Skip to content

DBA Role Access

Overview

At checkout the broker checks whether the requesting user exists in the Oracle database, creates them with a randomly generated password and CREATE SESSION if not, then grants the DBA role. At checkin it revokes DBA. Use this for temporary administrative escalation that’s fully removed when the session ends.

Before You Begin

  • The Access Broker is deployed and connected
  • Oracle SQL*Plus installed on the broker host and TNS connectivity to the database (default port 1521)
  • A service account (DB_USER) granted: SELECT ON dba_users, CREATE USER, ALTER USER, and GRANT DBA ... WITH ADMIN OPTION

DBA is the highest Oracle privilege. Require an approval workflow on this profile and keep the expiration short.

Environment Variables

VariableNotes
userInjected — target username
DB_HOST, DB_PORT, DB_SERVICE_NAMEConnection details
DB_USER, DB_PASSService account credentials

Checkout Routine

Full script: OracleDB/permissions/db_admin_checkout.sh

USER_PASSWORD=$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 12)

# Create the user if missing
sqlplus -s "$DB_USER/$DB_PASS@..." <<EOF
CREATE USER $USERNAME IDENTIFIED BY "$USER_PASSWORD";
GRANT CREATE SESSION TO $USERNAME;
EXIT;
EOF

# Grant DBA
sqlplus -s "$DB_USER/$DB_PASS@..." <<EOF
GRANT DBA TO $USERNAME;
EXIT;
EOF

Checkin Routine

Full script: OracleDB/permissions/db_admin_checkin.sh — revokes DBA from the user.

REVOKE DBA FROM $USERNAME;

Configure in Britive

Create the permission

Resource Manager → Resource Type Permissions → New Permission. Set Language to Shell. Paste the checkout and checkin routines. Declare DB_HOST, DB_PORT, DB_SERVICE_NAME, DB_USER, DB_PASS (user is system-defined).

Create a profile and policy

Create a profile with a short expiration (e.g. 30m), add this permission, and add a policy that requires approval. Assign members by tag.

Verify

Check out and connect

Check out the profile, then connect as the user and confirm the role:

SELECT granted_role FROM user_role_privs;
-- Expected: DBA

Check in and confirm revoke

After checkin, re-run the query — DBA is gone.

Troubleshoot

SymptomCauseFix
ORA-01031: insufficient privilegesService account lacks WITH ADMIN OPTION on DBARe-grant GRANT DBA TO <svc> WITH ADMIN OPTION
User not createdCREATE USER deniedGrant CREATE USER to the service account
Can’t connectSQL*Plus/TNS not configuredVerify SQL*Plus on the broker and TNS reachability on port 1521

Next Steps

Last updated on