In a multitenant environment, you register Oracle Database Vault with common users who will use the Database Vault-enforced roles in the CDB root.

1. In a multitenant environment, log into the root of the database instance as a user who has privileges to create users and grant the CREATE SESSION and SET CONTAINER privileges.

   For example:

   sqlplus c##dba_debra
   Enter password: password
   

2. Select user accounts (or create new users) that will be used for the Database Vault Owner (DV_OWNER role) and Database Vault Account Manager (DV_ACCTMGR role) accounts.

   Oracle strongly recommends that you maintain two accounts for each role. One account, the primary named user account, will be used on a day-to-day basis and the other account will be used as a backup account in case the password of the primary account is lost and must be reset.

   Prepend the names of these accounts with c## or C##. For example:

   GRANT CREATE SESSION, SET CONTAINER TO c##sec_admin_owen IDENTIFIED BY password CONTAINER = ALL;
   GRANT CREATE SESSION, SET CONTAINER TO c##dbv_owner_root_backup IDENTIFIED BY password CONTAINER = ALL;
   GRANT CREATE SESSION, SET CONTAINER TO c##accts_admin_ace IDENTIFIED BY password CONTAINER = ALL;
   GRANT CREATE SESSION, SET CONTAINER TO c##dbv_acctmgr_root_backup IDENTIFIED BY password CONTAINER = ALL;
   

   In this specification:

   • Create the primary accounts (c##sec_admin_owen and c##accts_admin_ace) if these do not already exist for the new roles, DV_ADMIN and DV_ACCTMGR.
   • Replace password with a password that is secure.
3. Connect to the root as user SYS with the SYSDBA administrative privilege

   CONNECT SYS AS SYSDBA
   Enter password: password
   

4. Configure the two backup Database Vault user accounts.
   For example:

   BEGIN
    CONFIGURE_DV (
      dvowner_uname         => 'c##dbv_owner_root_backup',
      dvacctmgr_uname       => 'c##dbv_acctmgr_root_backup',
      force_local_dvowner   => FALSE);
    END;
   /
   

   In this example, setting force_local_dvowner to FALSE enables the common users to have DV_OWNER privileges for the PDBs that are associated with this CDB root. Setting it to TRUE restricts the common DV_OWNER user to have the DV_OWNER role privileges for the CDB root only. If you grant DV_OWNER locally to the CDB root common user, then that user cannot grant the DV_OWNER role commonly to any other user.
5. Run the utlrp.sql script to recompile invalidated objects in the root.

   @?/rdbms/admin/utlrp.sql
   

   If the script provides instructions, follow them, and then run the script again. If the script terminates abnormally without giving any instructions, then run it again.

6. Connect to the root as the primary Database Vault Owner user that you just configured.

   For example:

   CONNECT c##dbv_owner_root_backup
   Enter password: password
   

7. Enable Oracle Database Vault using one of the following commands:

   • To enable Oracle Database Vault to use regular mode:

     EXEC DBMS_MACADM.ENABLE_DV;

   • If every associated PDB will need to have Database Vault enabled in this database, then use the following command. (You will need to enable each of these PDBs after you complete this procedure.) PDBs that do not have Database Vault enabled will be in restricted mode after the database is restarted and until Database Vault is enabled in the PDB:

     EXEC DBMS_MACADM.ENABLE_DV (strict_mode => 'y');

8. Connect with the SYSDBA administrative privilege.

   CONNECT / AS SYSDBA
   

9. Restart the database.

   SHUTDOWN IMMEDIATE
   STARTUP
   

10. Verify that Oracle Database Vault and Oracle Label Security are installed and enabled.

    SELECT * FROM DBA_DV_STATUS;
    SELECT * FROM DBA_OLS_STATUS;
    SELECT * FROM CDB_DV_STATUS;
    SELECT * FROM CDB_OLS_STATUS;

11. Connect as the backup DV_OWNER user and then grant the DV_OWNER role to the primary DV_OWNER user that you created earlier.

    For example:

    CONNECT c##dbv_owner_root_backup
    Enter password: password
    
    GRANT DV_OWNER TO c##sec_admin_owen WITH ADMIN OPTION;
    

12. Connect as the backup DV_ACCTMGR user and then grant the DV_ACCTMGR role to the backup DV_ACCTMGR user.

    For example:

    CONNECT c##dbv_acctmgr_root_backup
    Enter password: password
    
    GRANT DV_ACCTMGR TO c##accts_admin_ace WITH ADMIN OPTION;

13. Store the two backup account passwords in a safe location such as a privileged account management (PAM) system in case they are needed in the future.

In a multitenant environment, you must register Oracle Database Vault in the root first, then in the PDBs afterward.

1. If you have not already done so, then identify or create named common user accounts to be used as the Database Vault accounts along with associated backup accounts.
2. Ensure that you have registered Oracle Database Vault in the CDB root and that the DV_OWNER role was granted commonly to the common user.
3. Connect to the PDB as an administrator who is local to the PDB.
   For example:

   CONNECT dba_debra@pdb_name
   Enter password: password
   

   To find the available PDBs, query the DBA_PDBS data dictionary view. To check the current PDB, run the show con_name command.

4. Grant the CREATE SESSION and SET CONTAINER privileges to the users for this PDB.
   For example:

   GRANT CREATE SESSION, SET CONTAINER TO c##sec_admin_owen CONTAINER = CURRENT;
   GRANT CREATE SESSION, SET CONTAINER TO c##accts_admin_ace CONTAINER = CURRENT;
   

5. Connect as user SYS with the SYSDBA administrative privilege

   CONNECT SYS@pdb_name AS SYSDBA
   Enter password: password
   

6. While still in the PDB, configure the two backup Database Vault user accounts.

   BEGIN
    CONFIGURE_DV (
      dvowner_uname         => 'c##dbv_owner_root_backup',
      dvacctmgr_uname       => 'c##dbv_acctmgr_root_backup');
    END;
   /
   

   In this example, the force_local_dvowner parameter is omitted because it is unnecessary. All common users who are configured within a PDB are restricted to the scope of the PDB.

7. Run the utlrp.sql script to recompile invalidated objects in this PDB.

   @?/rdbms/admin/utlrp.sql
   

   If the script provides instructions, follow them, and then run the script again. If the script terminates abnormally without giving any instructions, then run it again.

8. Connect to the PDB as the backup Database Vault Owner user that you just configured.
   For example:

   CONNECT c##dbv_owner_root_backup@pdb_name
   Enter password: password
   

9. Enable Oracle Database Vault in this PDB.

   EXEC DBMS_MACADM.ENABLE_DV;
   

10. Connect to the CDB with the SYSDBA administrative privilege.

    CONNECT / AS SYSDBA
    

11. Close and reopen the PDB.
    For example:

    ALTER PLUGGABLE DATABASE pdb_name CLOSE IMMEDIATE;
    
    ALTER PLUGGABLE DATABASE pdb_name OPEN;
    

12. Verify that the PDB is configured and enabled for Database Vault.

    CONNECT SYS@pdb_name AS SYSDBA
    Enter password: password
    
    SELECT * FROM DBA_DV_STATUS;

13. Connect as the backup DV_OWNER user and then grant the DV_OWNER role to the primary DV_OWNER user that you created earlier.

    For example:

    CONNECT c##dbv_owner_root_backup
    Enter password: password
    
    GRANT DV_OWNER TO c##sec_admin_owen WITH ADMIN OPTION;
    

14. Connect as the backup DV_ACCTMGR user and then grant the DV_ACCTMGR role to the primary DV_ACCTMGR user.

    For example:

    CONNECT c##dbv_acctmgr_root_backup
    Enter password: password
    
    GRANT DV_ACCTMGR TO c##accts_admin_ace WITH ADMIN OPTION;

15. Store the two backup account passwords in a safe location such as a privileged account management (PAM) system in case they are needed in the future.

In this tutorial, you create a realm around for the HR sample database schema by using the Oracle Database Vault PL/SQL packages.

In the HR schema, the EMPLOYEES table has information such as salaries that should be hidden from most employees in the company, including those with administrative access. To accomplish this, you add the HR schema to the secured objects of the protection zone, which in Oracle Database Vault is called a realm, inside the database. Then you grant limited authorizations to this realm. Afterward, you test the realm to make sure it has been properly secured. And finally, to see how Oracle Database Vault provides an audit trail on suspicious activities like the one you will try when you test the realm, you will run a report.

You must enable the HR schema for this tutorial.

1. Log into the database instance as a user who has been granted the DBA role, and then access the HR schema.

   For example:

   sqlplus system
   Enter password: password
   

2. In a multitenant environment, connect to the appropriate PDB.

   For example:

   CONNECT SYSTEM@my_pdb
   Enter password: password
   

   To find the available PDBs, run the show pdbs command. To check the current PDB, run the show con_name command.

3. Query the HR.EMPLOYEES table as follows.

   SELECT FIRST_NAME, LAST_NAME, SALARY FROM HR.EMPLOYEES WHERE ROWNUM < 10;
   

   Output similar to the following appears:

   FIRST_NAME           LAST_NAME                     SALARY
   -------------------- ------------------------- ----------
   Steven               King                           24000
   Neena                Kochhar                        17000
   Lex                  De Haan                        17000
   Alexander            Hunold                          9000
   Bruce                Ernst                           6000
   David                Austin                          4800
   Valli                Pataballa                       4800
   Diana                Lorentz                         4200
   Nancy                Greenberg                      12008
   
   9 rows selected.
   

4. If the HR schema is locked and expired, log into the database instance as the DV_ACCTMGR user and unlock and unexpire the account. For example:

   sqlplus bea_dvacctmgr -- For a multitenant environment, sqlplus bea_dvacctmgr@hrpdb
   Enter password: password
   
   ALTER USER HR ACCOUNT UNLOCK IDENTIFIED BY password
   

   Follow the guidelines in Oracle Database Security Guide to replace password with a password that is secure.

   As you can see, SYSTEM has access to the salary information in the EMPLOYEES table of the HR schema. This is because SYSTEM is automatically granted the DBA role, which includes the SELECT ANY TABLE system privilege.

5. Do not exit SQL*Plus.

Realms can protect one or more schemas, individual schema objects, and database roles.

1. Log in to Oracle Database Vault Administrator from Cloud Control as a user who has been granted the DV_OWNER or DV_ADMIN role and the SELECT ANY DICTIONARY privilege. Logging in to Oracle Database Vault from Oracle Enterprise Cloud Control explains how to log in.
2. In the Administration page, under Database Vault Components, click Realms.
3. In the Realms page of Oracle Database Vault Administrator, click Create.
4. In the Create Realm page, under General, enter HR Apps after Name.
5. In the Description field, enter Realm to protect the HR schema.
6. Leave the Mandatory Realm check box unchecked.
7. After Status, ensure that Enabled is selected so that the realm can be used.
8. Under Audit Options, ensure that Audit On Failure is selected so that you can create an audit trial later on.
9. Click Next to display the Realm secured objects page.
10. Click the Add button and in the Add Secured Object dialog box, enter the following information:

    • Owner: Enter HR to select the HR schema.

    • Object Type: Enter TABLE.

    • Object Name: Enter EMPLOYEES.

11. Click OK.

    The HR.EMPLOYEES table is added to the Create Realm : Realm Secured Objects page.

12. Click Done, and then click Finish.

At this stage, there are no database accounts or roles authorized to access or otherwise manipulate the database objects the realm will protect.

1. In SQL*Plus, connect as the Database Vault Account Manager, who has the DV_ACCTMGR role, and create the local user SEBASTIAN.

   For example:

   CONNECT bea_dvacctmgr -- Or, CONNECT bea_dvacctmgr@hrpdb
   Enter password: password
   
   GRANT CREATE SESSION TO SEBASTIAN IDENTIFIED BY password;
   

   Replace password with a password that is secure. See Oracle Database Security Guide for the minimum requirements for creating passwords.

2. Connect as SYS with the SYSDBA privilege, and then grant SEBASTIAN the following additional privilege.

   CONNECT SYS AS SYSDBA -- Or, CONNECT SYS@hrpdb AS SYSDBA
   Enter password: password
   
   GRANT READ ANY TABLE TO SEBASTIAN;
   

Next, user SEBASTIAN must be granted authorization to the HR Apps realm, so that he can access the HR.EMPLOYEES table.

1. In the Realms page of Database Vault Administrator, select the HR Apps in the list of realms, and then click Edit.
2. Click the Next button until you reach the Realm authorizations page.
3. Click Add and then enter the following information in the Add Authorizations dialog box:

   • Realm Authorization Grantee: Enter SEBASTIAN.

   • Realm Authorization Type: Select Participant from the list.

   • Realm Authorization Ruleset: Leave this field blank.

4. Click OK.

   The Participant authorization allows the user SEBASTIAN in the HR Apps realm to manage access, manipulate, and create objects protected by the HR Apps realm. In this case, the HR user and SEBASTIAN are the only users allowed to view the EMPLOYEES table.

5. Click Done, and then Finish.

To test the realm, you must try to access the EMPLOYEES table as a user other than HR.

Because you enabled auditing on failure for the HR Apps realm, you can generate a report to find any security violations.

1. In SQL*Plus, connect as user SYSTEM and ensure that unified auditing is not enabled.

   CONNECT SYSTEM -- Or, CONNECT SYSTEM@hrpdb
   Enter password: password
   
   SQL> SELECT VALUE FROM V$OPTION WHERE PARAMETER = 'Unified Auditing';
   

   If VALUE returns TRUE, then you cannot complete this section. Go to Step 8: Remove the Components for This Tutorial.

   If unified auditing is enabled, then you must create a unified audit policy to capture events. See Oracle Database Security Guide for information about how to create unified audit policies for Oracle Database Vault.

2. In the Database Vault Administrator page, click Home to display the home page.
3. In the Database Vault Home page, under Reports, select Database Vault Reports.
4. In the Database Vault Reports page, select Database Vault Enforcement Audit Report.
5. From the Database Vault Audit Report list, select Realm Audit Report.
6. In the Search area, from the Command menu, select Equals and in the text field, enter SELECT. Then click Search.

   The report appears in the table that follows the Search region.

7. Click OK to exit the report.

You can remove the components that you created for this tutorial if you no longer need them.