Changing OPS$ user name - help please 1

[zeons]

I have inherited the support of a system that was set up with administrator as the only OPS$ account. I need to rename this to PVCS I think. Currently when trying to create a new base database the password is failing, mainly because the administrator account is obviously authenticating against the domain and this password is not one that we are permitted to give to the customer. We have created a domain account called PVCS (as ya can guess this is for merant's PVCS software), run a script on the user databases to change all instances of administrator to PVCS, and can now do most activities with the PVCS account, except create a new base database etc. The PVCS (oracle) server is on an NT server and the relevant setting (I believe) have been set to authenticate to our domain.
Any helpful comments would be most welcome as I have a customer that is slowly climbing the walls. Thanks in advance.

 

[did02]

Hi,

I'm not sure to understand your pb, but I'll try to help you.

1/ there are 2 modes when you create oracle users :
- identified by password (clause identify by pwd)
- external authenticated, using the OS login (clause identify externally)

2/ when you use external authentication, the user name must be generally prefixed with OPS$. This value is defined into an oracle parameter (OS_AUTHENT_PREFIX) and OPS$ is the default value (Cf INITSID.ORA).

Moreover, for Windows NT authentication to work, the SQLNET.AUTHENTICATION_SERVICES parameter must be set as follows in your ORACLE_HOME\NET80\ADMIN\SQLNET.ORA file on both client and server:

SQLNET.AUTHENTICATION_SERVICES = (NTS)

So if your login is loginNT, you have to create a user :

create user OPS$LOGINNT
identify externally
...;

3/ if you want to use domain\loginNT in the external authentication, it is a little bit more complex :
on the serveur side, the OSAUTH_PREFIX_DOMAIN should be set to TRUE in the Oracle register database.
Then cf 2/.

So if your login is DOM\loginNT, you have to create a user :

create user OPS$DOM\LOGINNT
identify externally
...;


Hope it helps you.
Rgds,
Did02

 

[zeons]

Thanks for the quick reply.

Does it matter that previous database activities were done with the administrator account?
I presume not, but as you can tell I am new to this side of life.
Will this new user have the rights to create new base databases or will I need to change or assign specific rights to it?

This is something I found after posting the original question, hence my new query:

sqlplus system/<password>
Create user OPS$userid identified externally;
grant connect, resource, dba to OPS$userid;
exit

 

[did02]

Hi (again),

A user created with the dba role can nearly do every thing in its database.
Usualy, you find many users in a database : a DBA to administrate, schema owners, process users, users for DBLinks and end users (for reporting,update,...). The schema owners grant process users, users for dblinks and end users on each objects they need with the appropriate rights (usually through roles).

If you want to create another db on the same server, you just need to read the Oracle doc : you'll begin by creating instance, then defining the password of INTERNAL,... And if needed, you will be able to create, in this new db, a new user (externally authenticated with dba role).

Is it clear ?

Did02

 

[zeons]

Becoming clearer by the minute.
Thanks for your help.