Script for Users, Roles,Grant,Tablespace

Hi,
Please guide me on the following .
I am moving database to new Unix server .
so can I create the script which will check the existing Users, Roles, Grants, Tablespaces from current database and store that data.
And using same soared data I want to create the same " Users, Roles, Grants, Tablespaces" using the script.
Can i do this. Please guide me how to do this so I will help me to move database
Thanks,
Amol

You should run ?\rdbms\admin\utlrp (note the ?, which is shorthand for ORACLE_HOME) from the database server. to make sure you have the correct script. You can call sqlplus from Toad easily.
The script affects PL/SQL only. PL/SQL resides in the SYSTEM tablespace in the SYS schema. You don't have 400G of PL/SQL. It should take a few minutes only.
The SYSTEM schema WILL be imported. SYS will not be imported, but automagically recreated. The only thing you will miss is Grants which have been made by SYS directly to end-users or roles, outside those defined in catalog.sql
Sybrand Bakker
Senior Oracle DBA

Similar Messages

Ran CATT Script for the role assignment to users

Hi All,
I have ran ECATT script for doing role assignment in QAS and completed successfully. I did this through CUA. What is the next step after running catt script? Do I need to doing anything with PFUD in each child system? Because I checked in the child systems many derived single roles are not generated in QAS.(RED). Is it because of running catt script or it might have came like that only from development? Please advise..
Regards,
Masood

>
Salman123 wrote:
> Please let me know how should I proceed from here
Hi,
I have told you why the error message is there. What do you not understand about the resolution? Your parent roles are out of sync with the child roles so you need to re-sync them. An example of how do do this is to "adjust derived" from the master role. Only when you have done this will your roles be in sync again.

TIPS(42) : SCRIPT FOR CREATING ROLES

제품 : SQL*PLUS
작성날짜 : 1997-02-10
TIPS(42) : SCRIPT FOR CREATING ROLES
====================================
REM
REM SCRIPT FOR CREATING ROLES
REM
REM This script must be run by a user with the DBA role.
REM
REM This script is intended to run with Oracle7.
REM
REM Running this script will in turn create a script to build all the roles
REM in the database. This created file, create_roles.sql, can be run
REM by any user with the DBA role or with the 'CREATE ROLE' system privilege.
REM
REM Since it is not possible to create a role under a specific schema, it is
REM essential that the original creator be granted 'ADMIN' option to the role.
REM Therefore, such grants will be made at the end of the create_roles.sql
REM script. Since it is not possible to distinguish the creator from someone
REM who was simply granted 'WITH ADMIN OPTION', all grants will be spooled.
REM In addition, the user who creates the role is automatically granted
REM 'ADMIN' option on the role, therefore, if this script is run a second
REM time, this user will also be granted 'ADMIN' on all the roles. You must
REM explicitly revoke 'ADMIN OPTION' from this user to prevent this from
REM happening.
REM
REM NOTE: This script will not capture the create or grant on the Oracle
REM predefined roles, CONNECT, RESOURCE, DBA, EXP_FULL_DATABASE, or
REM IMP_FULL_DATABASE.
REM
REM Only preliminary testing of this script was performed. Be sure to test
REM it completely before relying on it.
REM
set verify off
set feedback off
set termout off
set echo off
set pagesize 0
set termout on
select 'Creating role build script...' from dual;
set termout off
spool create_roles.sql
select 'CREATE ROLE ' || lower(role) || ' NOT IDENTIFIED;'
from sys.dba_roles
where role not in ('CONNECT','RESOURCE','DBA', 'EXP_FULL_DATABASE',
'IMP_FULL_DATABASE')
and password_required='NO'
select 'CREATE ROLE ' || lower(role) || ' IDENTIFIED BY VALUES ' ||
'''' || password || '''' || ';'
from sys.dba_roles, sys.user$
where role not in ('CONNECT','RESOURCE','DBA', 'EXP_FULL_DATABASE',
'IMP_FULL_DATABASE')
and password_required='YES' and
dba_roles.role=user$.name
and user$.type=0
select 'GRANT ' || lower(granted_role) || ' TO ' || lower(grantee) ||
' WITH ADMIN OPTION;'
from sys.dba_role_privs
where admin_option='YES'
and granted_role not in ('CONNECT','RESOURCE','DBA', 'EXP_FULL_DATABASE',
'IMP_FULL_DATABASE')
order by grantee
spool off
exit
REM ---------------------------------------------------------------------------

One thing that stands out as being undesirable as far as best practices go is that you are placing code on objects (using the on() approach). The proper approach is to assign instance names to your interactive objects and use them to place all of your code on the timeline where it is readily visible. In doing so you may just find that alot of the code you show can be modularized into functions that can be shared by different objects rather than having each one carrying a full load on its back. You may find you can pass arguments to shared functions that make the same functions capable of supporting interactions with different objects
Your on(press) call performs an unnecessary conditional test. If you change the condition to be if (project._currentframe != 25) you can avoid this.
In your on(rollOver) call's set of conditionals, you have some lines that repeat in each condition, so they can be moved to the end outside the conditionals.
Your on(release) call has the same issue as your on(press) call. Also the overrun use of the _parent target is an indication that most of the code in this call would likely serve you better sitting in the _parent timeline, and your button could just call that function

Expdp users, roles, grants (privs)

(sorry for the cross-posting - I'm not sure how to delete or move threads and I posted this in the general questions forum thinking I was in this forum)
So, I think this works - still in the process of testing - but what I want to do is the following:
1) Export ONLY users, passwords, and privs from TEST
2) Clone PROD --> TEST
3) Drop all users in TEST excluding system users.
4) Import original users file from Step 1.
I think I've got it with the following. Am I missing anything? I'm testing, but if someone else has done this, I would be happy to hear from something I may be missing.
JOB_NAME=EXPDP_USERS
DIRECTORY=DTPUMP
REUSE_DUMPFILES=Y
FULL=Y
DUMPFILE=users_test.dmp
LOGFILE=users_test_expdp.log
INCLUDE=SCHEMA:"IN (SELECT USERNAME FROM dba_users where default_tablespace NOT in('SYSAUX','SYSTEM'))",ROLE,USER,SYSTEM_GRANT,ROLE_GRANT,DEFAULT_ROLE,TABLESPACE_QUOTA

Pl do not post duplicates - expdp users, roles, grants (privs)

Want to take "CREATE script" for all roles existing in DB.

Hi All,
I want to take "CREATE script" for all roles existing in DB.
Please provide me script to generate if you have or suggest any link or doc.
Oracle 10G

Use this-
select 'select dbms_metadata.get_ddl(''ROLE'','''||ROLE||''')||chr(10)||''/'' from dual;'
from dba_roles
Please be aware grants will not come in the definition
If you like the answer then don't forget to give points

Search for user role but help poppup display

Anyone ever trying to search for user role from search action bar or user admin page?
Whenever select role and clicked on the magnifying glass icon, help content displays instead of role selection.
At first I think this is a bug. But when I asked Customer Care they said its an expected behaviour which means that this is how the engineers designed it.
Dont you feel weird? because other field like status, correctly displays status info after clicking the icon.
Hope u can try it this out and give your opinion here.

Can you provide a little more detail on what you were trying to do.

RAR: Best strategy for users/roles/profiles synchronization

Hi all,
Assuming that:
1) we will be never interested about profiles risk analysis (just users and roles)
2) roles risk analysis will be run first and after sometime (threee weeks) we will run it for users.
and we will run batch risks analysis:
Question 1) Is it possible to synchronize just roles and do it for users just when we want to execute risk analysis for them? Or is a best practice to synchronize always for users/roles and profiles eventhough risk analysis will not be done for all three?
Question 2) If we execute just full sync and full risk analysis, users/roles or profiles deleted in backend between executions are also deleted from DB? or removal takes place only when executing incremental sync?
Many thanks in advance. Best regards,
Imanol

Hi Imanol,
Answer Q1: Yes, you can just select user and roles for the snych and risk analysis. Go to configuration-background jobs - shedule job. If you don't run risk analysis for profiles, you shouldn't sync and select them.
Answer Q2: Both, the Full risk analysis will alwaly update your DB. I will recommend you, to do this job in some periodic times. The incremental sync job will as well update your DB, if anything changed in the backend system. Normally your are going to run your daily or weekly jobs with this selection.
Thanks,
Martin

VIRSA tables for users, roles and profiles sync?

Hello,
I am in a customer, implementing CC 5.2. At the first time, we tried CC 5.2 in DEV environment, and when everything was OK, we redirect RFC connectors to QA environment.
After doing user, roles and profiles sync in DEV and in QA environment too, I have 4.500 user (1.100 from DEV + 3.400 from QA) when I recover all users "*" with "user level - risk analysis" from the "Informer" tab.
It seems that "users, roles, profiles, sync" works like and "APPEND", but I did a COMPLETE syncronization not an INCREMENTAL.
If I start an analysis for QA environment, CC works properly and only analyse QA users (3.400). But I would like to clean CC tables (users, roles and profiles) in order to have a clean copy of QA in CC.
Which VIRSA tables (users, roles and profiles) I need to clean?
It is necessary to do the same with authorization and text objects? Which would be these tables?
Thanks in advance,
Victor

Hi all,
SAP GRC Support provides a script which allows you to remove a connector since it does delete all data link to it. Anyway, I would recommend a deep analysis of it and find out if it does what you really want to do.
Víctor, if what you want to do it is just to remove all user, role and profile master data (stored in tables VIRSA_CC_SYSUSR and VIRSA_CC_GENOBJ) you could upload a text file using data extractor functionality with the delete field set to X. Doing so user, role and profile master data will be removed from CC database.
In order to use data extraction functionlaity you connector must be of type "File Local".
Be careful about removing data directly from DB since, as Prem states, you might loose the DB consistency.
Hope it helps. Best regards,
Imanol

Error while scheduling Background Job for User/Role Full Synchronization

Hi all,
We have installed RAR 5.3 Component and uploaded the authorization data & established the connectors to the backend system.
We have performed all the post installation activities and everything is complete.
When we have scheduled User -Full Synchronization with the Back End system as a part of Post Installation Activity we are receiving the below error message
"Error while executing the Job:Cannot assign an empty string to host variable 2."
Also the VIEW LOG/ Terminate Job buttons are disabled in this screen.
Can somebody please help us in resolving the above issue
Thanks and Best Regards,
Srihari.K

Hi,
We are copy pasting the error log (Part as it is huge) below here. We could able to do Full Synch for Roles and also for Profiles. Only for User Synch we are getting this error and none of the users are sychronized to RAR
Jan 13, 2009 12:34:27 AM com.virsa.cscext.dao.CSCDAO populateGenObjUser
INFO: Update user WILSONA of HL2-QAHR
Jan 13, 2009 12:34:27 AM com.virsa.cscext.dao.CSCDAO populateGenObjUser
INFO: Update user WINDC of HL2-QAHR
Jan 13, 2009 12:34:27 AM com.virsa.cscext.dao.CSCDAO populateGenObjUser
INFO: Update user WLADICHJ of HL2-QAHR
Jan 13, 2009 12:34:27 AM com.virsa.cscext.dao.CSCDAO populateGenObjUser
INFO: Update user WUK of HL2-QAHR
Jan 13, 2009 12:34:27 AM com.virsa.cscext.dao.CSCDAO populateGenObjUser
INFO: Update user ZENGS of HL2-QAHR
Jan 13, 2009 12:34:27 AM com.virsa.cscext.dao.CSCDAO populateGenObjUser
INFO: Update user ZHENGL of HL2-QAHR
Jan 13, 2009 12:34:27 AM com.virsa.cscext.dao.CSCDAO populateGenObjUser
INFO: All System Flag:false=====Last Batch Flag:true
Jan 13, 2009 12:34:27 AM com.virsa.cc.xsys.bg.BatchRiskAnalysis loadUserData
INFO: @@@ User sync completed for params true: Syskey List is [HL2-QAHR]
Jan 13, 2009 12:34:27 AM com.virsa.cc.xsys.bg.BgJob run
WARNING: *** Job Exception: Cannot assign an empty string to host variable 2.
com.sap.sql.log.OpenSQLException: Cannot assign an empty string to host variable 2.
     at com.sap.sql.log.Syslog.createAndLogOpenSQLException(Syslog.java:85)
     at com.sap.sql.log.Syslog.createAndLogOpenSQLException(Syslog.java:124)
     at com.sap.sql.types.VarcharResultColumn.setString(VarcharResultColumn.java:57)
     at com.sap.sql.jdbc.common.CommonPreparedStatement.setString(CommonPreparedStatement.java:511)
     at com.sap.engine.services.dbpool.wrappers.PreparedStatementWrapper.setString(PreparedStatementWrapper.java:355)
     at com.virsa.cscext.dao.CSCDAO.updateIgnoredUserData(CSCDAO.java:1388)
     at com.virsa.cscext.dao.CSCDAO.populateGenObjUser(CSCDAO.java:1169)
     at com.virsa.cc.xsys.bg.BatchRiskAnalysis.populateGenObj(BatchRiskAnalysis.java:868)
     at com.virsa.cc.xsys.bg.BatchRiskAnalysis.insertBAPIUserData(BatchRiskAnalysis.java:142)
     at com.virsa.cc.xsys.bg.BatchRiskAnalysis.loadUserData(BatchRiskAnalysis.java:390)
     at com.virsa.cc.xsys.bg.BatchRiskAnalysis.performBatchSyncAndAnalysis(BatchRiskAnalysis.java:1275)
     at com.virsa.cc.xsys.bg.BgJob.runJob(BgJob.java:402)
     at com.virsa.cc.xsys.bg.BgJob.run(BgJob.java:264)
     at com.virsa.cc.xsys.riskanalysis.AnalysisDaemonBgJob.scheduleJob(AnalysisDaemonBgJob.java:240)
     at com.virsa.cc.xsys.riskanalysis.AnalysisDaemonBgJob.start(AnalysisDaemonBgJob.java:80)
     at com.virsa.cc.comp.BgJobInvokerView.wdDoModifyView(BgJobInvokerView.java:436)
     at com.virsa.cc.comp.wdp.InternalBgJobInvokerView.wdDoModifyView(InternalBgJobInvokerView.java:1225)
     at com.sap.tc.webdynpro.progmodel.generation.DelegatingView.doModifyView(DelegatingView.java:78)
     at com.sap.tc.webdynpro.progmodel.view.View.modifyView(View.java:337)
     at com.sap.tc.webdynpro.clientserver.cal.ClientComponent.doModifyView(ClientComponent.java:481)
     at com.sap.tc.webdynpro.clientserver.window.WindowPhaseModel.doModifyView(WindowPhaseModel.java:551)
     at com.sap.tc.webdynpro.clientserver.window.WindowPhaseModel.processRequest(WindowPhaseModel.java:148)
     at com.sap.tc.webdynpro.clientserver.window.WebDynproWindow.processRequest(WebDynproWindow.java:335)
     at com.sap.tc.webdynpro.clientserver.cal.AbstractClient.executeTasks(AbstractClient.java:143)
     at com.sap.tc.webdynpro.clientserver.session.ApplicationSession.doProcessing(ApplicationSession.java:319)
     at com.sap.tc.webdynpro.clientserver.session.ClientSession.doApplicationProcessingStandalone(ClientSession.java:713)
     at com.sap.tc.webdynpro.clientserver.session.ClientSession.doApplicationProcessing(ClientSession.java:666)
     at com.sap.tc.webdynpro.clientserver.session.ClientSession.doProcessing(ClientSession.java:250)
     at com.sap.tc.webdynpro.clientserver.session.RequestManager.doProcessing(RequestManager.java:149)
     at com.sap.tc.webdynpro.serverimpl.defaultimpl.DispatcherServlet.doContent(DispatcherServlet.java:62)
     at com.sap.tc.webdynpro.serverimpl.defaultimpl.DispatcherServlet.doGet(DispatcherServlet.java:46)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:740)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
     at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
     at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
     at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
     at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
     at java.security.AccessController.doPrivileged(Native Method)
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:102)
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:172)
Jan 13, 2009 12:34:27 AM com.virsa.cc.xsys.bg.BgJob setStatus
INFO: Job ID: 13 Status: Error
Jan 13, 2009 12:34:27 AM com.virsa.cc.xsys.bg.BgJob updateJobHistory
FINEST: --- @@@@@@@@@@@ Updating the Job History -
2@@Msg is Error while executing the Job:Cannot assign an empty string to host variable 2.
Jan 13, 2009 12:34:27 AM com.virsa.cc.xsys.bg.dao.BgJobHistoryDAO insert
INFO: -
Background Job History: job id=13, status=2, message=Error while executing the Job:Cannot assign an empty string to host variable 2.
Jan 13, 2009 12:34:27 AM com.virsa.cc.xsys.riskanalysis.AnalysisDaemonBgJob scheduleJob
INFO: -
Complted Job =>13----
Please let us know how to resolve this error
Thanks and Best Regards,
Srihari.K

Error while running Background Sync for User, Roles

Hi All,
I get the below errors when i am scheduling background jobs for User and Role Sync
We have connected another system APO to GRC, we already have ECC running
for the APO system we used the connectors VirsaXSR3_01 (Metadata, model) for this
Any ideas why they are failing
Error while executing the Job:Interface Controller does not exist for Component Instance VirsaXSR3_01 in Component Usage VirsaXSR3_01
Error while executing the Job:type com.virsa.cc.modelvirsaxsr3_01.types.So_Text001 could not be loaded: com.sap.dictionary.runtime.DdException: TypeBroker failed to access SL
Thanks

Hi All,
Thank you for your inputs, but i figured out the issue with the error,
Our basis folks actually made the mistake creating JCO's
They created VIRSAXSR3_02_METADATA & VIRSAXSR3_01_MODEL instead of VIRSAXSR3_01_METADATA & VIRSAXSR3_01_MODEL
this has been rectified and my background jobs run fine now.
Thanks

Which objects to add for user role

Hello guys.
Have SCOM 2012 R2
Need to create user role for CRM admins, so they can view and edit alerts for their servers.
I choose Advanced Operators, but i'm stucked at creating group scope.
Let's say i want this user role to create rules\override for all objects, which contains in my CRM server. What object type will i choose? Windows Computer? Or i need to add specifically all objects, connected to this server (but they are hundreds).

This is where you would want to use a group. Create a group called CRM Servers. Add the servers to this group using the computer object. Then you would scope to that Group, so they could only see those servers that are in that group. Because you selected
the Computer Object, you will see all classes that fall under the computer object that are associated with those servers.
See the best paper ever on this topic (written by Cameron Fuller MVP) at veeams web site. http://www.veeam.com/wp-manage-scom-using-groups.html
Consider learning how to create a dynamic populated group so you will not have to be constantly change group membership by hand.
hope this helps!
Scott Moss
Scott Moss MVP (Operations Manager) President - System Center Virtual Users Group |Vice President - Atlanta Southeast Management Users Group (ATL SMUG)
Please remember to click “Mark as Answer” on the post that helps you!
my new blog om2012.wordpress.com

FM for User roles

Hi friends,
Is there any function module to read the user roles against an user. I know the table as AGR_USERS. But i want a funtion module to fetch the data.
Thanks in advance
Regards
Srikanth.S

Hi skk ,
Thanks for your answer. I got the whole user roles attached with a perticular user with the Fm BAPI_USER_GET_DETAIL which you have suggested. Thank you very much.
and i should thank Mr. Chandrasekhar J. B'cause he suggested a FM RSRA_USERS_OF_AGR_GET. But this is for other side. That is, once we know the role we can find who are all users having this role attached. That may be helpfull for others. But my problem is i know the user name i want user roles for the perticular user. i Got the solution from Mr.Skk.
and thanks to Mr. Abhijit V Patil. He gave a very valuable program 'IAM_API_TESTFRAME'. this will help full for others.
Thank you very much those who are reply my query.

Restrict GL / Cost Centre combinations for users/roles?

Hi,
Please could someone advise if it is possible to restrict Cost Centre and GL Account combinations during PO creation for specific users/roles?
For example:
Valid Combinations:
CC A1 GL 99
CC B2 GL 88
Scenarios:
Create PO with A1, 99 -> Allowed
Create PO with B2, 77 -> Not Allowed
I've found a related post, but not exactly my requirement - any other thoughts? Or has anyone done this themselves?
Authorisations - User Profile for purchasing - restrict by cost centre

Use the user exit MM06E005 to control the CC and G/L for user dependent.
to do that - ask ABAPer to create the custom table for user, CC and GL combination and let teh user exit read the combination from the table and give a error or warning based on your requirements.

T codes for user roles

hi
can any body help with T code to create user roles in solution Manager and IMP T codes relating to this
thanks
padma

Tcodes to create Roles in SAP is PFCG ...
it shd be the same in SOLMAN...
Sri

Export users , roles and tablespace definotion

Hello,
I would like to export (and after then import to another DB) users and roles from DB. How can I simply do this?
And second question: how can I export tablespace definitions?
Thanks
SASA

$ exp help=y
Export: Release 8.1.7.4.0 - Production on Fri Oct 31 14:01:52 2003
(c) Copyright 2000 Oracle Corporation. All rights reserved.
You can let Export prompt you for parameters by entering the EXP
command followed by your username/password:
Example: EXP SCOTT/TIGER
Or, you can control how Export runs by entering the EXP command followed
by various arguments. To specify parameters, you use keywords:
Format: EXP KEYWORD=value or KEYWORD=(value1,value2,...,valueN)
Example: EXP SCOTT/TIGER GRANTS=Y TABLES=(EMP,DEPT,MGR)
or TABLES=(T1:P1,T1:P2), if T1 is partitioned table
USERID must be the first parameter on the command line.
Keyword Description (Default) Keyword Description (Default)
USERID username/password FULL export entire file (N)
BUFFER size of data buffer OWNER list of owner usernames
FILE output files (EXPDAT.DMP) TABLES list of table names
COMPRESS import into one extent (Y) RECORDLENGTH length of IO record
GRANTS export grants (Y) INCTYPE incremental export type
INDEXES export indexes (Y) RECORD track incr. export (Y)
ROWS export data rows (Y) PARFILE parameter filename
CONSTRAINTS export constraints (Y) CONSISTENT cross-table consistency
LOG log file of screen output STATISTICS analyze objects (ESTIMATE)
DIRECT direct path (N) TRIGGERS export triggers (Y)
FEEDBACK display progress every x rows (0)
FILESIZE maximum size of each dump file
QUERY select clause used to export a subset of a table
VOLSIZE number of bytes to write to each tape volume
The following keywords only apply to transportable tablespaces
TRANSPORT_TABLESPACE export transportable tablespace metadata (N)
TABLESPACES list of tablespaces to transport
Export terminated successfully without warnings.

Script for Users, Roles,Grant,Tablespace

Similar Messages

Maybe you are looking for