Creating and Granting Privileges to a Virtual Private Catalog Owner

This section assumes that you created the base recovery catalog.

Assume that the following databases are registered in the base recovery catalog: prod1, prod2, and prod3. The database user who owns the base recovery catalog is catowner. You want to create database user vpc1 and grant this user access privileges only to prod1 and prod2. By default, a virtual private catalog owner has no access to the base recovery catalog.

To create and grant privileges to a virtual private catalog owner:

1. Start SQL*Plus and connect to the recovery catalog database with administrator privileges.

2. If the user that will own the virtual private catalog does not exist, then create the user.

   For example, if you want to create database user vpc1 to own the catalog, then you could execute the following command (replacing password with a user-defined password):

   SQL> CREATE USER vpc1 IDENTIFIED BY password
     2  DEFAULT TABLESPACE vpcusers
     3  QUOTA UNLIMITED ON vpcusers;
   

   Note:

   Create a password that is secure. See Oracle Database Security Guide for more information.

3. Grant the RECOVERY_CATALOG_OWNER role to the database user that will own the virtual private catalog, and then exit SQL*Plus.

   The following example grants the role to user vpc1:

   SQL> GRANT recovery_catalog_owner TO vpc1;
   SQL> EXIT;
   

4. Start RMAN and connect to the recovery catalog database as the base recovery catalog owner (not the virtual private catalog owner).

   The following example connects to the base recovery catalog as catowner:

   % rman
   RMAN> CONNECT CATALOG catowner@catdb;
   
   recovery catalog database Password: password
   connected to recovery catalog database
   

5. Grant desired privileges to the virtual private catalog owner.

   The following example gives user vpc1 access to the metadata for prod1 and prod2 (but not prod3):

   RMAN> GRANT CATALOG FOR DATABASE prod1 TO vpc1;
   RMAN> GRANT CATALOG FOR DATABASE prod2 TO vpc1;
   

   You can also use a DBID rather than a database name. The virtual private catalog user does not have access to the metadata for any other databases registered in the recovery catalog.

   You can also grant the user the ability to register new target databases in the recovery catalog. For example:

   RMAN> GRANT REGISTER DATABASE TO vpc1;
   

Creating a Virtual Private Catalog

This section assumes that the virtual private catalog owner has been given the RECOVERY_CATALOG_OWNER database role. Also, the base recovery catalog owner used the GRANT command to give the virtual private catalog owner access to metadata in the base recovery catalog.

To create a virtual private catalog:

1. Start RMAN and connect to the recovery catalog database as the virtual private catalog owner (not the base recovery catalog owner).

   The following example connects to the recovery catalog as vpc1:

   % rman
   RMAN> CONNECT CATALOG vpc1@catdb;
   

2. Create the virtual private catalog.

   The following command creates the virtual private catalog:

   RMAN> CREATE VIRTUAL CATALOG;
   

3. If you intend to use a 10.2 or earlier release of RMAN with this virtual private catalog, then execute the following PL/SQL procedure (wherebase_catalog_owner is the database user who owns the base recovery catalog):

   SQL> EXECUTE base_catalog_owner.DBMS_RCVCAT.CREATE_VIRTUAL_CATALOG;
   

Revoking Privileges from a Virtual Private Catalog Owner

This section assumes that you have created a virtual private catalog.

Assume that two databases are registered in the base recovery catalog: prod1 and prod2. As owner of the base recovery catalog, you have granted the vpc1user access privileges to prod1. You have also granted this user the right to register databases in his virtual private catalog. Now you want to revoke privileges from vpc1.

To revoke privileges from a virtual private catalog owner:

1. Start RMAN and connect to the recovery catalog database as the recovery catalog owner (not the virtual private catalog owner).

   The following example connects to the recovery catalog as catowner:

   % rman
   RMAN> CONNECT CATALOG catowner@catdb;
   

2. Revoke specified privileges from the virtual private catalog owner.

   The following command revokes access to the metadata for prod1 from virtual private catalog owner vpc1:

   REVOKE CATALOG FOR DATABASE prod1 FROM vpc1;
   

   You can also specify a DBID rather than a database name. The catalog vpc1 retains all other granted catalog privileges.

   You can also revoke the privilege to register new target databases in the recovery catalog. For example:

   REVOKE REGISTER DATABASE FROM vpc1;
   

Dropping a Virtual Private Catalog

This section assumes that you have created a virtual private catalog and now want to drop it. When you drop a virtual private catalog, you do not remove the base recovery catalog itself, but only drop the synonyms and views that refer to the base recovery catalog.

To drop a virtual private catalog:

1. Start RMAN and connect to the recovery catalog database as the virtual private catalog owner (not the base recovery catalog owner).

   The following example connects to the recovery catalog as user vpc1:

   % rman
   RMAN> CONNECT CATALOG vpc1@catdb;
   

2. Drop the catalog.

   If you are using an Oracle Database 11g or later RMAN executable, then drop the virtual private catalog with the DROP CATALOG command:

   RMAN> DROP CATALOG;
   

   If you are using an Oracle Database 10g or earlier RMAN executable, then you cannot use the DROP CATALOG command. Instead, connect SQL*Plus to the catalog database as the virtual private catalog user, then execute the following PL/SQL procedure (where base_catalog_owner is the database user who owns the base recovery catalog):

   SQL> EXECUTE base_catalog_owner.DBMS_RCVCAT.DELETE_VIRTUAL_CATALOG;

   
   
   来源： <http://docs.oracle.com/cd/E11882_01/backup.112/e10642/rcmcatdb.htm#BRADV89662>