{"id":1355,"date":"2015-03-02T14:04:32","date_gmt":"2015-03-02T17:04:32","guid":{"rendered":"http:\/\/www.dbarj.com.br\/?p=1355"},"modified":"2015-04-04T12:08:58","modified_gmt":"2015-04-04T15:08:58","slug":"impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault","status":"publish","type":"post","link":"https:\/\/www.dbarj.com.br\/en\/2015\/03\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\/","title":{"rendered":"IMPDP failing with ORA-31625 and ORA-01031: insufficient privileges with Database Vault"},"content":{"rendered":"<p>Those days, I was having a lot of errors during my Import Datapump session in a Oracle 11g with Database Vault environment.<\/p>\n<p>As the schema was protected, first I did the overall check up making sure the user I was using to import had the <strong>DBA<\/strong> permission and I also <span style=\"text-decoration: underline;\">gave it full access to the realm<\/span>.<\/p>\n<p>However, I was receiving a lot of <strong>ORA-31625<\/strong> and <strong>ORA-01031<\/strong> errors in my impdp log file as below:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"oracledb\">ORA-31625: Schema XXX is needed to import this object, but is unaccessible\r\nORA-01031: insufficient privileges<\/pre>\n<p>As a temporary solution, I tried to disable the realm. However, the error persisted.\u00a0Then, I added the granted the user the\u00a0Database Vault-specific authorization by using the\u00a0<strong><code>DBMS_MACADM.AUTHORIZE_DATAPUMP_USER<\/code><\/strong> procedure.\u00a0However, the error still persisted.<\/p>\n<p>After researching a little more, I discover that the cause of the\u00a0failure was that the &#8220;BECOME USER&#8221; system privilege is not granted to DBA or IMP_FULL_DATABASE roles as it is in non Datavault environments.<\/p>\n<p>In fact, when you enable Datavault, the <strong>DBA<\/strong> and\u00a0<strong>IMP_FULL_DATABASE<\/strong> <span style=\"text-decoration: underline;\">lose<\/span> the following privileges:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">DBA:\r\n\tBECOME USER\r\n\tCREATE ANY JOB\r\n\tCREATE EXTERNAL JOB\r\n\tDEQUEUE ANY QUEUE\r\n\tENQUEUE ANY QUEUE\r\n\tEXECUTE ANY CLASS\r\n\tEXECUTE ANY PROGRAM\r\n\tMANAGE ANY QUEUE\r\n\tMANAGE SCHEDULER\r\n\tSELECT ANY TRANSACTION\r\n\r\nIMP_FULL_DATABASE:\r\n\tBECOME USER\r\n\tMANAGE ANY QUEUE<\/pre>\n<p>After granting to the user running import the &#8220;BECOME USER&#8221; privilege, everything started working again =]<\/p>\n<p>In the beginning, the first thing that come to my was that this would be an Oracle Bug. <span style=\"text-decoration: underline;\"><strong>But it&#8217;s not a bug<\/strong><\/span>. Why?<\/p>\n<p>Because Oracle give in his <a href=\"http:\/\/docs.oracle.com\/cd\/E11882_01\/server.112\/e23090\/dba.htm#DVADM70315\">Oficial Documentation<\/a>\u00a0the exactly steps that should be done if you want to run expdp\/impdp in a DV environment:<\/p>\n<ul>\n<li><span class=\"bold\">Users who import data into another schema must have the <strong>BECOME USER<\/strong> system privilege.<\/span> To find the privileges a user has been granted, query the\u00a0<code>USER_SYS_PRIVS<\/code> data dictionary view.<\/li>\n<li><span class=\"bold\">A database administrator wants to export or import data in a schema that <span style=\"text-decoration: underline;\">has <strong>no<\/strong> realm protection<\/span>.<\/span> In this case, this user only needs the standard Oracle Data Pump privileges, not the Oracle Database Vault authorization.<\/li>\n<li><span class=\"bold\">A database administrator wants to export or import data in a protected schema.<\/span> You must grant this user Database Vault-specific authorization by using the\u00a0<strong><code>DBMS_MACADM.AUTHORIZE_DATAPUMP_USER<\/code><\/strong> procedure. This authorization applies to both the <strong><code>EXPDP<\/code><\/strong> and <strong><code>IMPDP<\/code><\/strong> utilities. Later on, you can revoke this authorization by using the <code>DBMS_MACADM.UNAUTHORIZE_DATAPUMP_USER<\/code> procedure.<\/li>\n<li><span class=\"bold\">A database administrator wants to export or import the contents of an entire database.<\/span> In addition to the authorization granted by the\u00a0<code>DBMS_MACADM.AUTHORIZE_DATAPUMP_USER<\/code> procedure, you must grant this user the <code>DV_OWNER<\/code> role. For the <strong>import<\/strong> operation, this user must have the\u00a0<strong><code>BECOME USER<\/code><\/strong> privilege.<\/li>\n<\/ul>\n<p>So, the all that I needed was to execute the steps 1 and 3. The user that runs impdp doesn&#8217;t need to be part of the realm, neither is necessary to disable it.<\/p>\n<p>Everything is now working correctly, and one more exception in my list for future cases.<\/p>\n<b>Have you enjoyed? Please leave a comment or give a \ud83d\udc4d!<\/b>\n<div class='watch-action'><div class='watch-position align-left'><div class='action-like'><a class='lbg-style2 like-1355 jlk' href='javascript:void(0)' data-task='like' data-post_id='1355' data-nonce='de4404f630' rel='nofollow'><img class='wti-pixel' src='https:\/\/www.dbarj.com.br\/wp-content\/plugins\/wti-like-post\/images\/pixel.gif' title='Like' \/><span class='lc-1355 lc'>+27<\/span><\/a><\/div><\/div> <div class='status-1355 status align-left'><\/div><\/div><div class='wti-clear'><\/div>","protected":false},"excerpt":{"rendered":"<p>Those days, I was having a lot of errors during my Import Datapump session in a Oracle 11g with Database Vault environment. As the schema was protected, first I did the overall check up making sure the user I was using to import had the DBA permission and I also gave it full access to &hellip; <\/p>\n<p><a class=\"more-link btn\" href=\"https:\/\/www.dbarj.com.br\/en\/2015\/03\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\/\">Continue reading<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,15],"tags":[],"class_list":["post-1355","post","type-post","status-publish","format-standard","hentry","category-security-en","category-database-en","item-wrap"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>IMPDP failing with ORA-31625 and ORA-01031: insufficient privileges with Database Vault - DBA - Rodrigo Jorge - Oracle Tips and Guides<\/title>\n<meta name=\"description\" content=\"How to resolve the IMPDP failing with ORA-31625 and ORA-01031 in a Data Vault Environment\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbarj.com.br\/en\/2015\/03\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"DBA RJ\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2015\\\/03\\\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2015\\\/03\\\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\\\/\"},\"author\":{\"name\":\"DBA RJ\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/#\\\/schema\\\/person\\\/28a44ca3a6633fe4156ad1ea209d40a9\"},\"headline\":\"IMPDP failing with ORA-31625 and ORA-01031: insufficient privileges with Database Vault\",\"datePublished\":\"2015-03-02T17:04:32+00:00\",\"dateModified\":\"2015-04-04T15:08:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2015\\\/03\\\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\\\/\"},\"wordCount\":437,\"commentCount\":3,\"publisher\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/#\\\/schema\\\/person\\\/28a44ca3a6633fe4156ad1ea209d40a9\"},\"articleSection\":[\"Database Security\",\"Oracle Database General\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2015\\\/03\\\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2015\\\/03\\\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\\\/\",\"url\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2015\\\/03\\\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\\\/\",\"name\":\"IMPDP failing with ORA-31625 and ORA-01031: insufficient privileges with Database Vault - DBA - Rodrigo Jorge - Oracle Tips and Guides\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/#website\"},\"datePublished\":\"2015-03-02T17:04:32+00:00\",\"dateModified\":\"2015-04-04T15:08:58+00:00\",\"description\":\"How to resolve the IMPDP failing with ORA-31625 and ORA-01031 in a Data Vault Environment\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2015\\\/03\\\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2015\\\/03\\\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2015\\\/03\\\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"IMPDP failing with ORA-31625 and ORA-01031: insufficient privileges with Database Vault\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/\",\"name\":\"DBA - Rodrigo Jorge - Oracle Tips and Guides\",\"description\":\"Blog about Databases, Security and High Availability\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/#\\\/schema\\\/person\\\/28a44ca3a6633fe4156ad1ea209d40a9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/#\\\/schema\\\/person\\\/28a44ca3a6633fe4156ad1ea209d40a9\",\"name\":\"DBA RJ\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2019\\\/09\\\/RodrigoJorgePOUG19.png\",\"url\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2019\\\/09\\\/RodrigoJorgePOUG19.png\",\"contentUrl\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2019\\\/09\\\/RodrigoJorgePOUG19.png\",\"width\":712,\"height\":712,\"caption\":\"DBA RJ\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2019\\\/09\\\/RodrigoJorgePOUG19.png\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"IMPDP failing with ORA-31625 and ORA-01031: insufficient privileges with Database Vault - DBA - Rodrigo Jorge - Oracle Tips and Guides","description":"How to resolve the IMPDP failing with ORA-31625 and ORA-01031 in a Data Vault Environment","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbarj.com.br\/en\/2015\/03\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\/","twitter_misc":{"Written by":"DBA RJ","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbarj.com.br\/en\/2015\/03\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\/#article","isPartOf":{"@id":"https:\/\/www.dbarj.com.br\/en\/2015\/03\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\/"},"author":{"name":"DBA RJ","@id":"https:\/\/www.dbarj.com.br\/en\/#\/schema\/person\/28a44ca3a6633fe4156ad1ea209d40a9"},"headline":"IMPDP failing with ORA-31625 and ORA-01031: insufficient privileges with Database Vault","datePublished":"2015-03-02T17:04:32+00:00","dateModified":"2015-04-04T15:08:58+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbarj.com.br\/en\/2015\/03\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\/"},"wordCount":437,"commentCount":3,"publisher":{"@id":"https:\/\/www.dbarj.com.br\/en\/#\/schema\/person\/28a44ca3a6633fe4156ad1ea209d40a9"},"articleSection":["Database Security","Oracle Database General"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbarj.com.br\/en\/2015\/03\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbarj.com.br\/en\/2015\/03\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\/","url":"https:\/\/www.dbarj.com.br\/en\/2015\/03\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\/","name":"IMPDP failing with ORA-31625 and ORA-01031: insufficient privileges with Database Vault - DBA - Rodrigo Jorge - Oracle Tips and Guides","isPartOf":{"@id":"https:\/\/www.dbarj.com.br\/en\/#website"},"datePublished":"2015-03-02T17:04:32+00:00","dateModified":"2015-04-04T15:08:58+00:00","description":"How to resolve the IMPDP failing with ORA-31625 and ORA-01031 in a Data Vault Environment","breadcrumb":{"@id":"https:\/\/www.dbarj.com.br\/en\/2015\/03\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbarj.com.br\/en\/2015\/03\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbarj.com.br\/en\/2015\/03\/impdp-failing-with-ora-31625-and-ora-01031-insufficient-privileges-with-database-vault\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.dbarj.com.br\/en\/"},{"@type":"ListItem","position":2,"name":"IMPDP failing with ORA-31625 and ORA-01031: insufficient privileges with Database Vault"}]},{"@type":"WebSite","@id":"https:\/\/www.dbarj.com.br\/en\/#website","url":"https:\/\/www.dbarj.com.br\/en\/","name":"DBA - Rodrigo Jorge - Oracle Tips and Guides","description":"Blog about Databases, Security and High Availability","publisher":{"@id":"https:\/\/www.dbarj.com.br\/en\/#\/schema\/person\/28a44ca3a6633fe4156ad1ea209d40a9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbarj.com.br\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.dbarj.com.br\/en\/#\/schema\/person\/28a44ca3a6633fe4156ad1ea209d40a9","name":"DBA RJ","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2019\/09\/RodrigoJorgePOUG19.png","url":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2019\/09\/RodrigoJorgePOUG19.png","contentUrl":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2019\/09\/RodrigoJorgePOUG19.png","width":712,"height":712,"caption":"DBA RJ"},"logo":{"@id":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2019\/09\/RodrigoJorgePOUG19.png"}}]}},"_links":{"self":[{"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/posts\/1355","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/comments?post=1355"}],"version-history":[{"count":0,"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/posts\/1355\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/media?parent=1355"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/categories?post=1355"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/tags?post=1355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}