DBA Role Access
Overview
At checkout the broker checks whether the requesting user exists in the Oracle database, creates them with a randomly generated password and CREATE SESSION if not, then grants the DBA role. At checkin it revokes DBA. Use this for temporary administrative escalation that’s fully removed when the session ends.
Before You Begin
- The Access Broker is deployed and connected
- Oracle SQL*Plus installed on the broker host and TNS connectivity to the database (default port
1521) - A service account (
DB_USER) granted:SELECT ON dba_users,CREATE USER,ALTER USER, andGRANT DBA ... WITH ADMIN OPTION
DBA is the highest Oracle privilege. Require an approval workflow on this profile and keep the expiration short.
Environment Variables
| Variable | Notes |
|---|---|
user | Injected — target username |
DB_HOST, DB_PORT, DB_SERVICE_NAME | Connection details |
DB_USER, DB_PASS | Service account credentials |
Checkout Routine
Full script: OracleDB/permissions/db_admin_checkout.sh
USER_PASSWORD=$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 12)
# Create the user if missing
sqlplus -s "$DB_USER/$DB_PASS@..." <<EOF
CREATE USER $USERNAME IDENTIFIED BY "$USER_PASSWORD";
GRANT CREATE SESSION TO $USERNAME;
EXIT;
EOF
# Grant DBA
sqlplus -s "$DB_USER/$DB_PASS@..." <<EOF
GRANT DBA TO $USERNAME;
EXIT;
EOFCheckin Routine
Full script: OracleDB/permissions/db_admin_checkin.sh — revokes DBA from the user.
REVOKE DBA FROM $USERNAME;Configure in Britive
Create the permission
Resource Manager → Resource Type Permissions → New Permission. Set Language to Shell. Paste the checkout and checkin routines. Declare DB_HOST, DB_PORT, DB_SERVICE_NAME, DB_USER, DB_PASS (user is system-defined).
Create a profile and policy
Create a profile with a short expiration (e.g. 30m), add this permission, and add a policy that requires approval. Assign members by tag.
Verify
Check out and connect
Check out the profile, then connect as the user and confirm the role:
SELECT granted_role FROM user_role_privs;
-- Expected: DBACheck in and confirm revoke
After checkin, re-run the query — DBA is gone.
Troubleshoot
| Symptom | Cause | Fix |
|---|---|---|
ORA-01031: insufficient privileges | Service account lacks WITH ADMIN OPTION on DBA | Re-grant GRANT DBA TO <svc> WITH ADMIN OPTION |
| User not created | CREATE USER denied | Grant CREATE USER to the service account |
| Can’t connect | SQL*Plus/TNS not configured | Verify SQL*Plus on the broker and TNS reachability on port 1521 |