Insufficient privileges when creating user logged in as SYS

Hi,
I'm working on 11.1.0.6.0 Enterprise Edition, Advanced Security options, Label Security a and Database Vault installed. (for testing purposes)
I'm creating a new user being logged as SYS using this sentence:
CREATE USER "HR_DIRECTOR" PROFILE "DEFAULT" IDENTIFIED BY "*******" DEFAULT TABLESPACE "USERS" TEMPORARY TABLESPACE "TEMP" ACCOUNT UNLOCK;
However, the command fails with the message "Failed to commit: ORA-01031: insufficient privileges . You do not have enough privileges to perform this operation. You must have the appropriate system and object privileges to create, edit, or drop database objects or objects outside of your schema."
Please note that I'm working on a fresh DB install and I have also installed Database Vault in this instance for testing purposes, but still haven't configured any realm or command rules on it.
Is it possible Vault is the reason why I am not able to create a new user?
Thanks and Regards,
Leandro

Hi, It seems I've found it.
After you install Database Vault and associate it with your SID, SYS user is revoked the CREATE USER system privilege.
Only a user with the DV_ACCTMGR role may create, alter or drop a user. This is done in order to separate responsabilities in your database. A SYS user cannot grant himself this role or the DV_OWNER role.
(If interested, check page 10-4 from http://www.oracle.com/pls/db111/to_toc?pathname=server.111/b31222/toc.htm)
Regards,
Leandro

Similar Messages

Insufficient privileges when creating MV with alter session set current_sch

I am getting Insufficient privileges when creating MV with alter session set current_schema=Application schema name. User running the alter session is DBA user. If run as SYSDBA, MV is created successfully. DB Version is 10.2.0.3
I observed similiar issue with regular View also in 9.2.0.6 also.
Any advice is greatly appreciated.
Thanks,
Siva

Sounds like your management needs a stern lecture on the concept of change management. <g>
I am not debating what you do. I am questioning the logic, or lack thereof, of doing it that way. My recommendation would be to change your procedure to one that:
A. Is more in line with good change management practices.
B. Works.

Insufficient Privileges when create materialized view as user system

If I login as system (connect sys/****@DevDB) and try to create a materialized view for another schema (e.g. XDCONTROLDB), I get the insufficient privileges error. If I login as sys as sysdba then I can create successfully.
I have searched some ariticles in Google and grant create any snapshot, create any table, create any view, global query rewrite, select any table system privileges to system but still get the same error.
Any other privileges I need to grant to system?
Cheers
below is a sample script to create the view which get the error:
CREATE MATERIALIZED VIEW XDControlDB."XDTest1" PCTFREE 10
PCTUSED 0 MAXTRANS 255
STORAGE ( INITIAL 64K NEXT 0K MINEXTENTS 1 MAXEXTENTS
2147483645 PCTINCREASE 0)
TABLESPACE "USERS"
BUILD IMMEDIATE
REFRESH COMPLETE START WITH sysdate NEXT sysdate + 1/24
ENABLE QUERY REWRITE AS
SELECT * From XDControlDB.RiskInstance;
Message was edited by:
user500168
Message was edited by:
user500168

Thanks for your reply. After I grant privileges to system, I login as system and try to create the view as below which I get the insufficient privileges error:
CREATE MATERIALIZED VIEW XDControlDB."XDTest1" PCTFREE 10
PCTUSED 0 MAXTRANS 255
STORAGE ( INITIAL 64K NEXT 0K MINEXTENTS 1 MAXEXTENTS
2147483645 PCTINCREASE 0)
TABLESPACE "USERS"
BUILD IMMEDIATE
REFRESH COMPLETE START WITH sysdate NEXT sysdate + 1/24
ENABLE QUERY REWRITE AS
SELECT 1 From XDControlDB.RiskInstance;
As you can see, I try to create the view under a schema called 'XDCONTROLDB'. If I login as sys as sysdba, then it create successfully.
After I create UserA, and grant the privileges I mentioned in the ealier post, I login as UserA, and run the statement above I get the same privileges error. But if I change the stament to below which will create the view under UserA's schema, then it create successfully:
CREATE MATERIALIZED VIEW UserA."XDTest1" PCTFREE 10
PCTUSED 0 MAXTRANS 255
STORAGE ( INITIAL 64K NEXT 0K MINEXTENTS 1 MAXEXTENTS
2147483645 PCTINCREASE 0)
TABLESPACE "USERS"
BUILD IMMEDIATE
REFRESH COMPLETE START WITH sysdate NEXT sysdate + 1/24
ENABLE QUERY REWRITE AS
SELECT 1 From XDControlDB.RiskInstance;
Looking for your suggestions,
Cheers

ORA-01031: insufficient privileges when creating a table in other schema

Dear all,
I appreciate your help please in this issue :
when i try to issue the below statement to create a table in an another schema than the user i am connected in
CREATE TABLE SCHEMA_NAME_B.HST_ARCH nologging AS
SELECT *
FROM HST
WHERE 1 = 0;
I always get ORA-01031: insufficient privileges error, even if i have granted the create table privilege to the user i am connected in.
What other privileges should i grant also,
Please if you have any idea.

user562674 wrote:
Dear all,
I appreciate your help please in this issue :
when i try to issue the below statement to create a table in an another schema than the user i am connected in
CREATE TABLE SCHEMA_NAME_B.HST_ARCH nologging AS
SELECT *
FROM HST
WHERE 1 = 0;
I always get ORA-01031: insufficient privileges error, even if i have granted the create table privilege to the user i am connected in.
What other privileges should i grant also,
Can you show us a cut/paste from the sql*plus of session of yours which should show that you have given the privilege directly to this user and after that the command fails?
Aman....

Found ORA-20072: insufficient privileges when run user package

We use workspace manager
enable version table : FEED_ADMIN.FEED_SET
login with my username : KTEERAYUT that have dba privilege
If we run dbms_wm in sqlplus. It work properly.
KTEERAYUT@BKKXE > BEGIN
2 dbms_wm.Beginresolve('D_1_1');
3 dbms_wm.resolveconflicts('D_1_1','FEED_ADMIN.FEED_SET','','PARENT');
4 COMMIT;
5 dbms_wm.rollbackresolve('D_1_1');
6 COMMIT;
7 END;
PL/SQL procedure successfully completed.
Then try create as procedure with FEED_ADMIN owner.
create procedure feed_admin.test_resolveconflicts_wm(p_workspace_name varchar2)
as
begin
dbms_wm.Beginresolve(p_workspace);
dbms_wm.resolveconflicts(p_workspace,'FEED_ADMIN.FEED_SET','','PARENT');
COMMIT;
dbms_wm.rollbackresolve(p_workspace);
COMMIT;
END;
Then test run with KTEERAYUT
KTEERAYUT@BKKXE > BEGIN
2 feed_admin.test_resolveconflicts_wm('D_1_1');
3 end;
4 /
begin
ERROR at line 1:
ORA-20072: insufficient privileges on 'FEED_ADMIN.FEED_SET'
ORA-06512: at "WMSYS.LT", line 8615
ORA-06512: at "FEED_ADMIN.TEST_RESOLVECONFLICTS_WM", line 5
ORA-06512: at line 2
I already grant all on FEED_ADMIN.FEED_SET to KTEERAYUT but it's still error.
Anyway It work properly if connect and execute with FEED_ADMIN.
So Can I run the package with another username? Which privilege that it's required?

Hi Ben,
Thanks for reply. Version of workspace manager is 10.2.0.4.4 on oracle 10.2.0.4 platform is window server 2003 sp2
Below is more detail.
1. Grant workspace manager privs to both user (KTEERAYUT also have dba privs)
GRANT EXECUTE ON dbms_lock TO feed_admin;
GRANT ROLE WM_ADMIN_ROLE TO feed_admin;
GRANT SELECT ON DBA_WORKSPACE_SESSIONS TO feed_admin;
begin
dbms_wm.grantSystemPriv (
'ACCESS_ANY_WORKSPACE, ' ||
'MERGE_ANY_WORKSPACE, ' ||
'CREATE_ANY_WORKSPACE, ' ||
'REMOVE_ANY_WORKSPACE, ' ||
'ROLLBACK_ANY_WORKSPACE',
'feed_admin',
'YES');
END;
GRANT EXECUTE ON dbms_lock TO KTEERAYUT;
GRANT ROLE WM_ADMIN_ROLE TO KTEERAYUT;
GRANT SELECT ON DBA_WORKSPACE_SESSIONS TO KTEERAYUT;
begin
dbms_wm.grantSystemPriv (
'ACCESS_ANY_WORKSPACE, ' ||
'MERGE_ANY_WORKSPACE, ' ||
'CREATE_ANY_WORKSPACE, ' ||
'REMOVE_ANY_WORKSPACE, ' ||
'ROLLBACK_ANY_WORKSPACE',
'apex',
'YES');
END;
2. FEED_ADMIN create table FEED_SET and enable version for FEED_ADMIN.FEED_SET
CREATE TABLE feed_admin.feed_set
(feed_set_id NUMBER PRIMARY KEY,
feed_set_name VARCHAR2(30)
GRANT ALL ON feed_admin.feed_set TO kteerayut;
BEGIN
dbms_wm.enableversioning('feed_set','VIEW_WO_OVERWRITE');
END;
SELECT * FROM ALL_WM_VERSIONED_TABLES;
INSERT INTO feed_admin.feed_set
VALUES (1,'new feed set');
COMMIT;
3. KTEERAYUT create workspace name : WORK
BEGIN
dbms_wm.gotoworkspace('LIVE');
     COMMIT;
     dbms_wm.createworkspace('WORK_TEST');
     dbms_wm.gotoworkspace('WORK_TEST');
     COMMIT;
END;
SELECT * FROM feed_admin.feed_set;
FEED_SET_ID FEED_SET_NAME
1 new feed set
4. FEED_ADMIN create procedure name : TEST_REFRESH and grant execute privs to KTEERAYUT
create or replace procedure FEED_ADMIN.Test_refresh is
BEGIN
dbms_wm.Beginresolve('WORK');
dbms_wm.resolveconflicts('WORK','feed_admin.feed_set','','PARENT');
COMMIT;
dbms_wm.Commitresolve('WORK');
COMMIT;
dbms_wm.refreshworkspace('WORK');
end Test_refresh;
GRANT EXECUTE ON Test_refresh TO KTEERAYUT;
5. Login with KTEERAYUT.
5.1 test directly command via sql*plus
BEGIN
dbms_wm.Beginresolve('WORK');
dbms_wm.resolveconflicts('WORK','feed_admin.feed_set','','PARENT');
COMMIT;
dbms_wm.Commitresolve('WORK');
COMMIT;
dbms_wm.refreshworkspace('WORK');
END;
PL/SQL procedure successfully completed.
5.2 but it will fail when call via procedure
BEGIN
feed_admin.Test_refresh;
END;
ERROR at line 1:
ORA-20072: insufficient privileges on 'FEED_ADMIN.FEED_SET'
ORA-06512: at "WMSYS.LT", line 8615
ORA-06512: at "FEED_ADMIN.TEST_REFRESH", line 4
ORA-06512: at line 2
Regards.

4.0 EA2 - Insufficient Privileges When Creating Object With Proxy

When I have connected by proxying to another user, I receive the following message when trying to create a new object:
The database user has insufficient privileges for the given operation.
Steps to reproduce:
Connect by proxying to another user
Right Click on Views
Select New View
I noticed this under EA1, though, not sure if reported. This worked under 3.2.2

Sounds like your management needs a stern lecture on the concept of change management. <g>
I am not debating what you do. I am questioning the logic, or lack thereof, of doing it that way. My recommendation would be to change your procedure to one that:
A. Is more in line with good change management practices.
B. Works.

How to create a logon script to delete folder, subfolders and contents when a user logs on ?

I need to create a logon script which will delete a folder, subfolder and contents when a user logs on. I have no experience with scripting so any pointers you can give would be much appreciated.
Thanks

depending on how you have thing set up, it might be easier to make a LaunchAgent to handle this. do this:
copy the text below into a text editor
save it as a plain text file in /Library/LaunchAgents with the file name "user.startup.folderDeleter.plist" (the name doesn't matter so much, but the 'plist' extension is required)
load the plist into launchd by restarting the machine or by opening terminal and running the command launchctl load /Library/LaunchAgents/user.startup.folderDeleter.plist
This will delete the folder any time any user logs in. You could also expand this to delete the folder periodically (once a day, for instance) if that would be helpful.
Note, this file must be saved as plain text. apps like TextEdit sometimes default to making rich text files which will not work. Either download a programmer's text editor like TextWrangler, or make sure that TextEdit is using plain text (if the window has a formatting toolbar it's using rich text; select "Make Plain Text" from the Format menu).
copy the text below:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
          <key>Label</key>
          <string>user.startup.folderDeleter</string>
          <key>RunAtLoad</key>
          <true/>
          <key>ProgramArguments</key>
          <array>
                    <string>osascript</string>
                    <string>-e</string>
                    <string>tell application "Finder" to delete folder "Final Cut Express Data" of folder (path to preferences from user domain)</string>
                    <string>-e</string>
                    <string>tell application "Finder" to empty trash</string>
          </array>
</dict>
</plist>

Insufficient privilege when Activating an attribute view (person responsible for package = SYSTEM)

Insufficient privilege when Activating an attribute view (person responsible for package = SYSTEM)
SAP HANA Studio
Version: 1.0.33
Build id: 201206301604 (363996)
Playing with the efashion tutorial with HANA Studio.
I am SYSTEM user by default when starting the studio.
-Schema created
-DDL created
-Data loaded
-Attribute views created
Below an extract of the error log:
<info>Create Attribute View failed: SQL: transaction rolled back by an internal error: insufficient privilege: Not authorized

Hello Anooj and Sri,
Thank you for your answers, I really appreciate your inputs.
So I executed this:
"GRANT SELECT ON SCHEMA SYSTEM TO _SYS_REPO WITH GRANT OPTION;"
Under the Studio SQL GUI and I still have the same error when activating my very simple attribute view.
I have installed a recent HANA + Studio + Client release on my laptop:
SAP HANA Studio
Version: 1.0.33
Build id: 201207050531 (364183)
And yes, this is a demo and yes I am logged as the SYSTEM user (default user when stating the studio). For now, I dont know how to connect to another user with the studio and I will search the doumentation.
Below a copy/past of the error msg.
Internal deployment of object failed;Repository: Encountered an error in repository runtime extension;Internal Error:Deploy Attribute View: SQL: transaction rolled back by an internal error: insufficient privilege: Not authorized (ptime/query/plan_executor/ddl/qx_cube.cc:1514) n
Create view DDL statement: CREATE COLUMN VIEW "_SYS_BIC"."efashion/ATV_OUTLET_LOOKUP" TYPE JOIN WITH PARAMETERS ( joinIndex = "EFASHION_TUTORIAL"."OUTLET_LOOKUP", joinIndexType = 0, viewAttribute = ('SHOP_ID', "EFASHION_TUTORIAL"."OUTLET_LOOKUP", "SHOP_ID", '', 'default', 'attribute', '', 'efashion/ATV_OUTLET_LOOKUP$SHOP_ID'), viewAttribute = ('SHOP_NAME', "EFASHION_TUTORIAL"."OUTLET_LOOKUP", "SHOP_NAME", '', 'default', 'attribute', '', 'efashion/ATV_OUTLET_LOOKUP$SHOP_NAME'), viewAttribute = ('MANAGER', "EFASHION_TUTORIAL"."OUTLET_LOOKUP", "MANAGER", '', 'default', 'attribute', '', 'efashion/ATV_OUTLET_LOOKUP$MANAGER'), viewAttribute = ('ZIP_CODE', "EFASHION_TUTORIAL"."OUTLET_LOOKUP", "ZIP_CODE", '', 'default', 'attribute', '', 'efashion/ATV_OUTLET_LOOKUP$ZIP_CODE'), viewAttribute = ('CITY', "EFASHION_TUTORIAL"."OUTLET_LOOKUP", "CITY", '', 'default', 'attribute', '', 'efashion/ATV_OUTLET_LOOKUP$CITY'), view = ('V_OUTLET_LOOKUP', "EFASHION_TUTORIAL"."OUTLET_LOOKUP"), defaultView = 'V_OUTLET_LOOKUP', 'REGISTERVIEWFORAPCHECK' = '1' )nVersion: 48n
Thank you.
Patrick

Getting ORA-01031: Insufficient privileges when connecting as sys as sysdba

Hi There,
I am running Linux AS version 4, oracle 102.0.1, and logginging as oracle user which belongs to dba group. I got error "ORA-01031: Insufficient privileges" when trying to connect as sys user to bring up database. I wondered what is causing the error. Here is an example
oracle-dev>sqlplus /nolog
SQL>conn as sys/oracle@dev as sysdba
ERROR:
ORA-01031: Insufficient privileges
Any suggestions would be greatly appreciated. Thanks again.
Rich,

Did you create a password file ?
http://download-uk.oracle.com/docs/cd/B19306_01/server.102/b15658/admin_ora.htm#sthref142
Message was edited by:
Paul M.
BTW, the syntax is
SQL>conn sys/oracle@dev as sysdba

Insufficient privileges while creating EUL

Hi All,
I am trying to create a new EUL in Discoverer 9.0.4. Option "Select an existing user" is selected and "Grant access to Public" is unchecked.
I am connected as user A. The tables are in schema for user B. So I selected the user B and entered the password. When I click "Finish", I get the following error:
Insufficient privileges to create a new user or grant the necessary privileges to an existing user. You must have CREATE USER, ALTER USER and GRANT ANY PRIVILEGE privileges.
Now user A does have privileges to create role, view, table, session, sequence, procedure. User B too has these privileges plus a few more.
Can somebody help me with what privileges am I lacking? For which user, A or B?
Thanks.

If you want to create an EUL the user you select (B in your case) must be the following privilegies:
CREATE SESSION
CREATE USER
GRANT ANY PRIVILEGE
ALTER USER
It doesn't matter the user you are connected in Discoverer.
Hope this helps.

Insufficient Privileges when calling package- Oracle9i

Hello People,
I've a Package PKGA owned by user A. PKGA contains a function returning boolean value. The Function performs dynamic SQL (using Execute Immediate) in order to Create user(Basically a User Admin package).
User B has been granted Execute any Procedure privilege, Create User and Alter User privileges by the SYS user.
When User B now tries to execute this package for eg: A.PKGA.create_user from a PLSQL block, there is a resultant 'Insufficient Privileges' error.
User B however can create it's own identical package PKGB and execute this package to create user NewUsr, following that, User B grants execute any procedure and create session privilege to NewUsr. Furthermore NewUsr can now logon and execute PKGB without any trouble.
What could possibly be the problem. Why is User B unable to execute PKGA? What other privilege does User B need?
Cheers

If UserA owns the package, and assuming that you are using the default of definer's rights, UserA needs to have CREATE USER and ALTER USER privileges. UserB does not need to have these privileges to call a procedure owned by UserA that creates and modifies a user.
If I create a procedure in a highly privileged account that, for example, kills a session, I can grant normal users EXECUTE access on that procedure without granting them the underlying privileges necessary to kill a session.
Justin
Distributed Database Consulting, Inc.
http://www.ddbcinc.com/askDDBC

Insufficient privileges to create the RDF NETWORK

Hi,
I am using user scott to test a rdf database using oracle 11.2.0.2 contained in oracle developer days. I granted resource, create session, create table, and create tablespace to scott. I am able to create a tablespace under scott. I also used the OEM panel to grant many privileges in roles, system privileges and object privileges to scott. However, I am still not able to create the rdf network under scott. The error says insufficient privileges to create the RDF NETWORK. How can I grant a priviledge to scott to create a rdf network? Thanks a lot.
hong

Hi Hong,
Yes. This is the correct order. You must first create the semantic network as a user with DBA privileges. After that, you can create semantic models with a less privileged user.
You can find more information in the Quick Start Section of the user guide:
http://docs.oracle.com/cd/E11882_01/appdev.112/e25609/sdo_rdf_concepts.htm#CHDEDFFA
Hope this helps,
Matt

How do you make a program run when any user logs in?

I have an application which will need to run when any users logs in.
Such that Joe downloads and installs the application, logs out, then Sally logs in and the application runs for Sally.
Does anyone know how to do this?

Hey Steve, thanks for that link. It seems to be what
I am looking for. What is the meaning of the
~/Library vs /Library ? They are definitely
different folders.
Yes, they are definitely different folders. The "~" character represents the current users home folder, so "~/Library" represents the Library folder that's located inside a users home folder. Anything placed in there will only affect the one user whose home folder you've accessed.
The "/Library" folder is the Library folder that exists at to root of the boot volume. Things placed in this Library folder will affect all users of the system. Basically it's sort of a "global" Library.
Also, from a script, how do I add an item to execute
for that kind of PList?
That could be tricky based on the structure of that particular plist file. I haven't really looked at it closely but one place you could start is to read the "man" page for the "defaults" command... enter "man defaults" in Terminal. The "defaults" command allows you to read/write plist files, but defaults is not very good at accessing deeply nested plist items.
Related to that, how do I tell if the logging item
for my App is already there? I do not want to keep
adding to the list if it is there. If someone
deletes my app and then reinstalls it, I do not want
it to run twice, three times, etc..
Again, you could possibly read the plist using the defaults command and determine whether your item was already present or not.
Do you know of the one in the ~/Library path, what
user it execute as? Since it is all users, it
probably is root or something like that.
No, the one in ~/Library is in each individual user home folder. It will execute with the current user's privileges. This is where Login Items normally go when you go through the GUI... "Sys.Prefs -> Accounts -> Login Items" and add a login item for one user.
Even items placed in /Library, which should execute for all users, will execute with the current user's privileges.
In the near
future we might need root privileges, so I might need
a program to startup for all users as root instead of
the user.
Is your app, that needs to run at login time, a GUI application or is it a faceless shell script (or something similar). Your original post gave me the impression that you needed to launch a GUI application. However, if it's a shell script then you probably want to look at doing a LoginHook instead of using the Login Items procedure at the web page I posted earlier. I believe a LoginHook will also give you the ability to run the script as root.
Check out this link at the ADC website.
or
Take a look at this information and this utility at Mike Bombich's website.
Steve

When creating users in apex,how can i limit pages depending the user?

Hi,
1.When creating users in apex,how can i limit every user in the pages he can run or see depending on the user profile ?
2.Are the user that is created in apex also a user in DB ?
Thanks in advance
Yoel

Yoel -
We're talking about end users of applications you develop in Application Express, not users that login to the development environment.
You do not have to use Application Express to create user accounts for your application. Your apps can authenticate using SSO, LDAP, or other methods. If you use Application Express user accounts, that is only for convenience which may not be convenient in the long run if you have to manage those accounts, but that's up to you.
These Application Express accounts have no relation to database accounts. This situation is slightly different when using the XE database.
Your application's authorization logic determines which users can access the application, pages, or other components, that is, it is not the user account properties, per se, that control application access but rather the application's determination about the properties of the authenticated account in use that allow it to control access. For example, you don't create an account and give it attributes that say this user can access application ABC and pages 1,2, and 7. Instead, you might give that account properties like SALES MANAGER ROLE and the the application would allow only users with SALES MANAGER ROLE (whatever that means) to access certain pages.
Scott

Pre populating the database field when a user logs into web forms

Hi,
When my users log into the web forms application I want the database name field to be pre populated, how do I do this, I presume it can be defined in the config files ?
Thanks in anticipation.
SDG.

Hi,
I think u are refering to the username, password, database field (connect string)
here. If this is the case then you can use LOGON(username, password||'@'||connectstring) procedure and hardcode the connect string.
Best Regards
Rajesh Alex

Insufficient privileges when creating user logged in as SYS

Similar Messages

Maybe you are looking for