标题: ORA-01031: Insufficient Privileges When Cloning PDB - After Applying Oct 2018... [打印本页] 作者: 刘泽宇 时间: 2024-6-30 17:31 标题: ORA-01031: Insufficient Privileges When Cloning PDB - After Applying Oct 2018... 现象：
After applying the Oct 2018 patchset, client is no longer able to create a pluggable from a database link.
The process executed by the client had been working for over two years:
1. CREATE DATABASE LINK "<dblink_name>" CONNECT TO SYSTEM IDENTIFIED BY "<password>" USING 'service';
2. SELECT * FROM DUAL@<dblink_name>;
3. CREATE PLUGGABLE DATABASE pdb_name FROM db_source@<dblink_name> KEYSTORE IDENTIFIED BY "<password>" STANDBYS=NONE;
It immediately comes back with the following error:
ORA-17628: Oracle error 1031 returned by remote Oracle server
ORA-01031: insufficient privileges
ORA-06512: at line 19
ORA-01403: no data found
ORA-06512: at line 5
CHANGES
Applied patch Oct 2018 critical patch update over 12.2.0.1
原因：
This is a privilege issue after applying OCT 2018 critical patch update. The problem is happening even though the Source DB user has the DBA role.
This was enough and was working fine before applying the patch.
After the patch was applied, the DBA role is no longer sufficient for cloning a database over network link.
处理方法：
NOTE: In the images and/or the document content below, the user information and data used represents fictitious data from the Oracle sample schema(s) or Public Documentation delivered with an Oracle database product. Any similarity to actual persons, living or dead, is purely coincidental and not intended in any manner.
Connect directly to the source PDB and execute the statement "grant create pluggable database" directly to the user (not a role), and then connect to the target CDB and set explicitly using "grant create pluggable database to ... container = all" to the source database user.
i.e. SYSTEM is the source database user:
-- on source, connect to the source PDB ....
sqlplus / as sysdba -- connects to CDB
alter session set container = <pdb_name>
grant create pluggable database to system;
-- on target connect to the CDB
sqlplus / as sysdba
grant create pluggable database to system container=all;
The issue is SYSTEM should have this privilege, but in this case you have to grant it explicitly