My new OEM 13c system has been having lots of issues, I have multiple bugs registered with oracle. This one is particularly odd, trying to create a new user I get an LDAP error
The user actually does get created, but when I try to assign additional privileges to the user I get the error again, and this time it doesn’t actually add them.
The kicker is, I am not using LDAP, the user is created as an internal user, no single sign on!
I am trying to give a user access to the performance page, so off to emcli!!
I need to find the privileges related to the performance tab. It’s better to copy and paste these since they are case sensitive.
$ emcli get_supported_privileges | grep -i perf PERFORM_OPERATION_AS_ANY_AGENT Resource Type TARGET DB_PERFSQL_OPT_ADMIN Resource TARGET ENTITY_GUID TARGET_NAME:TARGET_TYPE PERFORM_OPERATION Resource TARGET ENTITY_GUID TARGET_NAME:TARGET_TYPE DB_PERFORMANCE_HOME_VIEW Resource TARGET ENTITY_GUID TARGET_NAME:TARGET_TYPE DB_PERFORMANCE_ADMIN Resource TARGET ENTITY_GUID TARGET_NAME:TARGET_TYPE DB_PERFSQL_OPT_CONSOLE_VIEW Resource TARGET ENTITY_GUID TARGET_NAME:TARGET_TYPE PERFORM_OPERATION_ANYWHERE Resource Type TARGET DB_PERFORMANCE_VIEW Resource TARGET ENTITY_GUID TARGET_NAME:TARGET_TYPE PERFORM_OPERATION_AS_AGENT Resource TARGET ENTITY_GUID TARGET_NAME:TARGET_TYPE
I want to give myUser DB_PERFORMANCE_VIEW and DB_PERFORMANCE_HOME_VIEW. I have my databases assigned to groups, so lets do that grant
emcli grant_privs -name="myUser" -privilege="DB_PERFORMANCE_HOME_VIEW;TARGET_NAME=Dev:TARGET_TYPE=group" emcli grant_privs -name="myUser" -privilege="DB_PERFORMANCE_VIEW;TARGET_NAME=Dev:TARGET_TYPE=group" emcli modify_group -name="Dev" -privilege_propagation=true
I looped through my dev/test/prod groups
Checking inside OEM, the grants are now in place
I don’t understand what OEM is doing though the web interface that is difference from using emcli. I had another issue deploying plugins using the web interface. I was able to deploy them with emcli. I will have a post on that soon.