Configuring Users Groups and Environments for Oracle Grid Infrastructure and Oracle AI Database

Before installation, create operating system groups and users, and configure user environments.

Required Operating System Groups and Users

Oracle installations require an installation owner, a shared Oracle Inventory group as the primary group for all installation owners, and one or more operating system privilege groups. Verify whether an existing central inventory and oraInst.loc file exist, reuse the same inventory for all installations, and ensure installation owners can write to it. Create the inventory group if needed, and use designated grid and oracle owners when separating Grid Infrastructure and database administration. Installation owners must use the inventory group as their primary group and appropriate database, ASM, backup, Data Guard, encryption, and RAC groups as secondary groups; for Oracle Restart, ensure grid belongs to racdba.

Oracle Installations with Standard and Job Role Separation Groups and Users

Oracle supports standard and job role separation configurations through operating system users and groups that control administrative privileges for Grid Infrastructure, ASM, and databases. A single owner and group may provide all privileges, but Oracle recommends separate inventory and administrative groups when role separation is required. Standard database groups include OSDBA (dba) and optional OSOPER (oper), while extended groups provide limited SYSBACKUP, SYSDG, SYSKM, and SYSRAC privileges. ASM administration uses OSASM (asmadmin), optional OSOPER for ASM (asmoper), and OSDBA for ASM (asmdba); the ASMSNMP account can be created with limited monitoring privileges for Enterprise Manager.

Creating Operating System Privileges Groups

Create the operating system groups required by the installation when they do not already exist, using conventional names such as asmadmin for OSASM, asmdba for ASM disk access, asmoper for ASM startup and shutdown, dba for database SYSDBA, and oper for database SYSOPER. Database installations also require groups for SYSBACKUP (backupdba), SYSDG (dgdba), SYSKM (kmdba), and SYSRAC (racdba). Group identifiers should be selected according to the operating system’s existing allocation and organizational policies.

Creating Operating System Oracle Installation User Accounts

Create Oracle software owner accounts before installation, typically oracle for database software and grid for Grid Infrastructure, assigning the Oracle Inventory group as the primary group and the required privilege groups as secondary groups. Record each user ID for preinstallation tasks. If an existing owner lacks the required memberships, update its groups before installation, but do not change the primary inventory group or use different primary groups among owners because this can corrupt the central inventory.

Configuring Software Owner User Environments

Before installation, configure each oracle or grid environment with umask 022, suitable file-descriptor and process limits, and a valid DISPLAY setting for graphical installers. Remove conflicting Oracle variables such as ORACLE_HOME, ORACLE_SID, ORACLE_BASE, ORA_NLS10, TNS_ADMIN, and ORA_CRS_HOME, and remove Oracle home paths from PATH. Ensure temporary storage provides at least 1 GB, using a nonshared directory for RAC installations, and verify the resulting environment. Recommended limits include at least 1,024 soft and 65,536 hard open files, 2,047 soft and 16,384 hard processes, a stack size of approximately 10,240–32,768 KB, and sufficient locked memory for HugePages or database operation; re-login after changing limits.

Creating Oracle Database Vault User Accounts

If Oracle Database Vault is enabled by default, create and configure its required accounts before use. The Database Vault Owner account is mandatory, while a separate Account Manager account may also be created for administration. Database Vault establishes baseline auditing for security configuration, catalog information, system privileges, and Oracle Label Security, and initializes related database parameters with default values.
Read More: Creating Oracle Database Vault User Accounts