1. Cloud Control Security Guide
  2. Security Best Practices for Database Management in Enterprise Manager
  3. Flexible Database Access Control
  4. Application Developer Access

Application Developer Access

Application developers generally work on their development environments and have full access to their development databases. Application developers are not usually granted access to the production databases. However they might need access to a production database to see performance of application queries in a production environment. The access of the application developer to a production database must be READ ONLY access. Application developers should not be allowed to make any changes to the database. The application developer's access to a production database should be liberal enough to allow the developer to access performance management reports for a production database.

An Enterprise Manager administrator with the user management or grants management resource type privilege can grant application developer access on a database to an Enterprise administrator in Oracle Enterprise Manager 13c.

Granting Application Developer Access on the Database

To grant application developer access on the database, follow the instructions in "Creating a New Administrator" to create an Enterprise Manager administrator then grant the privilege Database Application Developer on the database.

Granting Application Developer Access to the Database Named Credentials

To access database management performance management pages the user must log in to the database using database named credentials. An application DBA should grant view credential access on a database named credential to the application developer in Enterprise Manager. The database named credential should have at least the SELECT_CATALOG_ROLE role on the database.

The application developer must not be given the user's password. The application developer should not be granted view access on the host, or any database host named credential.

The application developer account created in this way in Enterprise Manager will be able to view only the Performance Management and Schema Management pages in Enterprise Manager. The user will not be able to make any changes to the database.