Creating a User in a Database Vault-Protected Oracle PDB

Oracle Database Vault (DV) significantly tightens security by restricting privileged users—even DBA roles—from performing certain operations unless explicitly authorized. One such restriction is creating users in a DV-enabled Pluggable Database (PDB). This article demonstrates how to properly create a new user (SCOTT) in such an environment using the DV Account Manager user.

---

 Background

In a standard Oracle environment, a user with DBA or SYSDBA privileges can easily create users. However, once Database Vault is configured and enabled, these privileges are no longer sufficient unless the user is explicitly granted DV-specific roles, like:

• DV_OWNER

• DV_ACCTMGR

Let’s walk through a real-world scenario where an attempt to create a user fails due to DV restrictions, and how to fix it using the correct privileged user.

---

Initial Attempt — Access Denied

First, we switch to the target PDB (pdb1) and try to create the SCOTT user:

sql
ALTER SESSION SET CONTAINER=pdb1;

sql
CREATE USER scott IDENTIFIED BY tiger;

Result:

text
ORA-01031: insufficient privileges

Despite having typical DBA-level access, the operation is blocked—this is Database Vault in action.

---

 Use the Right Role: DV_ACCTMGR

To proceed, we must connect using the user who was assigned the DV Account Manager role during Database Vault setup. This account is typically named like c##dv_acctmgr_root.

bash
sqlplus c##dv_acctmgr_root@pdb1

Now, retry the CREATE USER command with a strong password:

sql
CREATE USER scott IDENTIFIED BY ORacle1234##;

Result:

text
User created.

Success! The scott user is now created within the DV-protected PDB.

---

 Why This Matters

Oracle DV enforces separation of duties. Even if you're a DBA, you're not permitted to perform user management or access sensitive data unless your account is assigned specific DV roles. This architecture prevents accidental or malicious privilege misuse and satisfies compliance requirements like GDPR, SOX, and HIPAA.

---

 Bonus: Granting Privileges to the New User

After creation, you can grant necessary roles or privileges to the new user:

sql
GRANT CONNECT, RESOURCE TO scott;
ALTER USER scott QUOTA UNLIMITED ON USERS;

Make sure these actions are also performed by the DV Account Manager or as per the defined security policy.

---

Summary

Creating users in a DV-enabled Oracle environment requires proper role management. Traditional SYS or DBA accounts can't perform this task unless they're granted DV-specific roles. In this post, we demonstrated:

• The error encountered when a non-DV-authorized user attempts to create a user.

• The correct process using the c##dv_acctmgr_root user.

• Why this restriction is a key part of Oracle's defense-in-depth strategy.

---

Author: Bidhan Mandal
Oracle EBS | Autonomous Database | Security Expert
More blogs at: https://bidhandba.blogspot.com