|Applies To||RSA Product Set: Identity Governance and Lifecycle|
|Issue||AVUSER and SYS database users are used by RSA Governance and Lifecycle to connect to the Oracle database and are used to perform administrative tasks and troubleshooting.|
Changing the database AVUSER and SYS user passwords requires additional steps (including encrypting the password) and application restart.
If you have a password policy that requires frequent changes to the password as recommended, you may not want to have to change AVUSER and SYS users, but use alternate users to perform admin tasks and troubleshooting.
This solution provides the steps to create an alternate database user for AVUSER and SYS to perform admin task or troubleshooting in Identity Governance and Lifecycle.
An alternative to using SYS user is possible by simply granting the DBA role to the user. An alternative only applicable with SQL*Plus is by using OS authentication, by adding a Linux user into the dba group. Doing this would allow that user to connect to the instance as sysdba by executing the command:
sqlplus /as sysdba .This would eliminate the need to create the extra Oracle account and just allow existing Linux users to get into the instance as SYS without the password. However, this approach is not going to work for remote administration.
An alternative to AVUSER is possible by granting SELECT ANY TABLE privilege to the new user from SYS. It will give that Oracle user the ability to access any table in the database in read-only mode. Such a user’s password can then be managed independently from AVUSER.
Note that granting the new user the existing ACMPROFILE will not help. The concept of Oracle Profile is about limiting resources and not access. For example, we set ACMPROFILE for AVUSER’s password to never expire. So the customer should create their own (probably new) Oracle Profile with password expiration set to the desired period and assign the profile to the user that is allowed to read AVUSER’s objects.
See the screen shots below to see the values for ACMPROFILE as they come out of the box:
To create alternate to SYS user
$ sqlplus "/as sysdba"
CREATE USER <NewUser> IDENTIFIED BY <password>;