Oracle Security in CDBs and PDBs - OCP: Oracle Database 12c Administrator Certified Professional - page 625

We'll discuss in detail how to create common and local users and provide several examples.
A user privilege is the authority or right to run a PL/SQL package, a particular type of
SQL statement, or access an object that belongs to another user. Privileges can be granted
to common or local users.
A role is a named group of privileges and/or other roles that are created by administrators
or other users. Roles simplify the administration of privileges for individuals and groups of
users. We'll explore roles in detail later in this chapter.

Managing Common and Local Users

In the multitenant environment, a user is either a common user, which has access to all
containers in the CDB, or a local user, which has access only to the PDB in which it was
created. In the context of a CDB, the word common is used to indicate that some entity
is common to all containers. In this context, local means that an entity is restricted to
exactly one container.
Common Users A common user is a database user who has the same username and
password in the root and in every PDB in the CDB.
Local Users A local user is defined in a PDB and does not have access to the CDB$ROOT or
other PDBs, very much like a user in a non-CDB.
In this section, we will explain the difference between common and local user accounts
in the multitenant environment. We will describe how to create users and provide examples.
We will discuss the current container and scope. We will also provide examples of altering
common and local users.

In Chapter 11, “Introduction to and Creation of Oracle Multitenant Data-
bases,” we demonstrate how to create CDBs and PDBs. The exercises in
this chapter assume that you have created a CDB and PDBs.

The Common Users in a CDB
A common user is a CDB user that has the same identity in CDB$ROOT and in all PDBs and
can connect to and perform operations in the root and in any PDB where they have CREATE
SESSION privileges. SYS and SYSTEM , as well as the other Oracle-supplied administrative
accounts, are examples of common users that are created with each CDB. A common user
has the following characteristics:

Other than Oracle-supplied administrative accounts, the username begins with the
characters c## or C## .

■

The username contains only ASCII or EBCDIC characters.

■

The user resides in the root and uses the same identity to connect to every PDB.

■

The schema associated with a common user can be different in each PDB.

■