Use this procedure when you are configuring Database Vault operations control to automatically restrict common users from accessing pluggable database (PDB) local data. The procedure applies to the entire container, so you must run it from the CDB root. When the exception is for a package, then owner statements from the given package can access local schemas.

Syntax

DBMS_MACADM.ADD_APP_EXCEPTION(
  owner         IN VARCHAR2,
  package_name  IN VARCHAR2);

Parameters

Examples

EXEC DBMS_MACADM.ADD_APP_EXCEPTION ('C##HR_ADMIN', '%'); --Applies to the user c##hr_admin

EXEC DBMS_MACADM.ADD_APP_EXCEPTION('C##HR_ADMIN', 'validateHRdata'); --Applies to the package validateHRdata

Syntax

DBMS_MACADM.ADD_NLS_DATA(
  language      IN VARCHAR );

Parameters

Examples

EXEC DBMS_MACADM.ADD_NLS_DATA('french');

It applies to both the expdp and impdp utilities.

Syntax

DBMS_MACADM.AUTHORIZE_DATAPUMP_USER(
  user_name      IN VARCHAR2,
  schema_name    IN VARCHAR2 DEFAULT NULL,
  table_name     IN VARCHAR2 DEFAULT NULL);

Parameters

Examples

EXEC DBMS_MACADM.AUTHORIZE_DATAPUMP_USER('DP_MGR');

EXEC DBMS_MACADM.AUTHORIZE_DATAPUMP_USER('DP_MGR', 'HR');

EXEC DBMS_MACADM.AUTHORIZE_DATAPUMP_USER('DP_MGR', 'HR', 'EMPLOYEES'); 

The DDL authorization allows the grantee to perform DDL operations on users who are authorized to realms or granted Oracle Database Vault roles. However, the DDL authorization does not allow the grantee to perform DDL operations on realm-protected schemas. To enable such operations, you must authorize the user for the realm.

To find information about users who have been granted this authorization, query the DBA_DV_DDL_AUTH data dictionary view.

Syntax

DBMS_MACADM.AUTHORIZE_DDL(
  user_name      IN VARCHAR2,
  schema_name    IN VARCHAR2);

Parameters

Examples

The following example enables user psmith to execute DDL statements in any schema:

EXEC DBMS_MACADM.AUTHORIZE_DDL('psmith', '%');

This example enables user psmith to execute DDL statements in the HR schema only.

EXEC DBMS_MACADM.AUTHORIZE_DDL('psmith', 'HR');

These views and tables are as follows:

Without this authorization, when a user queries these tables and views, no values are returned.

Syntax

DBMS_MACADM.AUTHORIZE_DIAGNOSTIC_ADMIN(
  uname      IN VARCHAR2);

Parameters

Example

EXEC DBMS_MACADM.AUTHORIZE_DIAGNOSTIC_ADMIN('PFITCH'); 

To find information about users who have been granted this authorization, query the DBA_DV_MAINTENANCE_AUTH view.

Syntax

DBMS_MACADM.AUTHORIZE_MAINTENANCE_USER(
 uname        IN VARCHAR2,
 sname        IN VARCHAR2 DEFAULT NULL,
 objname      IN VARCHAR2 DEFAULT NULL,
 objtype      IN VARCHAR2 DEFAULT NULL,
 action       IN VARCHAR2 DEFAULT NULL);

Parameters

Example

The following example enables user psmith to have Database Vault authorization to manage ILM features for the HR.EMPLOYEES table:

BEGIN
 DBMS_MACADM.AUTHORIZE_MAINTENANCE_USER (
  uname       => 'psmith', 
  sname       => 'HR', 
  objname     => 'EMPLOYEES',
  objtype     => 'TABLE', 
  action      => 'ILM');
END;
/

For example, the CREATE SESSION privilege is a valid database authorization.

AUTHORIZE_PROXY_USER does not control whether a particular user can connect as a proxy of another user. That part is controlled by GRANT CONNECT THROUGH, which can be issued only by the a user who has the DV_ACCTMGR role. Instead, AUTHORIZE_PROXY_USER controls whether the proxy user is allowed to assume all the Database Vault authorizations that the target user has. For example, suppose that the proxy user hr_proxy_user successfully connects as user HR. Now being HR, hr_proxy_user can access all the objects to which HR has access. However, if the target objects are Database Vault protected and HR is authorized to access it, hr_proxy_user can access the objects if and only if hr_proxy_user is proxy-authorized for HR. If hr_proxy_user is not proxy-authorized for HR, then even after connecting as HR, hr_proxy_user cannot access the Database Vault-protected objects for which HR is authorized.

To find information about users who have been granted authorization using AUTHORIZE_PROXY_USER, query the DBA_DV_PROXY_AUTH view.

Syntax

DBMS_MACADM.AUTHORIZE_PROXY_USER(
  proxy_user   IN VARCHAR2,
  user_name    IN VARCHAR2);

Parameters

Examples

The following example enables proxy user preston to proxy all users:

EXEC DBMS_MACADM.AUTHORIZE_PROXY_USER('preston', '%');

This example enables proxy user preston to proxy database user dkent only.

EXEC DBMS_MACADM.AUTHORIZE_PROXY_USER('preston', 'dkent');

This authorization applies to anyone who has privileges to schedule database jobs. These privileges include any of the following: CREATE JOB, CREATE ANY JOB, CREATE EXTERNAL JOB, EXECUTE ANY PROGRAM, EXECUTE ANY CLASS, MANAGE SCHEDULER.

Syntax

DBMS_MACADM.AUTHORIZE_SCHEDULER_USER(
  user_name      IN VARCHAR2,
  schema_name    IN VARCHAR2 DEFAULT NULL);

Parameters

Examples

The following example authorizes the user JOB_MGR to run a job under any schema.

EXEC DBMS_MACADM.AUTHORIZE_SCHEDULER_USER('JOB_MGR');

This example authorizes user JOB_MGR to run a job under the HR schema only.

EXEC DBMS_MACADM.AUTHORIZE_SCHEDULER_USER('JOB_MGR', 'HR');

It applies to both the EXPDP and IMPDP utilities.

Syntax

DBMS_MACADM.AUTHORIZE_TTS_USER(
  uname      IN VARCHAR2,
  tsname     IN VARCHAR2);

Parameters

Example

EXEC DBMS_MACADM.AUTHORIZE_TTS_USER('PSMITH', 'HR_TS');

The exception list allows a user or package to access local PDB data. Removing a user or package from the exception list will block the user or package from accessing PDB local data.

Syntax

DBMS_MACADM.DELETE_APP_EXCEPTION(
  owner         IN VARCHAR2,
  package_name  IN VARCHAR2);

Parameters

Examples

EXEC DBMS_MACADM.DELETE_APP_EXCEPTION ('C##HR_ADMIN'); --Applies to the user c##hr_admin

EXEC DBMS_MACADM.DELETE_APP_EXCEPTION('C##HR_ADMIN', 'validateHRdata'); --Applies to the package validateHRdata

Syntax

DBMS_MACADM.DISABLE_APP_PROTECTION(
  pdb_name     IN VARCHAR2 DEFAULT NULL);

Parameters

Examples

EXEC DBMS_MACADM.DISABLE_APP_PROTECTION; --Applies to all PDBs

EXEC DBMS_MACADM.DISABLE_APP_PROTECTION('hr_pdb'); --Applies to a specific PDB

After you run this procedure, you must restart the database.

Syntax

DBMS_MACADM.DISABLE_DV;

Parameters

None

Example

EXEC DBMS_MACADM.DISABLE_DV;

By default these two accounts are locked. Only a user who has been granted the DV_OWNER role can execute this procedure. To find the status of whether users can log into DVSYS and DVF, query the DBA_DV_DICTIONARY_ACCTS data dictionary view. For stronger security, run this procedure to better protect the DVSYS and DVF schemas. The disablement takes place immediately, so you do not need to restart the database after running this procedure.

Syntax

DBMS_MACADM.DISABLE_DV_DICTIONARY_ACCTS;

Parameters

None

Example

EXEC DBMS_MACADM.DISABLE_DV_DICTIONARY_ACCTS;

This procedure disables the successful actions of this user, not the failed actions. You should run this procedure after the DV_PATCH_ADMIN user has completed database patch operation. To find if auditing is enabled or not, query the DBA_DV_PATCH_AUDIT data dictionary view.

Syntax

DBMS_MACADM.DISABLE_DV_PATCH_ADMIN_AUDIT;

Parameters

None

Example

EXEC DBMS_MACADM.DISABLE_DV_PATCH_ADMIN_AUDIT;

The disablement takes place immediately, so you do not need to restart the database after running this procedure. To find the status of whether the ORADEBUG utility is available in Database Vault, query the DVYS.DBA_DV_ORADEBUG data dictionary view.

Syntax

DBMS_MACADM.DISABLE_ORADEBUG;

Parameters

None

Example

EXEC DBMS_MACADM.DISABLE_ORADEBUG;

Syntax

DBMS_MACADM.ENABLE_APP_PROTECTION(
  pdb_name     IN VARCHAR2 DEFAULT NULL);

Parameters

Examples

EXEC DBMS_MACADM.ENABLE_APP_PROTECTION; --Applies to all PDBs

EXEC DBMS_MACADM.ENABLE_APP_PROTECTION('hr_pdb'); --Applies to a specific PDB

If you want to run DBMS_MACADM.ENABLE_DV in an application container, then you must run it in the application container outside of application actions.

After you run this procedure, you must restart the database.

Syntax

DBMS_MACADM.ENABLE_DV(
 strict_mode  IN VARCHAR2 DEFAULT);

Parameters

Examples

The following example enables Oracle Database Vault in regular mode.

EXEC DBMS_MACADM.ENABLE_DV;

This example enables Oracle Database Vault in strict mode in a multitenant environment.

EXEC DBMS_MACADM.ENABLE_DV (strict_mode => 'y');

By default, the DVSYS and DVF accounts are locked.

Only a user who has been granted the DV_OWNER role can execute this procedure. To find the status of whether users can log into DVSYS and DVF, query the DBA_DV_DICTIONARY_ACCTS data dictionary view. For stronger security, only run this procedure when you need to better protect the DVSYS and DVF schemas. The enablement takes place immediately, so you do not need to restart the database after running this procedure.

Syntax

DBMS_MACADM.ENABLE_DV_DICTIONARY_ACCTS;

Parameters

None

Example

EXEC DBMS_MACADM.ENABLE_DV_DICTIONARY_ACCTS;

This procedure is designed to audit these users' actions during a patch upgrade. To find if this auditing is enabled or not, query the DBA_DV_PATCH_AUDIT data dictionary view.

Syntax

DBMS_MACADM.ENABLE_DV_PATCH_ADMIN_AUDIT;

Parameters

None

Example

EXEC DBMS_MACADM.ENABLE_DV_PATCH_ADMIN_AUDIT;

The enablement takes place immediately, so you do not need to restart the database after running this procedure. To find the status of whether the ORADEBUG utility is available in Database Vault, query the DVYS.DBA_DV_ORADEBUG data dictionary view.

Syntax

DBMS_MACADM.ENABLE_ORADEBUG;

Parameters

None

Example

EXEC DBMS_MACADM.ENABLE_ORADEBUG;

When you run this procedure, ensure that its settings correspond exactly to the equivalent AUTHORIZE_DATAPUMP_USER procedure.

For example, the following two procedures will work because the parameters are consistent:

EXEC DBMS_MACADM.AUTHORIZE_DATAPUMP_USER('DP_MGR');

EXEC DBMS_MACADM.UNAUTHORIZE_DATAPUMP_USER('DP_MGR');

However, because the parameters in the following procedures are not consistent, the UNAUTHORIZE_DATAPUMP_USER procedure will not work:

EXEC DBMS_MACADM.AUTHORIZE_DATAPUMP_USER('JSMITH');

EXEC DBMS_MACADM.UNAUTHORIZE_DATAPUMP_USER('JSMITH', 'HR');

Syntax

DBMS_MACADM.UNAUTHORIZE_DATAPUMP_USER(
  user_name      IN VARCHAR2,
  schema_name    IN VARCHAR2 DEFAULT NULL,
  table_name     IN VARCHAR2 DEFAULT NULL);

Parameters

Examples

EXEC DBMS_MACADM.UNAUTHORIZE_DATAPUMP_USER('JSMITH');

EXEC DBMS_MACADM.UNAUTHORIZE_DATAPUMP_USER('JSMITH', 'HR');

EXEC DBMS_MACADM.UNAUTHORIZE_DATAPUMP_USER('JSMITH', 'HR', 'SALARY');

To find information about users who have been granted this authorization, query the DBA_DV_DDL_AUTH data dictionary view.

Syntax

DBMS_MACADM.UNAUTHORIZE_DDL(
  user_name      IN VARCHAR2,
  schema_name    IN VARCHAR2);

Parameters

Examples

The following example revokes DDL statement execution authorization from user psmith for all schemas:

EXEC DBMS_MACADM.UNAUTHORIZE_DDL('psmith', '%');

This example revokes DDL statement execution authorization from user psmith for the HR schema only.

EXEC DBMS_MACADM.UNAUTHORIZE_DDL('psmith', 'HR');

These views and tables are as follows:

Without this authorization, when a user queries these tables and views, no values are returned.

Syntax

DBMS_MACADM.UNAUTHORIZE_DIAGNOSTIC_ADMIN(
  uname      IN VARCHAR2);

Parameters

Example

EXEC DBMS_MACADM.UNAUTHORIZE_DIAGNOSTIC_ADMIN('PFITCH'); 

To find information about the settings for the ILM authorization, query the DBA_DV_MAINTENANCE_AUTH view.

When you run this procedure, ensure that its settings correspond exactly to the equivalent AUTHORIZE_MAINTENANCE_USER procedure.

For example, the following two procedures will work because the parameter settings correspond:

EXEC DBMS_MACADM.AUTHORIZE_MAINTENANCE_USER('psmith', 'OE', 'ORDERS', 'TABLE', 'ILM');
EXEC DBMS_MACADM.UNAUTHORIZE_MAINTENANCE_USER('psmith', 'OE', 'ORDERS', 'TABLE', 'ILM');

However, these two statements will fail because the settings do not correspond:

EXEC DBMS_MACADM.AUTHORIZE_MAINTENANCE_USER('psmith', 'OE', 'ORDERS', 'TABLE', 'ILM');

EXEC DBMS_MACADM.UNAUTHORIZE_MAINTENANCE_USER('psmith', '%', '%', '%', 'ILM');

Syntax

DBMS_MACADM.UNAUTHORIZE_MAINTENANCE_USER(
 uname        IN VARCHAR2,
 sname        IN VARCHAR2 DEFAULT NULL,
 objname      IN VARCHAR2 DEFAULT NULL,
 objtype      IN VARCHAR2 DEFAULT NULL,
 action       IN VARCHAR2 DEFAULT NULL);

Parameters

Example

The following example revokes privileges from Database Vault user psmith so that she can no longer perform ILM operations in any HR schema objects:

BEGIN
 DBMS_MACADM.UNAUTHORIZE_MAINTENANCE_USER (
  uname       => 'psmith', 
  sname       => 'HR', 
  objname     => 'EMPLOYEES',
  objtype     => 'TABLE', 
  action      => 'ILM');
END;
/

Syntax

DBMS_MACADM.UNAUTHORIZE_PROXY_USER(
  proxy_user   IN VARCHAR2,
  user_name    IN VARCHAR2);

Parameters

Examples

The following example revokes proxy authorization from user preston for proxying all users:

DBMS_MACADM.UNAUTHORIZE_PROXY_USER('preston', '%');

This example revokes proxy authorization from user preston for proxying database user psmith only.

EXEC DBMS_MACADM.UNAUTHORIZE_PROXY_USER('preston', 'psmith');

When you run this procedure, ensure that its settings correspond exactly to the equivalent AUTHORIZE_SCHEDULER_USER procedure. For example, the following two procedures will work because the parameters are consistent:

EXEC DBMS_MACADM.AUTHORIZE_SCHEDULER_USER('JOB_MGR');

EXEC DBMS_MACADM.UNAUTHORIZE_SCHEDULER_USER('JOB_MGR');

However, because the parameters in the following procedures are not consistent, the UNAUTHORIZE_SCHEDULER_USER procedure will not work:

EXEC DBMS_MACADM.AUTHORIZE_SCHEDULER_USER('JOB_MGR');

EXEC DBMS_MACADM.UNAUTHORIZE_SCHEDULER_USER('JOB_MGR', 'HR');

Syntax

DBMS_MACADM.UNAUTHORIZE_SCHEDULER_USER
  user_name      IN VARCHAR2,
  schema_name    IN VARCHAR2 DEFAULT NULL);

Parameters

Examples

EXEC DBMS_MACADM.UNAUTHORIZE_SCHEDULER_USER('JOB_MGR');

EXEC DBMS_MACADM.UNAUTHORIZE_SCHEDULER_USER('JOB_MGR', 'HR');

Syntax

DBMS_MACADM.UNAUTHORIZE_TTS_USER
  uname      IN VARCHAR2,
  tsname     IN VARCHAR2);

Parameters

Example

EXEC DBMS_MACADM.UNAUTHORIZE_TTS_USER('PSMITH', 'HR_TS');