Mapping a user's role and privilege to another

Hi all,
Is there a command/way to map the role and privileges of a current user to a new user? I am new to oracle, I did read through the online docs but was not able to figure it out.
Thank you very much!

Check this link would help: Check the part where they are copying roles and grants for the users using dbms_metadata. You can limit this to one user you want by adding additional where clause like "where username = <username>
Copying Oracle Users

Similar Messages

  • Create new user same as a existing roles and Privileges

    Hi Team,
    I am a junior DBA. New user Joined in Application team. So, Client requested me.....
    Crerate new user with same privileges as like as existing user.
    As of now i am creating user like "create user username identified by "password". Then grant privileges to that user. earliar I never comapare or copied users.
    Please suggest any one how to create new user as like as existing user roles and privileges.
    Thanks,
    Venkat

    For basic cloning:
    select dbms_metadata.get_ddl('USER', '...') FROM DUAL;
    SELECT DBMS_METADATA.GET_GRANTED_DDL('ROLE_GRANT','...') FROM DUAL;
    SELECT DBMS_METADATA.GET_GRANTED_DDL('SYSTEM_GRANT','...') FROM DUAL;
    SELECT DBMS_METADATA.GET_GRANTED_DDL('OBJECT_GRANT','...') FROM DUAL;
    SELECT DBMS_METADATA.GET_granted_DDL(‘TABLESPACE_QUOTA’, ‘...’) FROM dual;
    Then just replace the username with the new one you want to create.

  • Error in reconcilation Function - Job "Reconcile roles and privileges"

    SAP NW 7.0 SP2 Patch 3
    Roles contain Privileges
    Help file says: "If you are using roles and privileges, you will need to perform a reconciliation of the roles/privileges assigned to the users in the identity store after the roles are modified. "
    Job imported as described.
    When I let the job run on the ID-Store, for each entry, the following error message occurs:
    runFunctionsInString($FUNCTION.reconcile( MSKEY )$$) got exception
    org.mozilla.javascript.NotAFunctionException: reconcile( MSKEY )
    ...where MSKEY is, of course, the MSKEY of the entry.
    If I let run the job with the Windows-Dispatcher and as a VB-script, it produces no error; however, in the output file, there are a lot of Messages like
    "!ERROR: Invalid use of Null"
    Only some entries (of Type MX_PERSON) show the "Priviliege added: (...)" output. But the job does not add the Privileges assigend to the role, as it should.
    So, I would suggest that one redefines the SQL-Query of the Job so that it runs only on MX_PERSONS. But then, still, in my case, it does nothing.
    Has anyone better experiences with the Job?
    Edited by: Thomas P. Felder on Sep 25, 2008 10:32 AM

    The job when imported by default uses java runtime engine but the script is written in vbscript syntax so you have to change the engine or the script syntax.
    When you did your select statement did you use SELECT DISTINCT.  That will also cause errors.  I do not narrow the entry type to MX_PERSON.
    I'm installing the patch now;  I will see if I get any errors.

  • Role and privilege used by JDBC

    Is there any reqiured role and privilege used by JDBC?
    I use Oracle JDBC9203 for Oracle to connect Oracle8163, when executing certion codes, the JDBC raise a exception as below:
         at oracle.jdbc.dbaccess.DBError.throwSqlException(DBError.java:134)
         at oracle.jdbc.dbaccess.DBError.throwSqlException(DBError.java:179)
         at oracle.jdbc.dbaccess.DBError.throwSqlException(DBError.java:269)
         at oracle.jdbc.oracore.OracleTypeCOLLECTION.initCollElemTypeName(OracleTypeCOLLECTION.java:1026)
         at oracle.jdbc.oracore.OracleTypeCOLLECTION.getAttributeType(OracleTypeCOLLECTION.java:1056)
         at oracle.jdbc.oracore.OracleNamedType.getFullName(OracleNamedType.java:110)
         at oracle.jdbc.oracore.OracleTypeADT.createStructDescriptor(OracleTypeADT.java:2262)
         at oracle.jdbc.oracore.OracleTypeADT.unpickle81(OracleTypeADT.java:1656)
         at oracle.jdbc.oracore.OracleTypeUPT.unpickle81UPT(OracleTypeUPT.java:466)
         at oracle.jdbc.oracore.OracleTypeUPT.unpickle81rec(OracleTypeUPT.java:416)
         at oracle.jdbc.oracore.OracleTypeCOLLECTION.unpickle81_imgBody_elems(OracleTypeCOLLECTION.java:979)
         at oracle.jdbc.oracore.OracleTypeCOLLECTION.unpickle81_imgBody(OracleTypeCOLLECTION.java:923)
         at oracle.jdbc.oracore.OracleTypeCOLLECTION.unpickle81(OracleTypeCOLLECTION.java:743)
         at oracle.jdbc.oracore.OracleTypeCOLLECTION._unlinearize(OracleTypeCOLLECTION.java:242)
         at oracle.jdbc.oracore.OracleTypeCOLLECTION.unlinearize(OracleTypeCOLLECTION.java:208)
         at oracle.sql.ArrayDescriptor.toJavaArray(ArrayDescriptor.java:963)
    I decompile "OracleTypeCOLLECTION.class", in funtion "initCollElemTypeName", i see a SQL as "select elem_type_name, elem_type_owner from all_coll_types where ....", this sql raise the error.
    Since all_coll_types is a system view of Oracle, i think the user connect to Oracle must have some role and privilege, it has connect role and execution privileges on some user-defined packages, is there any other role and privilege it needs? I don't like to grant DBA role to it for security reason.
    Very thanks for your reply.

    Can you post the code (Java and PL/SQL) that is being executed when this error is thrown? You don't need any particular privilege to execute PL/SQL via JDBC-- just the privileges you'd need to execute it in SQL*Plus or anywhere else.
    Justin
    Distributed Database Consulting, Inc.
    www.ddbcinc.com/askDDBC

  • Role and Privileges for OLAP metadata

    Hi,
    Is there any document which specifies what all roles and privileges are required for creating any OLAP meta data ( Dimension, Cube, Measure and Catalog etc)?
    I think these are impt roles:-
    SELECT_CATALOG_ROLE
    EXECUTE_CATALOG_ROLE
    DELETE_CATALOG_ROLE
    RECOVERY_CATALOG_OWNER
    OLAP_DBA
    OLAP_USER
    Through system/manager I created one user TEST_BI_OLAP and granted CONNECT.
    After login as TEST_BI_OLAP I am able to create dimension. Why it is possible whereas doc says user should have OLAP_USER or OLAP_DBA role associated with it.
    OR only CONNECT is sufficient for creating OLAP metadata!!!!!
    regds
    P

    The difference is in what the end user sees. Say you want to deploy an analytical workspace based off of a ROLAP dimensional cube. Here is how I've been approaching the problem:
    1. Create a new user with the OLAP_USER role to hold the AW (say "AW_USER")
    2. Now log in with a userid that has OLAP_DBA role, and create the AW utilizing the ROLAP cube - but direct the AW to be stored in the AW_USER schema. Note that because it is in a separate schema from the ROLAP cube, you will not need to append characters to the dimension or measure names.
    3. Have end users log in using the AW_USER name. Then they will see the AW information, but they will not have access to the ROLAP cube data.
    Hope this helps,
    Scott

  • Roles and Privileges for 10g AWR and ASH reports

    Are there specific roles and privileges are required for one to run AWR and ASH reports for users who don't have DBA roles? If so, I would like to know about them.

    I think sysdba privilege need to run AWR report.
    Also check, how privilege is granted to PERFSTAT user in $ORACLE_HOME/rdbms/admin/spcuser.sql, you might get some clue!!!
    Cheer,
    Virag

  • Export and Import of Roles and Privileges

    Hi,
    We're nearing the end of our development phase and are now preparing for initial load in our QA / Test environment.
    Is there a way to export the Roles and Privilege metadata from one environment to import them into the other. The Staging guide states you need to create them before importing your Identity Stores. I was hoping we didn't need to do this as it's a time consuming task to create them manually.
    Thanks
    Paul

    What I've seen is Business Role Export / Import functionality. It is pretty straight-forward to do, just export the Business Roles in a job (limit what to export in the source SQL) to a CSV-file, then read it back in to different environment in similar job.
    When we were exporting the Business Roles we expored the privilege-references as MSKEYVALUEs not MSKEYs. Note how you have named your repositories in different environments (as you know the name of the MX_PRIVILEGE differs if your ERP repository in development is eg ERP100 and in Q/A ERP200), you may need to convert the privilege names accordingly in export or import.
    One more thing you need to keep in mind is to pay attention whether your data has CR+LFs, which will break the CSV, we tackled this by encrypting/decrypting the data that had line feeds (DESCRIPTION-attribute).

  • Mapping of users with roles in BPM

    Hi, in oracle BPM there is a mapping of user with the roles.I have search the BPM database tables in dev_soainfra schema but no tables consists of mapping of these tables.I have a urgent requirement of it so that i can use it on adf form.
    Can anyone plz tell me where to get it.
    =>I got the Organization.XML file in BPM which consists of the mapping of these two.But i am not able to create datacontrol from xml file so that it can be used on adf form.Anyone plz help me out.
    Thanks

    BPM Roles are in turned mapped to Application Roles and the users are added to these application roles. So I don't think it is available in DB. You might need to get it from Application Roles using OPSS API if available or system-jazn-data.xml (if you policy store is file based) or from your LDAP.

  • Trying to auto generate roles and privileges

    Greetings All,
    Oracle Enterprise 11g v11.2.0.1.0 on Windows Server 2008
    I have a database with many schemas. One of the schemas is referred to as the CM_MASTER schema in that it has been granted the following: dba, create user, drop user, alter user, create any table, select any table, and a few others, all with the “with admin option” clause.
    We have developers that need select only access to the tables and views of the non-master schemas. My plan was to create a unique ROLE for each schema, then grant select on each table and view in that schema to that unique role. Then grant the appropriate role(s) to each developer hence giving them read only access.
    I can accomplish the above manually while logged on as the CM_MASTER schema.
    I am trying to create a procedure owned and executed only by the CM_MASTER schema that creates a new role and then grants to that role. The procedure accepts a parameter containing the user name of the target schema. The procedure is able to create the role (create role scott_r) successfully.
    However, I am getting an insufficient privileges error (see below) after the role has been created, when trying to issue the “grant select on scott.some_table to scott_r” command via "execute immediate".
    Any ideas what privilege(s) the CM_MASTER user needs in order to be able to issue the grant(s) to the role?
    Error message below:
    exec gen_schema_role('scott');
    Error report:
    ORA-01031: insufficient privileges
    ORA-06512: at "CM_MASTER.GEN_SCHEMA_ROLE", line 30
    ORA-06512: at line 1
    01031. 00000 - "insufficient privileges"
    The procedure code is below:
    The utl_file.put_line commands were added for debugging but nothing gets output.
    When the "execute immediate" lines are commented out, the output from the utl_file.put_line commands displays the correct SQL create and grant statements.
    create or replace
    procedure gen_schema_role(p_db_user in varchar)
    as
    v_role_name varchar2(30);
    v_bat_out utl_file.file_type;
    cursor get_object_names is
    select object_name from dba_objects
    where owner = upper(p_db_user)
    and object_type in ('TABLE','VIEW')
    and status = 'VALID'
    and object_name not like 'DR$%'
    and object_name not like 'XT%';
    begin
    v_bat_out := utl_file.fopen('SR_BACKUP', 'Create_Roles.sql', 'W');
    v_role_name := substr(p_db_user,1,28) || '_r';
    utl_file.put_line(v_bat_out, ' ');
    utl_file.put_line(v_bat_out, 'create role '||v_role_name);
    execute immediate 'create role '||v_role_name; <<-- This seems to work, the role gets created
    for a in get_object_names
    loop
    utl_file.put_line(v_bat_out,' grant select on ' || p_db_user || '.' || a.object_name || ' to ' || v_role_name);
    execute immediate 'grant select on ' || p_db_user || '.' || a.object_name || ' to ' || v_role_name;
    end loop;
    utl_file.fclose(v_bat_out);
    end gen_schema_role;
    Thanks,
    Snyds

    sb92075,
    I just tried, and YES the SQL is able to apply the "grant select" statements to the newly created role.
    I wanted to call this new procedure from the procedure that creates a new user by scheduling a job to perform an IMPDP job to import a base schema (using the remap schema clause).
    Any suggestions how to automate generating this role?
    Thanks,
    Snyds

  • Mapping of users with roles

    Hi, in oracle BPM there is a mapping of user with the roles.I have search the BPM database tables in dev_soainfra schema but no tables consists of mapping of these tables.I have a urgent requirement of it so that i can use it on adf form.
    Can anyone plz tell me where to get it.
    =>I got the Organization.XML file in BPM which consists of the mapping of these two.But i am not able to create datacontrol from xml file so that it can be used on adf form.Anyone plz help me out.
    Thanks

    Hi.
    What is the BPM product version (10g or 11g)?

  • RFC Sender - Logon User - What Roles and Authorizations?

    Hi,
    Scenario: RFC Sender --> XI --> JDBC
    What necessary Roles and Authorizations has to be given for Logon User (in Sender RFC Communication Channel).
    It has to be moved to production soon. My Client wants to give only Roles and Authorization that are necessary for the Logon User.
    With Regards,
    Manikandan R

    Hi ,
    U need to give ECC Authorisation
    Application server : ECC Server
    Sytsem no : ECC system number
    Logoon User : ECC any username
    password : password for above user
    clientr : ECC client ( From which client u are sending to RFC adapter)
    Regards,
    Jayasimha jangam

  • User Profiles, Roles and  Permission folder empty

    Hi,
    We installed Peoplesoft 8.49 Apps 9.0, and 10G Oracle on Windows 2003, everything working perfectly except User profiles and Roles and Permission Folders
    I have ran AE scripts well, even then we are not able to browse those sections
    Any help much appreciated
    Thanks

    >
    We installed Peoplesoft 8.49 Apps 9.0, and 10G Oracle on Windows 2003, everything working perfectly except User profiles and Roles and Permission Folders
    >
    What do you mean by this? What is not working? What are you expecting and what is happening?

  • PBC 10 user users/teams/roles and access data profiles

    Hello experts,
    couples of questions with regards to BPC 10 security
    1) In PBC 10, version SAP NetWeaver , if a team or a user was created in BPC not in BW, can the created user/team has access to SAP BW? Can the created team/user be imported and assigned assigned rights in BW?  Or , if I need a user who will have acces to both SAP BW and BPC , do I HAVE to create the user in SAP NetWeaver (BW) and assign rights?? or
    2)
    If the defined attributes are Currency=Euro: Read and Country=France: Write, then Entity102 is writable.
    Assuming that a write access to Currency = Euro : Write produce the same output as in the above, How can ensure that I can give a write access on a dimension without having allowing the write access to the whole entity as in the above case?
    Thanks
    Jh

    Hi John,
    For your 1st question, to add a BPC user, you need to create BW user first on BW. Then add this BW user as BPC user. When you create a BW user, you need to assign two roles
    /POA/BUI_FLEX_CLIENT, /POA/BUI_UM_USER.
    Actually, once you created the BW user, you can use this BW user to log on to BW now, but this user has few rights, such as no rights to execute some t-code RSA1, etc. To make this BW user more powerful, you need to assign the corresponding rights directly on BW, not from BPC. The rights(Data Access profile or task profiles) added from BPC only works on BPC object, such as members, cube, etc.
    Best Regards,
    Charlie

  • Su01 recreate old user - lost roles and profiles

    Situation: a person's sap account was deleted, but now that person needs it again with the same sap access as before
    when you recreate an old sap user account in su01,
    sap gives a message "found old user information, do you want to reacreate this".
    Press yess, then all is copied except roles and profiles (empty)....
    You can find them back via the menu : information<change dcuments for users.
    Is there a way to make sure that roles (and/or profiles) are instantly copied from the old records of the sap account (like
    the name, email user group, user parameters, etcetera)?
    Regards,
    ABC

    No. There is no such feature.
    The solution is not to delete the user but rather lock the ID and move it to a "retired" user group where it is protected. From there you can restore it again easily.
    Cheers,
    Julius

  • DFD diagram and ER crossmatrix for role definitions and role's privileges on objects

    Hello,
    Having the question on derivative use of combination of DFDs and ER diagrams ( let us be more fixes and focus on Relational model ).
    In DFD there are defined external entities and functions, data flows and data stores that are forming processes.
    Functions represents procedures, transactions, transformations.
    Dataflows presents procedures parameters, intermediate reports, temporary table data, data that is passed , retrieved/written, signals, triggers/events that controle or trigger function...
    Context of my question is focused on external entities.
    External entity suppose to denote the sourced or destinationed system ( for example Archiving system ) or operator, system that is out of scope of the DFD and it is mentioned just as target or destination or source of dataflow or control flow.
    In context of these understandings I am using external entitiy also for types of users of the system:  staff that is triggering functions or schedulers or job managers, or reporting systems ( or components of reporting systems like for example business intelligence extraction processes ).
    What is my problem that on basis of external entity definitions and E/R model also define roles and privilege classes for access to data objects.
    And from those generating ddls for database roles, privileges on entitities to those roles.
    But in privileges granting to role having two different kind of privileges on data objects:
    - privileges that are granted on various schema objects
       For example role1 has grant on tab1, view2, procedure1, package3,
    - the other type of privilega is based on the scope or range of semantically defined scope or semantic area.
    Semantic area is scattered through tables because of normalisation and using semantic area as entity of which primary key is
    partitioning the table data through many semantic areas.
    So this privilege should be granted on basis of the rows in table not column ( more semantically then structurally ...row oriented more than column ).
    Both privileges that are granted to roles are also basis for functional roles
    ( privilege that is granted that functional role has grant to trigger or execute some function or process ).
    My question is?
    How do you handle modeling technology for analysis and design for role privileges and consolidation between database and functional roles ?
    Grateful for any idea, experience and suggestions.

    Hello,
    Guess I was looking for the formal sequence of steps that would bring me to the
    ddls for "create role ..." and "grant privileges to role".
    You can do that.
    1) I assume you have logical model and it's engineered to relational model, also you have data flow diagram created
    2) You need to define information structures for flows connecting "Information store" to primitive process - attribute usage of particular entities should be defined for those "information structures" processed in flows
    3) You need to define create, update and delete operation for flow going from primitive process to store - read is assumed in opposite direction
    4) create a role in Process model and assign primitive processes to it - list of available processes to add depends on current data flow diagram
    5) You need an open physical model for your relational model
    6) Select "transfer process model roles to physical model roles" from context menu of top level DFD - select roles, relational and physical model there - roles with related permissions will be created in physical model
    Entity1 is divided in several subtypes for different business areas.
    And account manager for business_area1 is allowed to work on subtype1 ( view on prime table )...
    Different implementation of entity hierarchies are not processed correctly in that wizard - i.e to get permissions to table corresponding to child entity - that entity should be used in information structure and flow.
    Philip

Maybe you are looking for