Transcription
Oracle DatabaseDatabase Security Guide12c Release 2 (12.2)E85682-10July 2021
Oracle Database Database Security Guide, 12c Release 2 (12.2)E85682-10Copyright 2006, 2021, Oracle and/or its affiliates.Primary Author: Patricia HueyContributing Authors: Sumit JelokaContributors: Suraj Adhikari, Thomas Baby, Tammy Bednar, Todd Bottger, Sanjay Bharadwaj, Leo Cloutier,Naveen Gopal, Rishabh Gupta, Peter Knaggs, Andre Kruklikov, Bryn Llewellyn, Rahil Mir, Hari Mohankumar,Gopal Mulagund, Abhishek Munnolimath, Paul Needham, Robert Pang, Dilip Raj, Kumar Rajamani, KathyRich, Vipin Samar, Saravana Soundararajan, James Spiller, Srividya Tata, Kamal Tbeileh, Can Tuzla, AnandVerma, Patrick WheelerThis software and related documentation are provided under a license agreement containing restrictions onuse and disclosure and are protected by intellectual property laws. Except as expressly permitted in yourlicense agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license,transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverseengineering, disassembly, or decompilation of this software, unless required by law for interoperability, isprohibited.The information contained herein is subject to change without notice and is not warranted to be error-free. Ifyou find any errors, please report them to us in writing.If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it onbehalf of the U.S. Government, then the following notice is applicable:U.S. GOVERNMENT END USERS: Oracle programs (including any operating system, integrated software,any programs embedded, installed or activated on delivered hardware, and modifications of such programs)and Oracle computer documentation or other Oracle data delivered to or accessed by U.S. Government endusers are "commercial computer software" or "commercial computer software documentation" pursuant to theapplicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use,reproduction, duplication, release, display, disclosure, modification, preparation of derivative works, and/oradaptation of i) Oracle programs (including any operating system, integrated software, any programsembedded, installed or activated on delivered hardware, and modifications of such programs), ii) Oraclecomputer documentation and/or iii) other Oracle data, is subject to the rights and limitations specified in thelicense contained in the applicable contract. The terms governing the U.S. Government’s use of Oracle cloudservices are defined by the applicable contract for such services. No other rights are granted to the U.S.Government.This software or hardware is developed for general use in a variety of information management applications.It is not developed or intended for use in any inherently dangerous applications, including applications thatmay create a risk of personal injury. If you use this software or hardware in dangerous applications, then youshall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure itssafe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of thissoftware or hardware in dangerous applications.Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks oftheir respective owners.Intel and Intel Inside are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks areused under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Epyc,and the AMD logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registeredtrademark of The Open Group.This software or hardware and documentation may provide access to or information about content, products,and services from third parties. Oracle Corporation and its affiliates are not responsible for and expresslydisclaim all warranties of any kind with respect to third-party content, products, and services unless otherwiseset forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not beresponsible for any loss, costs, or damages incurred due to your access to or use of third-party content,products, or services, except as set forth in an applicable agreement between you and Oracle.
ContentsPrefaceAudiencexlivDocumentation AccessibilityxlivRelated DocumentsxlvConventionsxlvChanges in This Release for Oracle Database Security Guide1Changes in Oracle Database Security 12c Release 2 (12.2.0.1)xlviUpdates to Oracle Database Security 12.2lviiiIntroduction to Oracle Database Security1.1About Oracle Database Security1-11.2Additional Oracle Database Security Resources1-2Part I2Managing User Authentication and AuthorizationManaging Security for Oracle Database Users2.1About User Security2-12.2Creating User Accounts2-22.2.1About Common Users and Local Users2-22.2.1.1About Common Users2-32.2.1.2How Plugging in PDBs Affects CDB Common Users2-42.2.1.3About Local Users2-52.2.2Who Can Create User Accounts?2-62.2.3Creating a New User Account That Has Minimum Database Privileges2-72.2.4Restrictions on Creating the User Name for a New Account2-82.2.4.1Uniqueness of User Names2-82.2.4.2User Names in a Multitenant Environment2-82.2.4.3Case Sensitivity for User Names2-8iii
2.2.5Assignment of User Passwords2-92.2.6Default Tablespace for the User2-102.2.6.1About Assigning a Default Tablespace for a User2-102.2.6.2DEFAULT TABLESPACE Clause for Assigning a Default Tablespace2-112.2.7About Assigning a Tablespace Quota for a User2-112.2.7.2CREATE USER Statement for Assigning a Tablespace Quota2-122.2.7.3Restriction of the Quota Limits for User Objects in a Tablespace2-122.2.7.4Grants to Users for the UNLIMITED TABLESPACE System Privilege2-12Temporary Tablespaces for the User2-132.2.8.1About Assigning a Temporary Tablespace for a User2-132.2.8.2TEMPORARY TABLESPACE Clause for Assigning a TemporaryTablespace2-142.2.92.2.10Profiles for the User2-14Creation of a Common User or a Local User2-152.2.10.1About Creating Common User Accounts2-152.2.10.2CREATE USER Statement for Creating a Common User Account2-162.2.10.3About Creating Local User Accounts2-172.2.10.4CREATE USER Statement for Creating a Local User Account2-182.2.11Creating a Default Role for the User2-18Altering User Accounts2-192.3.1About Altering User Accounts2-192.3.2ALTER USER Statement for Altering Common or Local User Accounts2-192.3.3Changing Non-SYS User Passwords2-202.3.3.1About Changing Non-SYS User Passwords2-202.3.3.2Using the PASSWORD Command or ALTER USER Statement toChange a Password2-212.3.42.42-112.2.7.12.2.82.3Tablespace Quotas for a UserChanging the SYS User Password2-212.3.4.1About Changing the SYS User Password2-222.3.4.2ORAPWD Utility for Changing the SYS User Password2-22Configuring User Resource Limits2-232.4.1About User Resource Limits2-232.4.2Types of System Resources and Limits2-242.4.2.1Limits to the User Session Level2-242.4.2.2Limits to Database Call Levels2-252.4.2.3Limits to CPU Time2-252.4.2.4Limits to Logical Reads2-252.4.2.5Limits to Other Resources2-252.4.3Values for Resource Limits of Profiles2-262.4.4Managing Resources with Profiles2-272.4.4.1About Profiles2-272.4.4.2ora stig profile User Profile2-28iv
2.52.632.4.4.3Creating a Profile2-282.4.4.4Creating a CDB Profile or an Application Profile2-292.4.4.5Assigning a Profile to a User2-292.4.4.6Dropping Profiles2-30Dropping User Accounts2-302.5.1About Dropping User Accounts2-312.5.2Terminating a User Session2-312.5.3About Dropping a User After the User Is No Longer Connected to the Database2.5.4Dropping a User Whose Schema Contains ObjectsDatabase User and Profile Data Dictionary Views2-322-322-322.6.1Data Dictionary Views That List Information About Users and Profiles2-332.6.2Query to Find All Users and Associated Information2-342.6.3Query to List All Tablespace Quotas2-342.6.4Query to List All Profiles and Assigned Limits2-352.6.5Query to View Memory Use for Each User Session2-36Configuring Authentication3.1About Authentication3-23.2Configuring Password Protection3-23.2.1What Are the Oracle Database Built-in Password Protections?3-33.2.2Minimum Requirements for Passwords3-43.2.3Creating a Password by Using the IDENTIFIED BY Clause3-43.2.4Using a Password Management Policy3-43.2.4.1About Managing Passwords3-53.2.4.2Finding User Accounts That Have Default Passwords3-63.2.4.3Password Settings in the Default Profile3-63.2.4.4Using the ALTER PROFILE Statement to Set Profile Limits3-83.2.4.5Disabling and Enabling the Default Password Security Settings3-83.2.4.6Automatically Locking Inactive Database User Accounts3-93.2.4.7Automatically Locking User Accounts After Failed Logins3-103.2.4.8Example: Locking an Account with the CREATE PROFILE Statement3-103.2.4.9Explicitly Locking a User Account3-113.2.4.10Controlling the User Ability to Reuse Previous Passwords3-113.2.4.11About Controlling Password Aging and Expiration3-123.2.4.12Using the CREATE PROFILE or ALTER PROFILE Statement to Set aPassword Lifetime3-133.2.4.13Checking the Status of a User Account3-133.2.4.14Password Change Life Cycle3-133.2.4.15PASSWORD LIFE TIME Profile Parameter Low Value3-153.2.5Managing the Complexity of Passwords3.2.5.1About Password Complexity Verification3-163-17v
3.2.5.2How Oracle Database Checks the Complexity of Passwords3-173.2.5.3Who Can Use the Password Complexity Functions?3-173.2.5.4verify function 11G Function Password Requirements3-173.2.5.5ora12c verify function Password Requirements3-183.2.5.6ora12c strong verify function Function Password Requirements3-183.2.5.7ora12c stig verify function Password Requirements3-193.2.5.8About Customizing Password Complexity Verification3-193.2.5.9Enabling Password Complexity Verification3-203.2.6Managing Password Case Sensitivity3.2.6.13-21SEC CASE SENSITIVE LOGON Parameter and Password CaseSensitivity3-21Using the ALTER SYSTEM Statement to Enable Password CaseSensitivity3-223.2.6.3Management of Case Sensitivity for Secure Role Passwords3-233.2.6.4Management of Password Versions of Users3-233.2.6.5Finding and Resetting User Passwords That Use the 10G PasswordVersion3-253.2.6.6How Case Sensitivity Affects Password Files3-283.2.6.7How Case Sensitivity Affects Passwords Used in Database LinkConnections3-283.2.6.23.2.7Ensuring Against Password Security Threats by Using the 12C PasswordVersion3-293.2.7.1About the 12C Version of the Password Hash3-293.2.7.2Oracle Database 12C Password Version Configuration Guidelines3-303.2.7.3Configuring Oracle Database to Use the 12C Password VersionExclusively3-323.2.7.4How Server and Client Logon Versions Affect Database Links3-343.2.7.5Configuring Oracle Database Clients to Use the 12C Password VersionExclusively3-353.2.8Managing the Secure External Password Store for Password Credentials3-363.2.8.1About the Secure External Password Store3-363.2.8.2How Does the External Password Store Work?3-373.2.8.3About Configuring Clients to Use the External Password Store3-383.2.8.4Configuring a Client to Use the External Password Store3-383.2.8.5Example: Sample SQLNET.ORA File with Wallet Parameters Set3-403.2.8.6Managing External Password Store Credentials3-403.2.9Managing Passwords for Administrative Users3-423.2.9.1About Managing Passwords for Administrative Users3-433.2.9.2Setting the LOCK and EXPIRED Status of Administrative Users3-433.2.9.3Password Profile Settings for Administrative Users3-433.2.9.4Last Successful Login Time for Administrative Users3-443.2.9.5Management of the Password File of Administrative Users3-443.2.9.6Migration of the Password File of Administrative Users3-45vi
3.2.9.73.2.9.83.33.4How the Multitenant Option Affects Password Files for AdministrativeUsers3-45Password Complexity Verification Functions for Administrative Users3-45Authentication of Database Administrators3-463.3.1About Authentication of Database Administrators3-463.3.2Strong Authentication, Centralized Management for Administrators3-473.3.2.1About Strong Authentication for Database Administrators3-473.3.2.2Configuring Directory Authentication for Administrative Users3-473.3.2.3Configuring Kerberos Authentication for Administrative Users3-483.3.2.4Configuring Secure Sockets Layer Authentication for AdministrativeUsers3-493.3.3Authentication of Database Administrators by Using the Operating System3-503.3.4Authentication of Database Administrators by Using Their Passwords3-513.3.5Risks of Using Password Files for Database Administrator Authentication3-52Database Authentication of Users3-523.4.1About Database Authentication3-533.4.2Advantages of Database Authentication3-543.4.3Creating Users Who Are Authenticated by the Database3-543.5Operating System Authentication of Users3-553.6Network Authentication of Users3-563.73.83.6.1Authentication with Secure Sockets Layer3-563.6.2Authentication with Third-Party Services3-573.6.2.1About Authentication Using Third-Party Services3-573.6.2.2Authentication with Kerberos3-573.6.2.3Authentication with RADIUS3-573.6.2.4Authentication with Directory-Based Services3-583.6.2.5Authentication with Public Key Infrastructure3-58Configuring Operating System Users for a PDB3.7.1About Configuring Operating System Users for a PDB3-593.7.2Configuring an Operating System User for a PDB3-59Global User Authentication and Authorization3-603.8.1About Configuring Global User Authentication and Authorization3-613.8.2Configuration of Users Who Are Authorized by a Directory Service3-613.8.2.1Creating a Global User Who Has a Private Schema3-623.8.2.2Creating Multiple Enterprise Users Who Share Schemas3-62Advantages of Global Authentication and Global Authorization3-633.8.33.93-59Configuring an External Service to Authenticate Users and Passwords3-633.9.1About External Authentication3-643.9.2Advantages of External Authentication3-643.9.3Enabling External Authentication3-643.9.4Creating a User Who Is Authenticated Externally3-653.9.5Authentication of User Logins By Using the Operating System3-65vii
3.9.6Authentication of User Logins Using Network Authentication3.10Multitier Authentication and Authorization3-663.11Administration and Security in Clients, Application Servers, and Database Servers3-663.12Preserving User Identity in Multitiered Environments3-683.12.1Middle Tier Server Use for Proxy AuthenticationAbout Proxy Authentication3-693.12.1.2Advantages of Proxy Authentication3-703.12.1.3Who Can Create Proxy User Accounts?3-703.12.1.4Guidelines for Creating Proxy User Accounts3-713.12.1.5Creating Proxy User Accounts and Authorizing Users to ConnectThrough Them3-71Proxy User Accounts and the Authorization of Users to ConnectThrough Them3-723.12.1.7Using Proxy Authentication with the Secure External Password Store3-733.12.1.8How the Identity of the Real User Is Passed with Proxy Authentication3-733.12.1.9Limits to the Privileges of the Middle Tier3-743.12.1.10Authorizing a Middle Tier to Proxy and Authenticate a User3-753.12.1.11Authorizing a Middle Tier to Proxy a User Authenticated by OtherMeans3-763.12.1.12Reauthenticating a User Through the Middle Tier to the Database3-763.12.1.13Using Password-Based Proxy Authentication3-773.12.1.14Using Proxy Authentication with Enterprise Users3-773.12.2Using Client Identifiers to Identify Application Users Unknown to the Database3-783.12.2.1About Client Identifiers3-793.12.2.2How Client Identifiers Work in Middle Tier Systems3-793.12.2.3Use of the CLIENT IDENTIFIER Attribute to Preserve User Identity3-793.12.2.4Use of the CLIENT IDENTIFIER Independent of Global ApplicationContext3-80Setting the CLIENT IDENTIFIER Independent of Global ApplicationContext3-81Use of the DBMS SESSION PL/SQL Package to Set and Clear theClient Identifier3-813.12.2.7Enabling the CLIENTID OVERWRITE Event System-Wide3-823.12.2.8Enabling the CLIENTID OVERWRITE Event for the Current Session3-823.12.2.9Disabling the CLIENTID OVERWRITE 3-66User Authentication Data Dictionary Views3-83Configuring Privilege and Role Authorization4.1About Privileges and Roles4-24.2Who Should Be Granted Privileges?4-34.3How the Oracle Multitenant Option Affects Privileges4-44.4Managing Administrative Privileges4-4viii
4.54.64.4.1About Administrative Privileges4-54.4.2Grants of Administrative Privileges to Users4-54.4.3SYSDBA and SYSOPER Privileges for Standard Database Operations4-54.4.4SYSBACKUP Administrative Privilege for Backup and Recovery Operations4-64.4.5SYSDG Administrative Privilege for Oracle Data Guard Operations4-74.4.6SYSKM Administrative Privilege for Transparent Data Encryption4-84.4.7SYSRAC Administrative Privilege for Oracle Real Application Clusters4-9Managing System Privileges4.5.1About System Privileges4-114.5.2Why Is It Important to Restrict System Privileges?4-114.5.2.1About the Importance of Restricting System Privileges4-114.5.2.2Restricting System Privileges by Securing the Data Dictionary4-124.5.2.3User Access to Objects in the SYS Schema4-124.5.3Grants and Revokes of System Privileges4-134.5.4Who Can Grant or Revoke System Privileges?4-134.5.5About ANY Privileges and the PUBLIC Role4-14Managing Commonly and Locally Granted PrivilegesAbout Commonly and Locally Granted Privileges4-154.6.2How Commonly Granted System Privileges Work4-164.6.3How Commonly Granted Object Privileges Work4-164.6.4Granting or Revoking Privileges to Access a PDB4-174.6.5Example: Granting a Privilege in a Multitenant Environment4-174.6.6Enabling Common Users to View CONTAINER DATA Object ewing Data About the Root, CDB, and PDBs While Connected to theRoot4-18Enabling Common Users to Query Data in Specific PDBs4-19Managing Common Roles and Local Roles4-204.7.1About Common Roles and Local Roles4-204.7.2How Common Roles Work4-214.7.3How the PUBLIC Role Works in a Multitenant Environment4-214.7.4Privileges Required to Create, Modify, or Drop a Common Role4-214.7.5Rules for Creating Common Roles4-214.7.6Creating a Common Role4-224.7.7Rules for Creating Local Roles4-224.7.8Creating a Local Role4-234.7.9Role Grants and Revokes for Common Users and Local Users4-23Managing User Roles4.8.1About User Roles4-244-244.8.1.1What Are User Roles?4-254.8.1.2The Functionality of Roles4-254.8.1.3Properties of Roles and Why They Are Advantageous4-26ix
4.8.1.4Typical Uses of Roles4-274.8.1.5Common Uses of Application Roles4-284.8.1.6Common Uses of User Roles4-284.8.1.7How Roles Affect the Scope of a User's Privileges4-284.8.1.8How Roles Work in PL/SQL Blocks4-294.8.1.9How Roles Aid or Restrict DDL Usage4-304.8.1.10How Operating Systems Can Aid Roles4-314.8.1.11How Roles Work in a Distributed Environment4-314.8.2Predefined Roles in an Oracle Database Installation4-314.8.3Creating a Role4-384.8.3.1About the Creation of Roles4-394.8.3.2Creating a Role That Is Authenticated With a Password4-394.8.3.3Creating a Role That Has No Password Authentication4-404.8.3.4Creating a Role That Is External or Global4-404.8.3.5Altering a Role4-404.8.4Specifying the Type of Role Authorization4-414.8.4.1Authorizing a Role by Using the Database4-414.8.4.2Authorizing a Role by Using an Application4-424.8.4.3Authorizing a Role by Using an External Source4-424.8.4.4Authorizing a Role by Using the Operating System4-424.8.4.5Authorizing a Role by Using a Network Client4-434.8.4.6Authorizing a Global Role by an Enterprise Directory Service4-434.8.5Granting and Revoking Roles4-444.8.5.1About Granting and Revoking Roles4-444.8.5.2Who Can Grant or Revoke Roles?4-444.8.5.3Granting and Revoking Roles to and from Program Units4-454.8.6Dropping Roles4-454.8.7Restricting SQL*Plus Users from Using Database Roles4-464.8.7.1Potential Security Problems of Using Ad Hoc Tools4-464.8.7.2How the PRODUCT USER PROFILE System Table Can Limit Roles4-474.8.7.3How Stored Procedures Can Encapsulate Business Logic4-474.8.84.9Role Privileges and Secure Application Roles4-47Using PDB Lockdown Profiles to Restrict Operations on PDBs4-484.9.1About PDB Lockdown Profiles4-494.9.2Creating a PDB Lockdown Profile4-504.9.3Enabling a PDB Lockdown Profile4-514.9.4Dropping a PDB Lockdown Profile4-514.10Managing Object Privileges4-524.10.1About Object Privileges4-524.10.2Who Can Grant Object Privileges?4-534.10.3Grants and Revokes of Object Privileges4-53x
4.10.3.1About Granting and Revoking Object Privileges4-534.10.3.2How the ALL Clause Grants or Revokes All Available Object Privileges4-544.10.4READ and SELECT Object Privileges4-544.10.4.1About Managing READ and SELECT Object Privileges4-544.10.4.2Enabling Users to Use the READ Object Privilege to Query Any Tablein the Database4-55Restrictions on the READ and READ ANY TABLE Privileges4-554.10.4.34.10.5Object Privilege Use with Synonyms4-554.10.6Sharing Application Common Objects4-564.114.10.6.1Metadata-Linked Application Common Objects4-574.10.6.2Data-Linked Application Common Objects4-584.10.6.3Extended Data-Linked Application Common Objects4-59Table Privileges4-594.11.1How Table Privileges Affect Data Manipulation Language Operations4-604.11.2How Table Privileges Affect Data Definition Language Operations4-604.12View Privileges4-614.12.1Privileges Required to Create Views4-614.12.2The Use of Views to Increase Table Security4-614.13Procedure Privileges4-624.13.1The Use of the EXECUTE Privilege for Procedure Privileges4-634.13.2Procedure Execution and Security Domains4-634.13.3System Privileges Required to Create or Replace a Procedure4-634.13.4System Privileges Required to Compile a Procedure4-644.13.5How Procedure Privileges Affect Packages and Package Objects4-644.13.5.14.14About the Effect of Procedure Privileges on Packages and PackageObjects4-654.13.5.2Example: Procedure Privileges Used in One Package4-654.13.5.3Example: Procedure Privileges and Package Objects4-65Type Privileges4-664.14.1System Privileges for Named Types4-674.14.2Object Privileges for Named Types4-674.14.3Method Execution Model for Named Types4-674.14.4Privileges Required to Create Types and Tables Using Types4-684.14.5Example: Privileges for Creating Types and Tables Using Types4-684.14.6Privileges on Type Access and Object Access4-694.14.7Type Dependencies4-714.15Grants of User Privileges and Roles4.15.1Granting System Privileges and Roles to Users and Roles4-714-714.15.1.1Privileges for Grants of System Privileges and Roles to Users and Roles4-724.15.1.2Example: Granting a System Privilege and a Role to a User4-724.15.1.3Example: Granting the EXECUTE Privilege on a Directory Object4-72xi
4.15.1.44.15.1.54.15.24.16Use of the ADMIN Option to Enable Grantee Users to Grant thePrivilege4-73Creating a New User with the GRANT Statement4-73Granting Object Privileges to Users and Roles4-734.15.2.1About Granting Object Privileges to Users and Roles4-744.15.2.2How the WITH GRANT OPTION Clause Works4-754.15.2.3Grants of Object Privileges on Behalf of the Object Owner4-754.15.2.4Grants of Privileges on Columns4-764.15.2.5Row-Level Access Control4-77Revokes of Privileges and Roles from a User4-774.16.1Revokes of System Privileges and Roles4-774.16.2Revokes of Object Privileges4-784.16.2.1About Revokes of Object Privileges4-784.16.2.2Revokes of Multiple Object Privileges4-784.16.2.3Revokes of Object Privileges on Behalf of the Object Owner4-794.16.2.4Revokes of Column-Selective Object Privileges4-804.16.2.5Revokes of the REFERENCES Object Privilege4-804.16.3Cascading Effects of Revoking Privileges4-804.16.3.1Cascading Effects When Revoking System Privileges4-804.16.3.2Cascading Effects When Revoking Object Privileges4-814.17Grants and Revokes of Privileges to and from the PUBLIC Role4-824.18Grants of Roles Using the Operating System or Network4-824.18.1About Granting Roles Using the Operating System or Network4-834.18.2Operating System Role Identification4-844.18.3Operating System Role Management4-854.18.4Role Grants and Revokes When OS ROLES Is Set to TRUE4-854.18.5Role Enablements and Disablements When OS ROLES Is Set to TRUE4-854.18.6Network Connections with Operating System Role Management4-854.19How Grants and Revokes Work with SET ROLE and Default Role Settings4-864.19.1When Grants and Revokes Take Effect4-864.19.2How the SET ROLE Statement Affects Grants and Revokes4-864.19.3Specifying the Default Role for a User4-874.19.4The Maximum Number of Roles That a User Can Have Enabled4-874.20User Privilege and Role Data Dictionary Views4-884.20.1Data Dictionary Views to Find Information about Privilege and Role Grants4-884.20.2Query to List All System Privilege Grants4-904.20.3Query to List All Role Grants4-914.20.4Query to List Object Privileges Granted to a User4-914.20.5Query to List the Current Privilege Domain of Your Session4-924.20.6Query to List Roles of the Database4-93xii
4.20.75Query to List Information About the Privilege Domains of Roles4-93Managing Security for Definer's Rights and Invoker's Rights5.1About Definer's Rights and Invoker's Rights5-15.2How Procedure Privileges Affect Definer's Rights5-25.3How Procedure Privileges Affect Invoker's Rights5-35.4When You Should Create Invoker's Rights Procedures5-45.5Controlling Invoker's Rights Privileges for Procedure Calls and View Access5-45.65.75.85.5.1How the Privileges of a Schema Affect the Use of Invoker's Rights Procedures5-55.5.2How the INHERIT [ANY] PRIVILEGES Privileges Control Privilege Access5-65.5.3Grants of the INHERIT PRIVILEGES Privilege to Other Users5-65.5.4Example: Granting INHERIT PRIVILEGES on an Invoking User5-75.5.5Example: Revoking INHERIT PRIVILEGES5-75.5.6Grants of the INHERIT ANY PRIVILEGES Privilege to Other Users5-75.5.7Example: Granting INHERIT ANY PRIVILEGES to a Trusted Procedure Owner5-75.5.8Managing INHERIT PRIVILEGES and INHERIT ANY PRIVILEGES5-8Definer's Rights and Invoker's Rights in Views5-95.6.1About Controlling Definer's Rights and Invoker's Rights in Views5-95.6.2Using the BEQUEATH Clause in the CREATE VIEW Statement5-95.6.3Finding the User Name or User ID of the Invoking User5-105.6.4Finding BEQUEATH DEFINER and BEQUEATH CURRENT USER Views5-11Using Code Based Access Control for Definer's Rights and Invoker's Rights5-115.7.1About Using Code Based Access Control for Applications5-125.7.2Who Can Grant Code Based Access Control Roles to a Program Unit?5-125.7.3How Code Based Access Control Works with Invoker's Rights Program Units5-135.7.4How Code Based Access Control Works with Definer's Rights Program Units5-145.7.5Grants of Database Roles to Users for Their CBAC Grants5-165.7.6Grants and Revokes of Database Roles to a Program Unit5-175.7.7Tutorial: Controlling Access to Sensitive Data Using Code Based AccessControl5-185.7.7.1About This Tutorial5-185.7.7.2Step 1: Create the User and Grant HR the CREATE ROLE Privilege5-195.7.7.3Step 2: Create the print employees Invoker's Rights Procedure5-195.7.7.4Step 3: Create the hr clerk Role and Grant Privileges for It5-205.7.7.5Step 4: Test the Code Based Access Control HR.print employeesProcedure5-205.7.7.6Step 5: Create the view emp role Role and Grant Privileges for It5-215.7.7.7Step 6: Test the HR.print employees Procedure Again5-215.7.7.8Step 7: Remove the Components of This Tutorial5-22Controlling Definer's Rights Privileges for Database Links5.8.1About Controlling Definer's Rights Privileges for Database Links5-225-23xiii
5.8.2Grants of the INHERIT REMOTE PRIVILEGES Privilege to Other Users5-245.8.3Example: Granting INHERIT REMOTE PRIVILEGES on a Connected User5-245.8.4Grants of the INHERIT ANY REMOTE PRIVILEGES Privilege to Other Users5-255.8.5Revokes of the INHERIT [ANY] REMOTE PRIVILEGES Privilege5-255.8.6Example: Revoking the INHERIT REMOTE PRIVILEGES Privilege5-265.8.7Example: Revoking the INHERIT REMOTE PRIVILEGES Privilege fromPUBLIC5-26Tutorial: Using a Database Link in a Definer's Rights Procedure5-265.8.865.8.8.1About This Tutorial5-275.8.8.2Step 1: Create User Accounts5-275.8.8.3Step 2: As User dbuser2, Create a Table to Store User IDs5-275.8.8.4Step 3: As User dbuser1, Create a Database Link and Definer's RightsProcedure5-285.8.8.5Step 4: Test the Definer's Rights Procedure5-285.8.8.6Step 5: Remove the Components of This Tutorial5-29Managing Fine-Grained Access in PL/SQL Packages and Types6.1About Managing Fine-Grained Access in PL/SQL Packages and Types6-26.2About Fine-Grained Access Control to External Network Services6-26.3About Access Control to Oracle Wallets6-36.4Upgraded Applications That Depend on Packages That Use External NetworkServices6-3Configuring Access Control for External Network Services6-46.56.66.5.1Syntax for Configuring Access Control for External Network Services6-46.5.2Example: Configuring Access Control for External Network Services6-66.5.3Revoking Access Control Privileges for External Network Services6-66.5.4Example: Revoking External Network Services Privileges6-7Configuring Access Control to an Oracle Wallet6.6.1About Configuring Access Control to an Oracle Wallet6-76.6.2Step 1: Create an Oracle Wallet6-86.6.3Step 2: Configure Access Control Privileges for the Oracle Wallet6-86.6.4Step 3: Make the HTTP Request with the Passwords and Client Certificates6-96.6.4.1Making the HTTPS Request with the Passwords and Client Certificates6-96.6.4.2Using a Request Context to Hold the Wallet When Sharing the Sessionwith Other Applications6-116.6.4.3Use of Only a Client Certificate to Authenticate6-116.6.4.4Use of a Password to Authenticate6-116.6.56.76-7Revoking Access Control Privileges for Oracle Wallets6-12Examples of Configuring Access Control for External Network Services6.7.16.7.26-13Example: Configuring Access Control for a Single Role and NetworkConnection6-13Example: Configuring Access Control for a User and Role6-13xiv
76.7.3Example: Using the DBA HOST ACES View to Show Granted Privileges6-146.7.4Example: Configuring ACL Access Using Passwords in a Non-Shared Wallet6-146.7.5Example: Configuring ACL Access for a Wallet in a Sh
Changes in Oracle Database Security 12c Release 2 \(12.2.0.1\)xlvi. Updates to Oracle Database Security 12.2 lviii. Introduction to Oracle Database Security. About Oracle Database Security1-1. Additional Oracle Database Security Resources1-2 \376\377Managing User Authentication and\240A