URT fails with ORA-31685
Article ID: 233466
Updated On:
Products
Issue/Introduction
URT fails with ORA-31685 errors:
ORA-31685: Object type USER:"<URT User>" failed due to insufficient privileges. Failing sql is:
CREATE USER "<URT User>" IDENTIFIED BY VALUES 'S:ABE54FF35BF94230049B09185CDCA35174E55975756BEA7A1B760B25AA69;T:ABC75CDACCB2B2C6FF9C07698F8257DFB6B451335BB477F28535B46878FAE3CCA247FCC9AEBEE3224836443176204F227133B22D8556BBDC014550510CEFDC31CC41D6BAD44470F194F3FA0ED1C8FE47;31B0BCE68A5C965B' DEFAULT TABLESPACE "USERS" TEMPORARY TABLESPACE "TEMP" PROFILE "APP_PROFILE"
Processing object type SCHEMA_EXPORT/SYSTEM_GRANT
ORA-31685: Object type SYSTEM_GRANT:"<URT User>"."CREATE JOB" failed due to insufficient privileges. Failing sql is:
GRANT CREATE JOB TO "<URT User>"
ORA-31685: Object type SYSTEM_GRANT:"<URT User>"."CREATE INDEXTYPE" failed due to insufficient privileges. Failing sql is:
GRANT CREATE INDEXTYPE TO "<URT User>"
ORA-31685: Object type SYSTEM_GRANT:"<URT User>"."CREATE OPERATOR" failed due to insufficient privileges. Failing sql is:
GRANT CREATE OPERATOR TO "<URT User>"
ORA-31685: Object type SYSTEM_GRANT:"<URT User>"."CREATE TYPE" failed due to insufficient privileges. Failing sql is:
GRANT CREATE TYPE TO "<URT User>"
ORA-31685: Object type SYSTEM_GRANT:"<URT User>"."CREATE MATERIALIZED VIEW" failed due to insufficient privileges. Failing sql is:
GRANT CREATE MATERIALIZED VIEW TO "<URT User>"
ORA-31685: Object type SYSTEM_GRANT:"<URT User>"."CREATE TRIGGER" failed due to insufficient privileges. Failing sql is:
GRANT CREATE TRIGGER TO "<URT User>"
ORA-31685: Object type SYSTEM_GRANT:"<URT User>"."CREATE PROCEDURE" failed due to insufficient privileges. Failing sql is:
GRANT CREATE PROCEDURE TO "<URT User>"
ORA-31685: Object type SYSTEM_GRANT:"<URT User>"."CREATE SEQUENCE" failed due to insufficient privileges. Failing sql is:
GRANT CREATE SEQUENCE TO "<URT User>"
ORA-31685: Object type SYSTEM_GRANT:"<URT User>"."CREATE VIEW" failed due to insufficient privileges. Failing sql is:
GRANT CREATE VIEW TO "<URT User>"
ORA-31685: Object type SYSTEM_GRANT:"<URT User>"."CREATE SYNONYM" failed due to insufficient privileges. Failing sql is:
GRANT CREATE SYNONYM TO "<URT User>"
ORA-31685: Object type SYSTEM_GRANT:"<URT User>"."CREATE CLUSTER" failed due to insufficient privileges. Failing sql is:
GRANT CREATE CLUSTER TO "<URT User>"
ORA-31685: Object type SYSTEM_GRANT:"<URT User>"."CREATE TABLE" failed due to insufficient privileges. Failing sql is:
GRANT CREATE TABLE TO "<URT User>"
ORA-31685: Object type SYSTEM_GRANT:"<URT User>"."UNLIMITED TABLESPACE" failed due to insufficient privileges. Failing sql is:
GRANT UNLIMITED TABLESPACE TO "<URT User>"
ORA-31685: Object type SYSTEM_GRANT:"<URT User>"."ALTER SESSION" failed due to insufficient privileges. Failing sql is:
GRANT ALTER SESSION TO "<URT User>"
ORA-31685: Object type SYSTEM_GRANT:"<URT User>"."CREATE SESSION" failed due to insufficient privileges. Failing sql is:
GRANT CREATE SESSION TO "<URT User>"
Processing object type SCHEMA_EXPORT/DEFAULT_ROLE
ORA-31685: Object type DEFAULT_ROLE:"<URT User>" failed due to insufficient privileges. Failing sql is:
ALTER USER "<URT User>" DEFAULT ROLE ALL
Processing object type SCHEMA_EXPORT/PRE_SCHEMA/PROCACT_SCHEMA
Processing object type SCHEMA_EXPORT/TYPE/TYPE_SPEC
Processing object type SCHEMA_EXPORT/SEQUENCE/SEQUENCE
Processing object type SCHEMA_EXPORT/TABLE/TABLE
Processing object type SCHEMA_EXPORT/PACKAGE/PACKAGE_SPEC
Processing object type SCHEMA_EXPORT/FUNCTION/FUNCTION
Processing object type SCHEMA_EXPORT/PROCEDURE/PROCEDURE
Processing object type SCHEMA_EXPORT/PACKAGE/COMPILE_PACKAGE/PACKAGE_SPEC/ALTER_PACKAGE_SPEC
Processing object type SCHEMA_EXPORT/FUNCTION/ALTER_FUNCTION
Processing object type SCHEMA_EXPORT/PROCEDURE/ALTER_PROCEDURE
Processing object type SCHEMA_EXPORT/VIEW/VIEW
Processing object type SCHEMA_EXPORT/PACKAGE/PACKAGE_BODY
Processing object type SCHEMA_EXPORT/TABLE/INDEX/INDEX
Processing object type SCHEMA_EXPORT/TABLE/INDEX/FUNCTIONAL_INDEX/INDEX
Processing object type SCHEMA_EXPORT/TABLE/CONSTRAINT/CONSTRAINT
Processing object type SCHEMA_EXPORT/TABLE/CONSTRAINT/REF_CONSTRAINT
Job "<URT User>"."SYS_IMPORT_FULL_01" completed with 17 error(s) at Fri Jan 28 12:07:50 2022 elapsed 0 00:03:15
You are sure that gave correct permission to your URT user ("<URT User>") and Oracle user a RAC environment as per Symantec Data Loss Prevention Upgrade Guide for Windows, Version 15.8
Confirming the URT database user permissions
sqlplus sys/@:1521/<sys password> as sysdba
GRANT READ,WRITE ON directory DATA_PUMP_DIR TO [schema user name];
Confirming the Oracle database user permissions
The Oracle database user (typically “protect”) must have permission to connect to the Enforce Server. The installation fails if the user cannot access the Enforce Server.
1. Start SQL*Plus.
2. Run the following commands:
sqlplus sys/protect as sysdba
GRANT read, write ON directory data_pump_dir TO protect;
GRANT SELECT ON dba_registry_history TO protect;
GRANT SELECT ON dba_temp_free_space TO protect;
GRANT SELECT ON v_$version TO protect;
GRANT EXECUTE ON dbms_lob TO protect;
3. If you are running Oracle 19c, run the following command:
GRANT create job TO protect;
4. Exit SQL*Plus:
exit
Environment
Component: Data Loss Prevention
Resolution
The failed grant privileges to URT User (here "DLP_URT") in the URT log can be ignored because it was just trying to use a non sysdba user to grant privileges to the URT user to match the protect user without checking if the user already had those privileges. The URT had already verified the required privileges before it even started the data pump. The exclude grant from the export was supposed to avoid this benign error, but even so it can be ignored.
This is caused by two bugs in oracle. The first bug being that oracle is exporting these permissions when we instruct it not to (included with the valid export data). The second bug is that oracle is giving an error trying to set the permissions for a user that already has those permissions. Oracle has resolved this issue. If the Oracle database AND the oracle client / tools on enforce are updated to the latest release then these error messages should not occur.
Feedback
