OracleSecurity & users
All privileges for one user
Prompts for a username and lists the roles, system privileges and object privileges granted directly to it.
Not yet verified. How scripts are tested
1CLEAR COLUMNS2SET LINESIZE 140 PAGESIZE 500 TRIMOUT ON TAB OFF VERIFY OFF3COLUMN kind FORMAT A74COLUMN privilege FORMAT A305COLUMN on_object HEADING "ON" FORMAT A506 7SELECT 'ROLE' AS kind, granted_role AS privilege, NULL AS on_object8FROM dba_role_privs WHERE grantee = UPPER('&&username')9UNION ALL10SELECT 'SYSTEM', privilege, NULL11FROM dba_sys_privs WHERE grantee = UPPER('&&username')12UNION ALL13SELECT 'OBJECT', privilege, owner || '.' || table_name14FROM dba_tab_privs WHERE grantee = UPPER('&&username')15ORDER BY 1, 2, 3;16 17UNDEFINE usernameSave it as ora-user-privs.sql and run it with SQL> @ora-user-privs.
Helps with
- ORA-00942: table or view does not exist
- ORA-01031: insufficient privileges
- ORA-01950: no privileges on tablespace '%s'
More Oracle scripts: Security & users
- Accounts locked, expired or expiring soonApplication accounts that aren't OPEN, or whose passwords expire in the next 14 days. Catch service accounts before they break an application.
- Who has DBA, SYSDBA and powerful system privilegesNon-Oracle accounts and roles holding the DBA role or high-risk ANY privileges, then everyone in the password file. Worth reviewing every audit cycle.
- CMU step 1: prepare Active DirectoryDone once by an AD administrator before any database work: create the service account the database binds with, install Oracle's password filter on…
- CMU step 2: export the AD root certificateThe database talks to AD over LDAPS, so its wallet must trust the certificate authority that issued the domain controllers' certificates. Export that…
- CMU step 3: create the walletBuilds the auto-login wallet the database reads at login: the service account's user name, DN and password, plus the AD root certificate. With PDBs,…
- CMU step 4: create dsi.oraTells the database which domain controllers to use. Put it in the same folder as the wallet from step 3. Use fully qualified host names, and list at…