Linux non-oracle user cannot connect to database using TNS

Question

LS,
I've installed Oracle 11gR2 on a linux box (name="ilmserver") running CentOS 5.4 (based on RHEL).
Created user "oracle" and groups "oinstall" and "dba".
Installation under user "oracle" went fine, and logged in as "oracle" user I can - naturally - access the database easily (via SQL+, or using SQL Developer it works via Basic, TNS, and Advanced (=jdbc)).
I have a second user on the linux box called "informatica", on which I have installed Informatica ILM 5.3.2, which uses the Oracle database as its repository.
The "informatica" user has been granted the same groups as the "oracle" user, i.e. "oinstall" and "dba".
I have severe problems accessing the Oracle database as the "informatica" user.
Using SQL Developer I can access the database using the "Basic" method, but not TNS.
But guess what: for ILM to work to its fullest extent I need to implement an environment variable called TNS_ADMIN.
I have implemented it, it sits in bash_profile and as such works fine:
+[informatica@ilmserver ~]$ echo $TNS_ADMIN+
+/home/oracle/app/oracle/product/11.2.0/dbhome_1/network/admin+
But as for being able to access it:
+[informatica@ilmserver ~]$ cat $TNS_ADMIN/tnsnames.ora+
cat: /home/oracle/app/oracle/product/11.2.0/dbhome_1/network/admin/tnsnames.ora: Permission denied
Somehow I thought that granting "oinstall" group to "informatica" user would take care of this. Obviously it doesn't. I also granted "dba" group to "informatica", to no avail apparently.
This is then - I assume - also the reason that when I want to connect using TNS from within SQL Developer, the dropdown list is empty (because it's not able to read TNSNAMES.ORA).
Does anyone know how to resolve this issue?
Thanks heaps!
Cheers, Patrick

Answer 1

Just ran all+ commands for oracle user:
*[oracle@ilmserver ~]$ id*
uid=502(oracle) gid=504(oinstall) groups=503(dba),504(oinstall),505(asmdba),506(asmadmin) context=user_u:system_r:unconfined_t
*[oracle@ilmserver ~]$ env | sort*
COLORTERM=gnome-terminal
CVS_RSH=ssh
DBUS_SESSION_BUS_ADDRESS=unix:abstract=/tmp/dbus-m8BEsoxTeM,guid=7c9a73a7390af7742e606e004e571934
DESKTOP_SESSION=default
DESKTOP_STARTUP_ID=
DISPLAY=:0.0
G_BROKEN_FILENAMES=1
GDMSESSION=default
GDM_XSERVER_LOCATION=local
GNOME_DESKTOP_SESSION_ID=Default
GNOME_KEYRING_SOCKET=/tmp/keyring-TQlAPU/socket
GTK_RC_FILES=/etc/gtk/gtkrc:/home/oracle/.gtkrc-1.2-gnome2
HISTSIZE=1000
HOME=/home/oracle
HOSTNAME=ilmserver
INPUTRC=/etc/inputrc
JAVA_HOME=/usr/java/jdk1.7.0
LANG=en_US.UTF-8
LESSOPEN=|/usr/bin/lesspipe.sh %s
LOGNAME=oracle
LS_COLORS=no=00:fi=00:di=00;34:ln=00;36:pi=40;33:so=00;35:bd=40;33;01:cd=40;33;01:or=01;05;37;41:mi=01;05;37;41:ex=00;32:*.cmd=00;32:*.exe=00;32:*.com=00;32:*.btm=00;32:*.bat=00;32:*.sh=00;32:*.csh=00;32:*.tar=00;31:*.tgz=00;31:*.arj=00;31:*.taz=00;31:*.lzh=00;31:*.zip=00;31:*.z=00;31:*.Z=00;31:*.gz=00;31:*.bz2=00;31:*.bz=00;31:*.tz=00;31:*.rpm=00;31:*.cpio=00;31:*.jpg=00;35:*.gif=00;35:*.bmp=00;35:*.xbm=00;35:*.xpm=00;35:*.png=00;35:*.tif=00;35:
MAIL=/var/spool/mail/oracle
ORACLE_BASE=/home/oracle/app/oracle
ORACLE_HOME=/home/oracle/app/oracle/product/11.2.0/dbhome_1
ORACLE_HOSTNAME=ilmserver
ORACLE_SID=orcl
PATH=/usr/kerberos/bin:/usr/local/bin:/usr/bin:/bin:/usr/X11R6/bin:/home/oracle/bin:/usr/java/jdk1.7.0/bin:/usr/sbin:/sbin:/home/oracle/app/oracle/product/11.2.0/dbhome_1/bin
PWD=/home/oracle
SESSION_MANAGER=local/ilmserver:/tmp/.ICE-unix/14477
SHELL=/bin/bash
SHLVL=2
SSH_AGENT_PID=14513
SSH_ASKPASS=/usr/libexec/openssh/gnome-ssh-askpass
SSH_AUTH_SOCK=/tmp/ssh-INwup14477/agent.14477
TERM=xterm
TNS_ADMIN=/home/oracle/app/oracle/product/11.2.0/dbhome_1/network/admin
USERNAME=oracle
USER=oracle
_=/usr/bin/env
WINDOWID=24117329
XAUTHORITY=/tmp/.gdm9ITN0V
XMODIFIERS=@im=none
*[oracle@ilmserver ~]$ ls -l /home/oracle/app/oracle/product/11.2.0/dbhome_1/network/admin/tnsnames.ora*
-rw-r----- 1 oracle oinstall 879 Aug 24 21:39 /home/oracle/app/oracle/product/11.2.0/dbhome_1/network/admin/tnsnames.ora
*[oracle@ilmserver ~]$ ls -ld /home/oracle/app/oracle/product/11.2.0/dbhome_1/network/admin/*
drwxr-xr-x 3 oracle oinstall 4096 Aug 24 21:39 /home/oracle/app/oracle/product/11.2.0/dbhome_1/network/admin/
*[oracle@ilmserver ~]$ ls -ld /home/oracle/app/oracle/product/11.2.0/dbhome_1/*
drwxr-xr-x 74 oracle oinstall 4096 Aug 23 19:00 /home/oracle/app/oracle/product/11.2.0/dbhome_1/
*[oracle@ilmserver ~]$ ls -ld /home/oracle/app/oracle/product/11.2.0/*
drwxr-xr-x 3 oracle oinstall 4096 Aug 23 18:21 /home/oracle/app/oracle/product/11.2.0/
[*oracle@ilmserver ~]$ ls -ld /home/oracle/app/oracle/product/*
drwxr-xr-x 3 oracle oinstall 4096 Aug 23 18:21 /home/oracle/app/oracle/product/
*[oracle@ilmserver ~]$ ls -ld /home/oracle/app/oracle/*
drwxr-xr-x 10 oracle oinstall 4096 Aug 24 17:29 /home/oracle/app/oracle/
*[oracle@ilmserver ~]$ ls -ld /home/oracle/app/*
drwxr-xr-x 4 oracle oinstall 4096 Aug 23 18:21 /home/oracle/app/
*[oracle@ilmserver ~]$ ls -ld /home/oracle/*
drwx------ 22 oracle oinstall 4096 Aug 25 20:55 /home/oracle/
Naturally the "oracle" user has full access to its own directories.
A thought just occurred to me. I assume that theoretically it's possible to grant read privilige to informatica user on all these directories... would that do the trick?
But even if so, makes me wonder whether that is "best practice".
Also, I cannot imagine I'm the first person to encounter this scenario, and therefore there must be some standard approach to enable this.
Any suggestions/thoughts?
As for the TNSNAMES.ORA suggestion, I guess that is possible. Makes administration of TNSNAMES a bit more cumbersome though, as in, 2 files to maintain... risk of getting out of sync when making 'quick and dirty' changes without thinking things through too much (which shouldn't happen... but sometimes does anyway).
I'd prefer a solution where "informatica" has genuine access to TNSNAMES.ORA.
Thanks, Patrick
ps the bold bits with env.var LS_COLORS are unintentional, but don't know how to turn that off