Oracle Database 11 g - Online Public Access Catalog

CHAPTER 9 ■ STORAGE MANAGEMENT 363sysasm Privilege and osasm GroupOracle Database 11g defines a new privilege called sysasm for the ASM instance. The primarypurpose of the sysasm privilege is to manage the gray area of roles and responsibility introduced byASM. The sysasm privilege separates the roles between the storage administrator, systemadministrator, and database administrator.Eventually the sysdba privilege will be deprecated from the ASM instance. There will be aclear delineation between the RDBMS and ASM credentials. In Oracle Database 11g, the securitycredentials of sysdba will behave as they did with Oracle Database 10g. In future releases ofOracle, sysdba will be restricted from ASM. Separating the sysasm privilege from the sysdba privilegeimproves the security model since you are separating the role of the ASM administrationfrom the role of database administration.■Note Starting from Oracle Database 11g, Oracle’s best practices recommend using the sysasm roleinstead of the sysdba role for ASM administration.The following message is generated in the alert log file if the sysdba role is used to performASM maintenance:WARNING: Deprecated privilege SYSDBA for command 'ALTER DISKGROUP CHECK'The following code example illustrates the process necessary to grant the sysasm privilegeand configure a new user for the sysasm privilege. Let’s first create a user named ckim and grantthat user the sysasm privilege:SQL> create user ckim identified by oracle123default tablespace toolstemporary tablespace temp;User altered.SQL> grant sysasm, sysoper to ckim;Grant succeeded.You can clearly see that the ckim user has the sysasm privilege granted in the V$PWFILE_USERS view:SQL> select * from v$pwfile_users;USERNAME SYSDB SYSOP SYSAS------------------------------ ---------- ---------- ----------SYS TRUE TRUE FALSECKIM FALSE TRUE TRUE