ORA-01031 Insufficient Privileges

[chutney374]

HEEEEEELLLLLLLPPPPPPPP

Ok...here's the Saga, of the SAP System, the Basis Consultant and the no SAP sap support contract anymore.

My client is running a 4.6c System ( I know, when dinosaurs walked the earth, this version was old then) on windows 2000, running oracle 8.1.7.3... (stop running away and hiding....cowards

Right problem we have is when running any BRCONNECT commands from the SAP system DB13. I.e. CheckDB.

When we run it we get ORA-01031 insufficient privileges in the log and the checkdb doesn't run.

I’ve checked and compared the SAPUSER table at DB level with PRD and it’s consistent
I’ve checked the privs of all the OPS$ user at OS level and they are also consistent
I’ve checked the OS users SAPService<sid> and <sid>adm and they are all ok
I’ve checked the group assignments in windows all good for the above users
I’ve changed the SAP Services users for SAPoscol and the Sap instance and restarted the QAS system after comparing with PRD. No joy.
I’ve checked the registry, for Authorization entries, it’s clean.
I’ve ensured no SQLNet.or exists in the oracle_home directory.
I’ve read and checked about 30 notes in total, I’ve checked homogeneous upgrade guides for post copy activitieson multiple versions, I’ve re-applied the SAPDBA_ROLE.sql scripts for auths and still nothing flipping works.

I can however run sapdba and do the check manually.

Can anyone suggest something I've missed. I'm stumped....last time I looked at a 4.6c system in anger on 8.1.7.3 was about 12 years ago....so I may be a little rusty...

Please help.... I think I'm going insane because of this problem...

Regards

Paul M.

[QZ]

Hi Paul,

If I think back a decade or more ago, I think I remember something like this, though I don't
remember the solution. (It might have been a kernel, or sapdba patch).

What if you try to run an Oracle trace to get more information on the ORA-01031 error.
What privileges are missing for what user?

You may be able to get around it by granting them on the Oracle level.


QZ

[Zavaros]

hello,

some cloudy ideas (you have permission to laugh at it):
- can you please copy the br* command? .... or sapdba?
- have you tried to login to the database with sqlplus and and manually start/stop database?

... as I remember 8i used "connect internal" instead of modern "connect as sysdba". Maybe a support package or an implemented oss note updated the br* commands.

Regards,

Zav

[chutney374]

I've tried tracelevel 15 for this error. Doesn't actually show me a great deal and nothing for permissions.

I can login to SAPDBA and stop/start Oracle. I can also run the checkdb from the OS. Just not from within SAP.

It's really quiet odd.

Regards

Paul M.

[chutney374]

Right I've just double checked the trace for the DB13 job and it's reporting:

ALTER TABLESPACE PSAPBTABD COALESCE;

Then it immediately fails with ORA-01031 insufficient privs.

As stated though I can run this from sapdba.

Regards

Paul M

[chutney374]

The problem is that the role SAPCONN isn't active in my QAS system.

DEV and PRD users SAPR3 have it.

I've searched the server and the SAPCONN_ROLE.sql isn't available. Can't find it in OSS notes as SAP don't seem to go back to 8.1.7.3 versions of oracle anymore.

"Oh Globbits" Said Burke, when he realised he might be shafted. Channel 5 - Trap Door Stop motion Animation series.

[blueteeth]

SAP Oracle tools (like br* tools) and scripts use OPS$SIDADM and OPS$ORASID mechanism. SAPUSER is used by ABAP engine (R3trans etc & SAP Applications using ABAP workprocesses).

I think the checkdb is calling OPS$SIDADM or OPS$ORASID mechanism.

As an experiment, try assigning dba role to OPS$* users and run checkdb again. There was a role called sapdba inside Oracle which used to perform those functions.

Due to system copies, OPS$ users for relevant system get missing.


connect / as sysdba

select user from dba_users;
(ensure your SID user there).
grant dba to OPS$SIDADM;
commit;
exit

I do not know how MS Windows work (as there is no orasid user at OS level). Perhaps some SERVICE user?

Regards,
BT

[chutney374]

I've checked all of the accounts and their privs in the database. I've checked the Windows user groups and they contain the users required. I've adjusted the windows services.

I've compared PRD and QAS acces and other than SID's the privs are the same.

I can run checkdb from SAPDBA without any issues. WTF is wrong with this system?

I'm logged in as System with SAPDBA rights, but can't work out what user is being used when calling from DB13.

Any ideas?

Regards

Paul M.

[miataboy]

Paul,
I worked with SAP/3.1H/Oracle 7/WIn NT but that was about 13 years ago, I don't remember if you had 2 users as in UNIX but I'm almost sure its the same case.
Can you logon to sqlplus at command prompt, like this??
sqlplus /@qas
qas in this case, being fully qualified in your tnsnames.ora as the alias pointing to your database. You should be able to login with both OS users.
If you cannot, check in your initQAS.ora for parameter remote_os_authent=true and also check if os_authent_prefix applies to your version.
Rgds,
Claudio
PD all cals are done with sap owner from db13, as is the case with all SAP calls to the OS

[miataboy]

Update:
Need to have OS group oper as per note 91216.
Rgds,
Claudio