Using Database Vault to implement that administrators cannot view data

In this recipe, you will use multiple components (realms, command rules, and rule sets) to secure data in database from administrators.

How to do it...

1. Connect to the pluggable database PDB1 as the user c##dbv_acctmgr:

   SQL> connect c##dbv_acctmgr@pdb1
   SQL> create user orders_dba identified by oracle1;
   SQL> create user orders_user identified by oracle2;
   

2. Connect to the pluggable database PDB1 as a SYS user and execute the following statements:

   SQL> connect sys@pdb1 as sysdba
   SQL> grant dba to orders_dba;
   SQL> grant create session to orders_user;
   SQL> grant select on oe.orders to orders_user;
   SQL> grant update on oe.orders to orders_user;
   SQL> create role ord_usr_role;
   SQL> grant ord_usr_role to orders_user;
   

3. Create a realm that protects all objects in OE schema and authorize user orders_dba as owner (for detailed explanation on creating realms, see recipe Preventing users from exercising system...