Configure Oracle Database Vault for a Pluggable Database (PDB1)

Oracle Database Vault (DV) adds a critical layer of security to Oracle Databases by enabling strong access control and separation of duties. When working in a multitenant environment, it's essential to configure DV specifically for each Pluggable Database (PDB) where protection is required.

This guide outlines the complete steps to enable and verify Database Vault in PDB1, including the assignment of privileged users and schema verification.

---

Step 1: Connect to the Target PDB

Start by switching your session to the target pluggable database where DV needs to be enabled.

sql
ALTER SESSION SET CONTAINER=pdb1;

---

Step 2: Verify DV and OLS Installation

Ensure that Database Vault (DV) and Oracle Label Security (OLS) are installed and available in the PDB.

sql
SELECT * FROM SYS.DBA_DV_STATUS;
SELECT * FROM DBA_OLS_STATUS;

These views should return status information such as ENABLED, DISABLED, or NOT CONFIGURED.

---

Step 3: Load Sample Schema (HR)

If the HR schema is not yet available in the PDB, it can be created using the official Oracle script:

sql
@?/demo/schema/human_resources/hr_main.sql

Once the schema is created, validate access to sample data:

sql
SELECT EMPLOYEE_ID, FIRST_NAME, LAST_NAME, SALARY FROM hr.employees;

---

Step 4: Configure Database Vault

Use the built-in CONFIGURE_DV procedure to initialize Database Vault by assigning the DV Owner and DV Account Manager roles.

sql
BEGIN
  CONFIGURE_DV (
    dvowner_uname    => 'c##dv_owner_root',
    dvacctmgr_uname  => 'c##dv_acctmgr_root'
  );
END;
/

This step sets up the security foundation by defining which users will manage DV operations.

---

Step 5: Enable Database Vault

Connect as the DV Owner user to enable Database Vault enforcement within the PDB.

sql
CONNECT c##dv_owner_root@pdb1

Then execute the enablement procedure:

sql
EXEC DBMS_MACADM.ENABLE_DV;

This activates DV controls and enforces realm protection and command rules.

---

Step 6: Restart the PDB

To finalize DV configuration, restart the PDB.

sql
ALTER PLUGGABLE DATABASE pdb1 CLOSE;
ALTER PLUGGABLE DATABASE pdb1 OPEN;

---

Step 7: Confirm Configuration

After restarting, confirm that DV and OLS are enabled by rechecking their status:

sql
SELECT * FROM SYS.DBA_DV_STATUS;
SELECT * FROM DBA_OLS_STATUS;

You should now see the status as ENABLED, confirming that Database Vault is active in PDB1.

---

Conclusion

With Database Vault configured on a PDB, Oracle enforces separation of duties, limits administrative access, and safeguards application data against unauthorized actions—even from powerful users. This configuration is highly recommended for databases requiring strict compliance and security assurance.

For additional control, you can proceed to define realms, command rules, and authorized accounts as per your organizational policies.

---

Written by Bidhan Mandal
Oracle Apps DBA | EBS Tech Stack Expert | Security & OCI Specialist
Visit: https://bidhandba.blogspot.com