Creating database (confused!)

Question

hi,
it says that when you're creating a database, you have to log into the database as sysdba, and then do create database...but how can you log in to the database when it hasn't even yet been created? I mean, how can you connect as sysdba, because the database does not even yet exist and therefore neither should this privilege?
thanks.

Answer 1

Once you are in the nomount stage,you need to issue the command
connect / as sysdba
Here the "/" implicitly connects you as Sys schema..
There's nothing implicit about this at all. The command 'connect / as sysdba' means "please connect me to an instance, authenticating me using OS authentication methods, and I want to claim the SYSDBA system privilege whilst doing so".
Exactly the same effect can be achieved by issuing the command "connect sys/fred as sysdba". This simply means "connect me to an instance, authenticating me with an Oracle password file, and I want to claim the SYSDBA system privilege whilst doing so".
In neither case is the connection to the SYS schema "implicit", since the request for SYSDBA privileges is explicit in both -and the only "schema" that can ever acquire SYSDBA privileges is SYS's.
The only difference between the two forms of the connection command, in fact, is whether to use OS or password file authentication.
This fact makes it all the more unfortunate that you would go on to write, "You will log in to your instance using this command and than will issue ,create database command.Oracle maintains the Sys user's password in a password file."
If, as you say, Oracle is maintaining something in a password file, then the connection command you actually gave (which very deliberately didn't mention a password!) shouldn't be used (the idea of a password file is that you should supply the password when connecting!). If you're going to use the password-less form of the connection string, then the one thing you can say with some confidence is that there is NOT a password file (or, at least, that its existence is entirely optional).
Your answer also completely misses the point that I might well connect as follows: connect hjr/dizwell as sysdba. That's password file authentication, requesting the SYSDBA system privilege. I will end up connected using hjr's credentials -but a 'show user' in SQL*Plus will STILL show me connected as SYS.
A more meaningful answer to the original question (of "how can you log in to the database when it hasn't even yet been created") is very simple:
1. No-one ever logs onto a database. Ever.
2. People only ever connect to an instance.
3. Usually, the database tables (USER$, for example) are used to check on user names and passwords and privileges to work out whether you are allowed to connect to an instance or not. That's called 'data dictionary authentication' -and obviously can only happen once the database exists, those tables exist and can be read and accessed properly ...post-database-creation, in other words, and post-database-opening.
4. A 'privileged user' is one who is allowed to perform the five privileged actions (which are: startup, shutdown, backup, recover and create)
5. Privileged users are never authenticated by the data dictionary, at least partly because of the Catch22 situation you describe: how can we use a data dictionary table to authenticate whether you are allowed to create (or startup!) the very thing needed to store that table in the first place
6. Privileged users are therefore always only ever authenticated either by the OS (membership by an ordinary user of the OS of an appropriate OS group -such as dba on Unix or ORA_DBA on Windows); or by a password file
7. OS group membership or password files are external to the database -that is, their existence has nothing to do with whether the database exists or has been opened for business.
8. Therefore, privileged users can be authenticated whether a database exists or has been opened for business or not.
9. There is actually only ever one privileged user: SYS. Therefore, you can connect as SYS regardless of whether a database exists or has been opened for business or not.
And how you connect as SYS (which of the two authentication methods you want to use, in other words -and which is the only thing your answer concerned itself with) is completely and utterly irrelevant to all of that.