Identity Manager Startup Fails Due to Oracle Database Permission Issues

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

Identity Manager startup may fail when attempting to initialize the Task Persistence schema. This typically manifests as a SQL exception due to insufficient privileges on the Oracle database user account used by the application. This article outlines the minimum required permissions to allow the schema to initialize successfully.

Environment

Identity Manager
 

Cause

The error ORA-02158: invalid CREATE INDEX option occurs because the Oracle user account lacks the necessary CREATE permissions required for the application to properly initialize the Task Persistence schema.

Resolution

To resolve this issue, ensure the database user account has the required permissions. The Identity Manager/Governance/Portal solutions automatically recreate database tables upon restart. Grant the following privileges to the service account:

1. Grant Essential Privileges:

   GRANT CONNECT, RESOURCE TO <username>;GRANT CREATE TABLE, CREATE VIEW, CREATE SESSION, CREATE TRIGGER, CREATE SEQUENCE TO <username>;GRANT CREATE TABLESPACE, DROP TABLESPACE, MANAGE TABLESPACE, UNLIMITED TABLESPACE TO <username>;

2. Verify Access:

   • Ensure the service account is configured with the least-privileged security model.
   • Do not grant the DBA role; these specific grants are sufficient for schema management.
   • Run the configuration twice if necessary to validate that the new service ID can correctly drop and recreate tables.

Note: Ensure each solution (Identity Manager, Governance, Portal) uses a unique service ID to prevent cross-contamination of database objects.