Apprenda Off-Platform Oracle 12c Guide for Username Changes

Size: px

Start display at page:

Download "Apprenda Off-Platform Oracle 12c Guide for Username Changes"

Kathryn Barrett
5 years ago
Views:

1 Apprenda Off-Platform Oracle 12c Guide for Username Changes Last Updated for Apprenda version The Apprenda Platform version introduces support for guest applications that use Oracle 12c. In addition, this version of the Platform supports the following: The ability for Platform Operators to update guest applications that use Oracle 12c to connect to a Pluggable Database (PDB) also called a "storage partition" in Apprenda terminology hosted on an off-platform Oracle server. Controls for disabling Platform creation of user grants for on-platform Oracle 12c storage partitions. Although the functionality above is explained in our product documentation, some use-cases also requires the following modifications to Apprenda s Oracle 12c support: Changing the name of the owner/patching user and the tenant/runtime user from the defaults created by the Platform for each Oracle 12c storage partition. This guide provides installation and configuration instructions for Oracle 12c support on the Apprenda Platform that is specific to use-cases in which usernames are changed when storage partitions are moved off-platform. The scope of this guide has been tailored to the present use-case; it is therefore limited to information on installation and configuration that is specific to the use-case. When appropriate, relevant links to supplemental general Apprenda product documentation have been provided. Contents 1. Platform Operator: Update the oracle12c_admin.sql script before the Platform is installed Platform Operator: Turn off implicit auto-grants Developers: Update application archives to create grants Developers: Publish guest applications and onboard tenants DBA: Prepare the off-platform Oracle 12c servers Platform Operator: Update connection information... 5

2 2 1. PLATFORM OPERATOR: U PDATE THE ORACLE12C_ADMIN.SQL SCRIPT BEFORE THE PLATFORM I S INSTALLED All Platform and Oracle 12c pre-requisites listed in the Pre-Installation Checklist should be met before beginning installation. In addition, before launching the Apprenda Installer, locate the oracle12c_admin.sql script in the Binaries>Oracle folder of your installation package. Copy the script locally and make the following alterations as needed: Add the following lines immediately before CREATE_PDB swaps back to CDB: execute immediate 'create or replace function DEFAULT_SCHEMA.APPRENDATENANT RETURN VARCHAR2 IS BEGIN RETURN(''TENANT''); END;'; These lines will modify on-platform Oracle servers to provide a way for scripts to detect the current tenant/runtime user and owner/patching user. Once this change has been made to the oracle12c_admin.sql script, replace the script in the installation package with your updated script. You may now run the Apprenda Installer. 2. PLATFORM OPERATOR: TURN OFF IMPLICIT AUTO-GRANTS Automatic grant creation for on-platform storage partitions should be disabled: A. Navigate to the Platform Registry Settings section of the SOC. B. Set the value of the DB.GrantSchemaAccessIn12C setting to False. 3. DEVELOPERS: UPDATE APPLICATION AR CHIVES TO CREATE GRANTS For each guest application that will use Oracle 12c, developers must update the application provisioning script included in the archive to create the needed grants. The needed grants must be created for each object the client may access (e.g., each table, view, function, procedure, etc.). The example below shows the grant creation for four separate sample objects (MY_TABLE, OTHER_TABLE, SOME_FUNCTION, and SOME_PROC):

3 declare V_TENANT varchar2(50); begin V_TENANT := APPRENDATENANT(); execute immediate 'grant select, insert, update, delete on MY_TABLE to ' V_TENANT; execute immediate 'grant select, insert, delete

3 3 declare V_TENANT varchar2(50); begin V_TENANT := APPRENDATENANT(); execute immediate 'grant select, insert, update, delete on MY_TABLE to ' V_TENANT; execute immediate 'grant select, insert, delete on OTHER_TABLE to ' V_TENANT; end; execute immediate 'grant execute on SOME_FUNCTION to ' V_TENANT; execute immediate 'grant execute on SOME_PROC to ' V_TENANT; The execute statements modeled above rely on both the pre-installation changes made to the oracle12c_admin.sql described in section 1 above and the off-platform Oracle server configuration steps described below in section 5. It should be noted that the method for creating grants in the example above differs from the example in our product documentation at the example shown above has been modified to accommodate the requirement to change the usernames from the Platform defaults of DEFAULT_SCHEMA and TENANT when moving storage partitions off the Platform. Otherwise, developers should take note of the information provided in the product documentation for Oracle 12c PDBs (including the required rollback scripts and corresponding Deployment Manifest references required for patched application versions). 4. DEVELOPERS: PUBLISH GUEST APPLICATIONS AND ONBOARD TENANTS Developers can now publish guest applications created using the archive(s) prepared in step 3 and onboard tenants to the application. When a tenant is onboarded to the application, Apprenda will create a corresponding storage partition/pdb on an on-platform Oracle 12c server in accordance with the application provisioning script. 5. DBA: PREPARE THE OFF-PLATFORM ORACLE 12C SERVERS DBAs may move/copy on-platform PDBs to off-platform Oracle 12c servers or they may choose to recreate the PDBs on the off-platform servers if no tenant data has been created yet by end users. For the present use-case (in which usernames are changed), recreating the storage partitions/pdbs is recommended. Controls in the SOC (as described in section 6 below) will allow the Platform Operator to re-run the application provisioning script for each storage partition/pdb, which will recreate all objects

4 4 and create all necessary user grants for the new tenant/runtime user in the off-platform storage partition. If a PDB cannot be recreated and must be moved or copied, the DBA must ensure that the grants needed by the new tenant/runtime user are properly created and applied. For both the move/copy and the recreation options, the following are required: A. Each storage partition/pdb that will be moved off-platform requires the following: Two users: o Owner/Patching: this is going to 'house' the objects Permissions (GRANTS/roles) for all the activities that may occur in the schema scripts. create/alter/drop of tables, views, triggers, type, sequence procedures, etc can all be expected but can also be fine-tuned to the app. Permission(s) required to log on (create session). Allowed space allocations as needed by the app for the app's data. o Tenant/Runtime: this will be used by the app to access those objects (corresponds to the &OOBTenant placeholder below) Permission(s) required to log on (create session). There are no Platform requirements for such, but you may need additional permission(s) / space as needed by any prep-scripts which run as this user. A method for the tenant to 'see' the objects, namely: explicit synonyms or a logon trigger to switch current schema. Allowed space allocations as needed by the app for the two users. B. In addition, part of the preparation for each partition should include running the following script: CREATE OR REPLACE FUNCTION APPRENDATENANT RETURN VARCHAR2 IS BEGIN RETURN('&OOBTenant'); END; /

5 5 6. PLATFORM OPERATOR: UPDATE CONNECTION INFORMATION Once the PDBs on the off-platform Oracle servers have been prepared, the connection information for the PDBs created on-platform in step 4 must be updated to point to the appropriate off-platform PDB as outlined at User and connection string information should be updated as appropriate for the targeted off-platform PDB. Once the Connection String field is altered, a Re-run Provisioning Scripts checkbox will appear. If the off-platform PDBs have been moved or copied, do NOT check this box, as doing so will result in an error and possible data loss/corruption. If the off-platform PDBs are being recreated, check this box before hitting Save. It will run the application provisioning script on the new, off-platform PDB, thereby recreating all database objects (and creating all necessary grants for the new tenant/runtime user).

Pre-Installation Checklist for Installing the Cloud Platform on Multiple Servers

Pre-Installation Checklist for Installing the Cloud Platform on Multiple Servers Last Updated for Apprenda 7.0.0 Before beginning your Platform installation, make sure that you have fulfilled these requirements