This topic describes the users and their roles under Oracle tenants.
Applicability
This topic applies only to OceanBase Database Enterprise Edition. OceanBase Database Community Edition provides only MySQL mode.
Tenant administrator
The built-in SYS user under each Oracle tenant in OceanBase Database acts as the tenant administrator. Tenant administrators in OceanBase Database can configure database parameters, create database objects, and allocate access privileges under the corresponding tenants.
Database security administrator
After OceanBase Database is deployed, the system creates a built-in LBACSYS user under each tenant to act as the database security administrator of the tenant. The database security administrator of an Oracle tenant can configure database audit settings of the tenant, define new database auditors, view database audit records, set security levels, scopes, and groups of the system, and define security tags for subjects and objects, to comprehensively improve the system security.
Database auditor
After OceanBase Database is deployed, the system creates a built-in ORAAUDITOR user under each tenant to act as the database auditor of the tenant. The database auditor of an Oracle tenant can implement forcible access control on the system under the tenant, set the objects and operations to be audited, define new database auditors, view and analyze audit records, and set system strategies and tags. After auditing is set up, almost any operations performed by any users in the system can be tracked, to facilitate subsequent tracing.
Users
Regular users must be granted the required access and operation privileges before they can access and manage database objects under the corresponding tenants. Regular users are usually created and granted privileges by the tenant administrator. For more information about how to create and grant privileges to a user, see Create a user and Modify user privileges.
Roles
In Oracle mode, a role is a set of system privileges and object privileges. You can use roles to manage user privileges.
In OceanBase Database, you can perform the following operations on roles:
You can grant system privileges or object privileges to roles.
You can assign a role to another role. This means that a role can contain other roles.
A user can have several roles, and a role can be assigned to several users.
In Oracle mode, by default, the system has some built-in roles. The following table describes the privileges of the roles.
| Role | Privileges |
|---|---|
| CONNECT | This role has the CREATE SESSION privilege. |
| DBA | This role has all system privileges. |
| PUBLIC | This role applies to all users in a tenant. By default, no privilege is granted to the role. |
| RESOURCE | This role has the CREATE TABLE, CREATE PROCEDURE, CREATE SEQUENCE, CREATE TRIGGER, and CREATE TYPE privileges. |
For more information about roles, see Overview of role management.