22

Controlling Database Access

This chapter explains how to control access to an Oracle database. It includes the following sections:

Introduction to Database Security

Schemas, Database Users, and Security Domains

User Authentication

Oracle Internet Directory

User Tablespace Settings and Quotas

The User Group PUBLIC

User Resource Limits and Profiles

Controlling Database Access 22-1

Introduction to Database Security

Introduction to Database Security

Database security entails allowing or disallowing user actions on the database and the objects within it. Oracle uses schemas and security domains to control access to data and to restrict the use of various database resources.

Oracle provides comprehensive discretionary access control. Discretionary access control regulates all user access to named objects through privileges. A privilege is permission to access a named object in a prescribed manner; for example, permission to query a table. Privileges are granted to users at the discretion of other users—hence the term discretionary access control.

See Also: Chapter 23, "Privileges, Roles, and Security Policies"

Schemas, Database Users, and Security Domains

A user (sometimes called a username) is a name defined in the database that can connect to and access objects. A schema is a named collection of objects, such as tables, views, clusters, procedures, and packages. Schemas and users help database administrators manage database security.

Enterprise users are managed in a directory and can be given access to multiple schemas and databases without having to create an account or schema in each database. This arrangement is simpler for users and for DBAs and also offers better security because their privileges can be altered in one place.

When creating a new database user or altering an existing one, the security administrator must make several decisions concerning a user’s security domain. These include:

Whether user authentication information is maintained by the database, the operating system, or a network authentication service

Settings for the user’s default and temporary tablespaces

A list of tablespaces accessible to the user, if any, and the associated quotas for each listed tablespace

The user’s resource limit profile; that is, limits on the amount of system resources available to the user

The privileges, roles, and security policies that provide the user with appropriate access to schema objects needed to perform database operations

This chapter describes the first four security domain options listed.

22-2 Oracle9i Database Concepts