• Default: Default location of database objects

• Temporary: Used for sorting

Best practice: Be specific in your tablespace assignments.


Assigning Quota to Users

Users who do not have the UNLIMITED TABLESPACE system privilege must be given a quota before they can create objects in a tablespace. Quotas can be:

• Unlimited

• A specific value in megabytes or kilobytes


Authenticating Users

• Password

• External

• Global


Administrator Authentication

Operating System Security:

• DBAs must have the OS privileges to create and delete files.

• Typical database users should not have the OS privileges to create or delete database files.

Administrator Security:

• SYSBA and SYSOPER connections are authorized via password file or OS.– Password file authentication records the DBA user

by name.– OS authentication does not record the specific

user.– OS authentication takes precedence over password

file authentication for SYSDBA and SYSOPER.


Locking and Unlocking Accounts

Failed login attempts

Manual locking Account locked

Manual unlocking

Account unlocked

User

DBA


Setting Password Expiration

Password management includes the following:

• Specifying the maximum lifetime for a password

• Specifying a grace period for changing a password

Note: Do not use profiles that cause the SYS, SYSMAN, and DBSNMP passwords to expire and the accounts to get locked.


Unlocking a User Account andResetting the Password

Select the user, and click Unlock User.


Assigning Privileges to Roles and Roles to Users

Users

Privileges

Roles HR_CLERKHR_MGR

Jenny David Rachel

Delete

employees

Select

employees

Update

employees

Insert

employees


Assigning Roles to Users


Checklist for Creating Users

• Select a profile.

• Select an authentication technique.

• Assign a default tablespace and temporary tablespace.

• Decide on quotas for each tablespace.

• Grant privileges and roles to the user.


Summary

In this lesson, you should have learned how to:

• Create and manage user accounts

• Create and manage roles

• Grant and revoke privileges

• Control resource usage by users


Practice Overview: Administering Users

This practice covers the following topics:

• Creating a profile to limit resource consumption

• Creating two roles:a. HRCLERK

b. HRMANAGER

• Creating three new users: One manager and two clerks

administering user security

Documents