Proper privileges in production environment

In our environment, we attempt to maintain the policy that developers may not make any code or data changes in the production environment. Developers can however select on just about anything they want to, in order to troubleshoot problems the users bring up. This has been accomplished by granting proper selects to the developers and revoking execution of all stored procedures, since we have stored procedures which perform DML on tables and those stored procedures, by default, are created with "definer" rights rather than "invoker" rights.
The problem is that when the developers select from views which have stored procedure references in them (for retrieving names/descriptions of entities references in foreign key constraints, for look-up code descriptions, etc.), they receive the "ORA-01031: insufficient privileges" error because of the revoking of execute privileges on stored procedures to prevent developers from changing data.
Other than rewriting all of our stored procedures to separate out the "selection / look-up" code from the "DML-type" code, what options are there?
I've looked around online and have not been able to find something to address this -- probably because my search criteria just seemed to bring back too many results that were non-useful.
Shane.

I know you are looking for a quick easy to implement solution but my recommendation would be to fix the following:
ShaneB wrote:
The problem is that when the developers select from views which have stored procedure references in them (for retrieving names/descriptions of entities references in foreign key constraints, for look-up code descriptions, etc.),Why not retrieve the data using joins instead of calling stored functions? Writing code this weigh holds information from Oracle and the optimizer so it often has to use a less efficient access mechanism then it would if it were just performing straight SQL. The other benefit to fixing this is that it also fixes your permissions problem :)

Similar Messages

Development and product environment

Dear all,
I want to setup two databases in seperated server. One for development purpose and another for product environment.
Which good method/tool in oracle can transfer data (like pl/sql,tables,fields) from
development to product environment?
Thanks you

I would strongly suggest cloning the database from Development to Production, using RMAN. You get a proper copy that way - and it isn't hard to do. Howard Rogers has all the answers here: http://www.dizwell.com/prod/node/9

Use of Emigall for creation of masters in the production environment

Hi,
The EMIGALL objects are normally used for migrating legacy master data and/or cut-over data before production environment is up.
I am contemplating to use EMIGALL object for creation of contract account masters in production environment. One more option that I have is to use standard BAPI for creating contract account masters.
Can anyone tell me whether it is proper to use EMIGALL object for day to day creation of master day in production environment. Is there any disadvantage or risk involved in it.
Kindly reply soon.
Regards,
Ganesh

I've already used emigall multiple times to do delta migrations into an operational prod environment.
Purely looking at the functionalities, it should/would/must be possible to use emigall as a master data generator. I just think you need to look into the requirements:
who will use it? end-user/application manager/...
what's the amount of data to be loaded?
what's the time window of the load? Day/night
how is the data supplied?
As you know, emigall EATS system resources like mad, so using it during the day might not be preferable. emigall is also very picky about the file format, whereas in a custom report you can define the input structure yourself.
On the other hand, the error handling and follow-up of emigall is great...
Personally, I'd go for a custom report with a BAPI... It'll give you more flexibility than emigall.

You are not allowed to continue because your account does not have the proper privileges

I've been using PS since version 3. I currently run CS2 on Windows XP service pack 2. I've been using CS2 since it was first released. Now, all of a sudden, anytime I install or uninstall a program, whether it is related to Photoshop or not, when I start CS2 I get a window that says "You are not allowed to continue because your account does not have the proper privileges" and the program aborts. The first time this happened and after I had restarted CS2 for the 4th time it started normally. Since then it requires at least one restart (not reboot)after the error and then CS2 starts normally. Anyone have any idea of what is going on here? The first time it happened was right after I had installed a new HP AIO printer and I thought that may have had something to do with it. However, I have installed a couple of other programs and uninstalled another, none of them related in any way to CS2, and I get the error the next time I run CS2. I have found some posts about this but no answers, and most of the posts were related to Vista, not XP. I need help please.

there's a section in adobe.com (not adobeforums.com!) where after you log in (seperate log in from this site) you can go to "my account" and then "my registrations". you can manually add registrations there. that's how i've registered most of my adobe purchases.
ok. just ran through it:
go to http://www.adobe.com/ (make sure you have flash turned on)
click "Your Account" in the upper left corner.
log in with your adobe.com id, create one if you don't have one. this is SEPERATE from the id you log into this forum with!
click on "View Product Registrations"
click on "View Adobe branded products registrations"
if you have any registed packages, they'll be listed. at the bottom of the page click on the button that looks like this:

Consideration in a new Production Environment DB

Dear all,
DB : 10.2.0.4.0
Solaris 10
After installing Oracle DB in a production environment, is there any jobs to be scheduled for proper performance of the DB ?
What has to be considered in db health regard?.
Please guide ?
Kai

The most critical thing is to gather stats regularly
MOS Doc 377152.1 - Best Practices for automatic statistics collection on Oracle 10g
HTH
Srini

Use in production environment

Hello,
My company is extremely restrictive in terms of tools permitted for use in the production environment and have recently requested that support staff discontinue using SQL Developer.
Are there any recorded incidents of data loss, corruption or database performance and stability problems caused by SQL Developer?
Thanks,
Tony

No, but I suspect that won't convince anyone.
These things can rarely be argued on logical grounds, but what reasons have they given, or what criteria do they use to decide what is allowed?
Production environments should be protected using appropriate database privileges and resource management profiles.

What level of access a DBA should have on production Environment

We are in the process of auditing
I want to know what level of acccess a DBA has on a production server..How about the Backups ONLINE/EXport backup? Which account should be used for those purposes...
Can i DBA login as SYSTEM or SYS user? or he should have separate account to do all the activities..
I am more on protecting the data from unauthorized user..Any standards followed for that
Best Regards
Maran

Hi Maran,
What level of access a DBA should have on production Environment
root
However, there have been cases of dishonest DBA's and SA, manipulating data for profit and stealing data:
http://www.dba-oracle.com/art_lumigent_whitepaper.htm
Kevin Mitnick, the noted computer felon likes to show how security breeches are commonly the result of employee errors. In his book “The Art of Deception”, Mitnick talks about his techniques to get trusting employees to disclose confidential information and privileged passwords. In one case Mitnick was able to secure a privileged password using the name Lemonjello, and then bragged about the naïve employee who handed-over a system password to someone called “Lemon Jell-O”. In this case the IT staff was never able to ascertain the root cause of the breech because their mechanism for the dissemination and auditing of secure information was inadequate.
Today, there are ways to seregate the audit trails, giving the DBA what they need to do their job, while not giving them the keys to the kingdom.
Hope this helps . . .
Donald K. Burleson
Oracle Press author
Author of "Oracle Tuning: The Definitive Reference"
http://www.rampant-books.com/book_2005_1_awr_proactive_tuning.htm

Unable to import the Internet servivce into Production Environment

Hi,
We put the internet service and its HTML templates in a custom package for integrated ITSMobile. We got everything but the internet service ZXXX in the production. Has anyone come across this before? We were able to transport to the quality system. But it did not create the internet service in the production environment. Is it authorization issue? Your input will be highly appreciated.
Regards,
Subbu

Hi Subbu,
I suggest you to as your basis guys how are familiar with transports between systems. They will find out what the reason is. Without being able to look into transport protocols it is unlikeliy that someone here can advise you.
Regards,
Klaus

Issue in production environment

Hi,
We got an issue in the production environment on last Friday and yet not able to find out the root cause of the issue.
Environment
GUI : .Net
Server : Java
Application Server: Jboss
Database: Sqlserver
The Java application is deployed into Jboss application server which connects to SQL server as back end. GUI makes the web service call to server for data communication
Issue
Friday at 2 PM users reported the slowness of the application (Not getting the response from server in GUI), all the request from GUI were getting timed out.
Restart of Jboss didn't help
Restarted the Jboss and sqlserver for the second time and than the environment became stable
Analysis
1. From the thread dump of Jboss log we see that there are many threads waiting on a socket for database connection(according to database team all the connections are open and available at that particular time).
2. The size of transaction log is almost doubled during this period (when the issue was reported).
We couldn't find a reason why this issue is happened. Is it a database issue or something else? Please suggest...
Thanks,
Manoj

Hi Manoj,
According to your description, when running the web application, many threads are waiting for the socket from database which cause requests from front GUI time out. Right?
In this scenario, user can access the front GUI, which means the application server is working. Since the connections are all open at that particular time, it should not be issue on your JDBC. It seems to be a deadlock issue which cause other threads
waiting and hang. I recommend check and optimize your code. On database side, I suggest you open the SQL profiler, select DeadLock Graph, it will record when deadlock occurs. Please refer to links below:
Detecting and Ending Deadlocks
Analyze Deadlocks with SQL Server Profiler
If you have any question, please feel free to ask.
Simon Hou
TechNet Community Support

APO-DP - Change in Calculation Type of Key Figure in Production Environment

Hi Team,
I wish to know how to make a change in Calculation Type of Key Figure in Production Environment. I wish to change calculation type from "P" to "S" and also wish to enter Disaggregated Key Figure.
Regards,
Tarun Jha

HI,
The TR will not move the changes as you are expecting here.
Any changes to planning area, below 5.0 need to de-intialize the planning area.
just like
1. hold the latest back up
2. de-intialize planning area
3. make the required changes to planning area
4. initialize planning area and do conisistency checks
5. load back the data to planning area at all CVC level
all the steps need to perfom, in Dev and Quality and Production servers,
Plan the activity for a weekend so that users will not get disturb*
All the best
ARUN R Y

Security Issue httpOnlyCookies="true" is not working with production environment

Dear All,
I have tired to make set cookie value as httpOnly
The development environment is working fine and give me an output like that
Set-Cookie
WSS_KeepSessionAuthenticated={3644d93c-d1d3-46cd-845f-42c01640ab21};
path=/;
HttpOnly
But when implement the same changes in web.config production environment its not working
Set-Cookie NLSessionCdomainweb=a98q9jnsy0vXk5+RHeHnlKmM+HnneA9KmhIAR6g1bJiwTs8sD6d7dfV1gBffc8HiJXBowxdO8LhZAiIEKiFY6PzNWySyRs5rvgCfPu8XIFnqKcN4XQ4UL9PN3JI3f4E6;path=/;domain=.domain.com
I am using sharepoint 2010, under web.config i made the following changes
Add following tags under system.web
<httpRuntime maxRequestLength="2097151" enableVersionHeader="false"
/>
<httpCookies httpOnlyCookies="true"/>
Add following tags under <system.webServer>
  <httpProtocol>
      <customHeaders>
               <remove name="X-Powered-By" />
             <remove name="MicrosoftSharePointTeamServices" />
      </customHeaders>
    </httpProtocol>
Can any one tell me why it's happening i have checked all possible reasons from my side but no success
Regards
Rashid Bilgrami
RB

Hi,
From your description, I know you want to set cookie value as httpOnly but it is not work.
Please try to add codes below to your global.asax file:
<SCRIPT language="C#" runat="server">
protected void Session_Start(Object sender, EventArgs e)
try
if (Request.IsSecureConnection == true)
                Response.Cookies ["ASP.NET_SessionId"].Secure = true;
catch (Exception)
</SCRIPT>
Please refer to this article:
https://social.technet.microsoft.com/Forums/sharepoint/en-US/0fe55c13-3911-422e-af17-cb5c1ab2abd7/missing-secure-httponly-flags-on-sharepoint-2010-cookie?forum=sharepointadminprevious.
Best Regards
Vincent Han
TechNet Community Support

Problem on developing SSRS report in a production environment

Any problem could be caused if have to develop SSRS report in a production environment ?
If so, how it can be prevented?
Thanks!

Hi ,
As per my understanding, Normally our environment setup contains Development,testing,preproduction,production and its varies from company to company.
We develop SSRS report in development environment and after testing we deploy it to production report server.
Development environment use development database for creating report like your database IP and credential will use development environment
setup. and production environment use production database for creating report like your database IP and credential will use production environment setup.
Thanks
Neha Prajapati Please Mark This As Answer or vote for Helpful Post if this helps you to solve your question/problem.

How to port database changes from development to a production environment

How do I port database changes from the development to the production environment?
I am using v8 and have always had to redo everything using the schema manager all over in the production environment. Is there an easy way to generate a script, for example to dump the database changes on the development machine to be executed later on the production machine?

This should already be a clearly defined change control process. Once a procedure, function, package, trigger, or whatever completes the testing rounds, it should be promoted to production.
Forgive me if it seems I'm trivializing, but I don't see the problem, just copy the object(s) from your software library (or development) into production using whatever tool works best or has been chosen. If you are doing data copies then you have various options again including good old export/import.

In AE02, Asset numbers are missing in production environment.

Dear All,
Some asset numbers are missing in production environment. Yours suggestions are more helpful.
Regards,
Anishwa.

Hi,
created Asset number ranges-AS08

Create a new portlet in Deployed Portal in production environment

are there any ways to import or create a new portlet in Deployed Portal in production environment?
Edited by: user8322798 on May 1, 2011 7:26 AM

This can done via WSRP proxy portlets and streaming desktops. First, you'll need to have a WSRP producer setup somewhere. This could be another WLP webapp with portlets, or another server altogether. Or, you can use the JSR 286 WSRP import tool from within the Portal Administration Console (I think it's under Services | WSRP | Import Tool) -- this will allow you upload .war(s) of JSR 168 or 286 portlets, which will be turned into WSRP producer(s).
Then, you can use the Portal Administration Console to register a WSRP Producer, and then add portlets from the producer to your desktop (http://download.oracle.com/docs/cd/E15919_01/wlp.1032/e14235/chap_fed_books_pages.htm#FPGWP690). Additionally, once the producer has been registered in Portal Adminstration Console, an adminstrator user can use the Dynamic Visitor Tools from within the streaming desktop itself to add wsrp proxy portlets to the desktop (http://download.oracle.com/docs/cd/E15919_01/wlp.1032/e14243/dvt.htm#PDGWP691).
It is not possible to add new local .portlet files to a deployed application in production mode. This requires adding the file artifacts to the .ear/.war and redeploy the application.
Greg

Proper privileges in production environment

Similar Messages

Maybe you are looking for