Acquiring System Administration Privileges

Three levels of privileges

Instance Manager recognizes three levels of access rights. All users must have a login ID with the parent Oracle database; those who cannot provide valid credentials have no access rights. The levels are:

• All RDBMS users. All users have the right to view some of the information that is available in Instance Manager, such as the configuration settings for an OLAP service.

• Instance Administration Privilege. Users can manage a particular OLAP service by changing configuration settings, terminating sessions, starting and stopping the service, and so forth.

• OLAP Service Administration Privilege. Users have the Instance Administration Privilege, plus the ability to control the service environment on the host machine. For example, a user with the OLAP Service Administration Privilege can create new OLAP services, remove existing services, and grant the OLAP Service Administration Privilege to other users.

The local repository stores the Instance Administration and OLAP Service Administration privilege information, along with all other configuration information. Passwords are encrypted.

Who can grant administration privileges?

The OLAP_DBA role has the highest level of privilege for administering OLAP Services. This role is managed by database security, in contrast to the administration privileges for OLAP Services, which are managed by Instance Manager.

The OLAP_DBA role is granted automatically to the system DBA role, and can be granted to other users through the Security node of Oracle Enterprise Manager. A user with the OLAP_DBA role in the database automatically has the OLAP Services Administration Privilege in Instance Manager.

Any user with the OLAP Services Administration Privilege can grant other users the OLAP Services Administration Privilege or the Instance Administration Privilege by using the Security page of Instance Manager.

The OLAP_DBA role is also required to create OLAP metadata, as described in "OLAP Services identities".

Procedure: Granting administration privileges

Follow these steps to grant Instance Administration or OLAP Services Administration privileges to a valid database user name or to a role. You will be able to select valid user names and roles from run-time lists fetched from the database into Instance Manager.

1. Open Instance Manager by taking the steps listed in "Procedure: Opening Instance Manager". Log in with a user name that has the OLAP Services Administration Privilege, as described in "Who can grant administration privileges?".

2. Select Instance Security.

   You see the General page for Instance Security.

3. Choose Add to display the Add Users/Roles to Privileges box.

4. Choose Help for further information about adding users to the list of those with administration privileges.

Figure: Instance Security sheet

In the following figure, the Instance Security sheet identifies the users who have been granted the OLAP Services Administration Privilege. The Add Users/Roles to Privileges box lists the users and roles defined in the database.