Realm violation Datapatch 禁用DBV database vault

Datapatch failed with the error ORA-47410: Realm violation for CREATE ROLE (Doc ID 2306010.1)

编辑To Bottom

APPLIES TO:

Oracle Database - Enterprise Edition - Version 12.1.0.2 and later
Oracle Database Cloud Schema Service - Version N/A and later
Oracle Database Exadata Cloud Machine - Version N/A and later
Oracle Cloud Infrastructure - Database Service - Version N/A and later
Oracle Database Cloud Exadata Service - Version N/A and later
Information in this document applies to any platform.

SYMPTOMS

Datapatch failed with the below error

[oragpe6@hostname OPatch]$ ./datapatch -verbose
SQL Patching tool version 12.1.0.2.0 Production on Sun Sep 10 19:42:03 2017
Copyright (c) 2012, 2017, Oracle. All rights reserved.

Log file for this invocation: /u01/app/oracle/cfgtoollogs/sqlpatch/sqlpatch_175757_2017_09_10_19_42_03/sqlpatch_invocation.log

Connecting to database...OK
Bootstrapping registry and package to current versions...done
Determining current state...done

Current state of SQL patches:
Patch 19282028 (Database PSU 12.1.0.2.1, Oracle JavaVM Component ():
Not installed in the binary or the SQL registry
Patch 19877336 (Database PSU 12.1.0.2.2, Oracle JavaVM Component (Jan2015)):
Not installed in the binary or the SQL registry
Patch 22139226 (Database PSU 12.1.0.2.160119, Oracle JavaVM Component (Jan2016)):
Installed in the binary registry and the SQL registry
Patch 23321125 (DPLOAD DOESN'T CREATE THE SHARED OBJECTS ACROSS ALL PDBS):
Installed in the binary registry and APPLY with errors in the SQL registry
Bundle series DBBP:
ID 170814 in the binary registry and ID 170814 with errors in the SQL registry

Adding patches to installation queue and performing prereq checks...
Installation queue:
Nothing to roll back
The following patches will be applied:
  26609798 (DATABASE BUNDLE PATCH 12.1.0.2.170814)
  23321125 (DPLOAD DOESN'T CREATE THE SHARED OBJECTS ACROSS ALL PDBS)

Installing patches...
Patch installation complete. Total patches installed: 2

Validating logfiles...
Patch 26609798 apply: WITH ERRORS
logfile: /u01/app/oracle/cfgtoollogs/sqlpatch/26609798/21481992/26609798_apply_D_IN02_2017Sep10_19_42_36.log (errors)
  Error at line 14778: ORA-47410: Realm violation for CREATE ROLE on DV_SECANALYST
  Error at line 14795: ORA-47410: Realm violation for CREATE ROLE on DV_MONITOR
  Error at line 14812: ORA-47410: Realm violation for CREATE ROLE on DV_ADMIN
  Error at line 14828: ORA-47410: Realm violation for CREATE ROLE on DV_OWNER
  Error at line 14844: ORA-47410: Realm violation for CREATE ROLE on DV_ACCTMGR
  Error at line 14860: ORA-47410: Realm violation for CREATE ROLE on DV_PUBLIC

CHANGES

Apply JULY 2017 BP 170718

CAUSE

Oracle Database Vault is enabled for the database

Oracle database vault is set to true

SQL> SELECT VALUE FROM V$OPTION WHERE PARAMETER = 'Oracle Database Vault';

VALUE
----------------------------------------------------------------
TRUE

SOLUTION

Disable the database vault manually at the database level

1). In SQL*Plus, log in as the Oracle Database Owner (DBV_OWNER) account, and then disable Oracle Database Vault.

sqlplus /as sysdba
SQL> select username from dba_users where username like '%DBV_OWNER%';

USERNAME
--------------------------------------------------------------------------------
DBV_OWNER

sqlplus DBV_OWNER/password
Disable the vault

SQL> EXEC DBMS_MACADM.DISABLE_DV;
SQL> SELECT VALUE FROM V$OPTION WHERE PARAMETER = 'Oracle Database Vault';

2). Restart the database to get the database vault disable
sqlplus /as sysdba
SQL> SHUTDOWN IMMEDIATE
SQL> STARTUP
SQL> SELECT VALUE FROM V$OPTION WHERE PARAMETER = 'Oracle Database Vault';

3). Run the database patch and datapatch went through successful.

bash-4.1$ ./datapatch -verbose
SQL Patching tool version 12.1.0.2.0 Production on Sun Sep 10 22:49:20 2017
Copyright (c) 2012, 2017, Oracle. All rights reserved.

Log file for this invocation: /u01/app/oracle/cfgtoollogs/sqlpatch/sqlpatch_77767_2017_09_10_22_49_20/sqlpatch_invocatio

Connecting to database...OK
Bootstrapping registry and package to current versions...done
Determining current state...done

Current state of SQL patches:
Patch 19877336 (Database PSU 12.1.0.2.2, Oracle JavaVM Component (Jan2015)):
Not installed in the binary or the SQL registry
Patch 22139226 (Database PSU 12.1.0.2.160119, Oracle JavaVM Component (Jan2016)):
Installed in the binary registry and the SQL registry
Patch 23321125 (DPLOAD DOESN'T CREATE THE SHARED OBJECTS ACROSS ALL PDBS):
Installed in the binary registry and APPLY with errors in the SQL registry
Bundle series DBBP:
ID 170814 in the binary registry and ID 170814 with errors in the SQL registry

Adding patches to installation queue and performing prereq checks...
Installation queue:
Nothing to roll back
The following patches will be applied:
26609798 (DATABASE BUNDLE PATCH 12.1.0.2.170814)
23321125 (DPLOAD DOESN'T CREATE THE SHARED OBJECTS ACROSS ALL PDBS)

Installing patches...
Patch installation complete. Total patches installed: 2

Validating logfiles...
Patch 26609798 apply: SUCCESS
logfile: /u01/app/oracle/cfgtoollogs/sqlpatch/26609798/21481992/26609798_apply_D_ISIS_2017Sep10_22_49_53.log (no error
Patch 23321125 apply: SUCCESS
logfile: T23321125_apply_D_ISIS_2017Sep10_22_50_44.log (no errors)
SQL Patching tool complete on Sun Sep 10 22:55:29 2017
bash-4.1$

4). Enable the database vault back

sqlplus DBV_OWNER/password
Enable the vault

SQL>EXEC DBMS_MACADM.ENABLE_DV;

Restart the database to get the database vault enabled
sqlplus /as sysdba
SQL> SHUTDOWN IMMEDIATE
SQL> STARTUP
SQL> SELECT VALUE FROM V$OPTION WHERE PARAMETER = 'Oracle Database Vault';