Getting Started

Overview

This guide walks you through configuring the Britive Access Broker to manage just-in-time access to Oracle Database — creating a temporary schema user at checkout and dropping it at checkin.

What you’ll accomplish:

Deploy and configure the Britive Access Broker with connectivity to your Oracle instance
Configure checkout and checkin routines from the access-broker-examples repository
Register Oracle Database as a Resource Manager resource in Britive
Create a Resource Manager access profile
Check out database access and verify end-to-end

Prerequisites

Before you begin, make sure you have:

A Britive tenant with administrator access
A running Britive Access Broker with network access to the Oracle listener (port 1521)
An Oracle DBA account with CREATE USER, DROP USER, and GRANT privileges
Oracle Instant Client and sqlplus available on the broker host

Never hardcode credentials. Use environment variables, your secret manager, or the Britive Secrets Store.

How It Works

The Access Broker runs SQL*Plus commands to create and drop temporary Oracle users. At checkout, Britive creates an Oracle schema user, grants the target roles, and returns credentials. At checkin (or on expiry), the user is dropped — no standing database accounts remain.

User → Britive Console → Access Broker → sqlplus → CREATE USER / GRANT → DROP USER

Onboarding the Application

Configure the broker for Oracle Database access management. This is a one-time setup performed by an administrator.

Reference scripts are available in the britive/access-broker-examples repository under Oracle/permissions/.

Using the Britive Console

Deploy the Access Broker

Follow the Britive Access Broker deployment guide to install and register a broker. Install Oracle Instant Client on the broker host.

Configure the broker scripts

git clone https://github.com/britive/access-broker-examples.git
# Copy Oracle/permissions/ scripts to your broker's scripts directory

Create a DBA account for the broker

CREATE USER britive_admin IDENTIFIED BY "StrongPassword!";
GRANT DBA TO britive_admin;

Store the credentials in the Britive Secrets Store.

Register Oracle Database in Resource Manager

Navigate to Resource Manager → Resources → Add Resource. Enter the Oracle host, port, service name, and admin credentials.

Using Shell

Key environment variables used by the broker scripts:

ORACLE_HOST=oracle.example.com
ORACLE_PORT=1521
ORACLE_SERVICE=ORCL
ORACLE_ADMIN_USER=britive_admin
ORACLE_ADMIN_PASSWORD=...   # From Britive Secrets Store
ORACLE_TARGET_ROLE=CONNECT,RESOURCE
BRITIVE_USER_EMAIL=user@example.com

Refer to the britive/access-broker-examples Oracle/ directory for the full script set covering DBA and read-only access variants.

Using Terraform

resource "britive_resource_manager_resource_type" "oracle" {
  name        = "OracleDatabase"
  description = "Oracle Database instance"

  parameters {
    param_name   = "hostname"
    param_type   = "string"
    is_mandatory = true
  }
  parameters {
    param_name   = "port"
    param_type   = "string"
    is_mandatory = true
  }
  parameters {
    param_name   = "service_name"
    param_type   = "string"
    is_mandatory = true
  }
}

resource "britive_resource_manager_resource" "oracle_prod" {
  name          = "oracle-prod"
  resource_type = britive_resource_manager_resource_type.oracle.name

  parameter_values = {
    hostname     = "oracle.example.com"
    port         = "1521"
    service_name = "ORCL"
  }

  resource_labels = {
    environment = "Production"
  }
}

Create Your First Access Profile

Using the Britive Console

Open Resource Manager

Navigate to Resource Manager → Profiles → Add Profile.

Configure the profile

Field	Value
Name	A descriptive name (e.g., `Oracle-ReadOnly`)
Expiration	Set a max session duration (e.g., `2h`)

Associate resources

Under Associations, select the Oracle Database resource.

Add a permission

Under Permissions, select the checkout/checkin routine for the target access level.

Add a policy

Under Policies, assign members and configure conditions.

Save and activate

Click Save.

Using Terraform

resource "britive_resource_manager_profile" "oracle_readonly" {
  name                = "Oracle-ReadOnly"
  expiration_duration = 7200000

  associations {
    label_key = "environment"
    values    = ["Production"]
  }
}

resource "britive_resource_manager_profile_permission" "oracle_perm" {
  profile_id = britive_resource_manager_profile.oracle_readonly.id
  name       = "Oracle-ReadOnly-Access"
  version    = "latest"
}

Verify

Check out the profile

Navigate to My Access → find your profile → click Check Out. Britive returns temporary Oracle credentials.

Connect to Oracle

sqlplus <temp-user>/<temp-password>@oracle.example.com:1521/ORCL

Confirm access

SELECT user FROM dual;

Check in

Return to My Access → click Check In. Connecting with the same credentials should fail with ORA-01017: invalid username/password.

Troubleshoot

Symptom	Likely Cause	Fix
Checkout fails	Broker cannot reach Oracle listener	Check network connectivity on port 1521 and Oracle Net firewall rules
`ORA-01031: insufficient privileges`	Admin account lacks required grants	Re-grant DBA or specific system privileges to `britive_admin`
User not dropped after checkin	Active sessions holding the schema	Kill active sessions (`ALTER SYSTEM KILL SESSION`) before checkin

Next Steps

Britive documentation

Last updated on July 8, 2026

DBA Role Access