Further Recommended Privilege and Role Permissions for Oracle Users

This section outlines the minimum permissions required to interact with Oracle when using MFDBFH. It covers how to create the necessary tables/procedures/types used by Enterprise Server. There are two recommended processes in which to grant the minimum required privileges to users that require MFDBFH to function with Oracle:

Method 1 creates three roles that cover the various uses of MFDBFH; assign users to one or more of these roles, as appropriate. Each role is configured to contain the permissions that MFDBFH will require. This method still requires the GRANT ANY privileges, which can be deemed as insecure.
Method 2 utilizes proxy users. This may result in additional database connections per process, and you cannot perform an upgrade of MFDBFH without manual intervention; however, this method does removes the requirement for GRANT ANY.

Note about setting MFDBFH_GRANT_USER_PERMISSIONS:

The environment variable MFDBFH_GRANT_USER_PERMISSIONS specifies which users/roles to grant execute privileges to for the various procedures/types created by MFDBFH. If you intend to start an enterprise server region under a different user to the one that will use these procedures/types, then you must also specify them with this variable.

Use a space-delimited string to specify the roles or users that require grant execute privileges. For example; if you have 2 roles, named role_dbfh_admin and role_dbfh_standard, which are used for running the region, and a 3rd role named role_dbfh_install used only for creating the datastores and region/cross-region databases, you would set the following:

MFDBFH_GRANT_USER_PERMISSIONS=role_dbfh_admin role_dbfh_standard

The roles of any other users that may start the region would also need to be specified within the variable. This variable also needs to be set in the region itself if you intend to run the region with multiple different users, because Enterprise Server will also create tables/procedures on-the-fly as new data files are created.

After the variable is set, you can use the dbfhadmin commands to create your datastores.