CREATE USER

Purpose

Use the CREATE USER statement to create and configure a database user, or an account through which you can log in to the database and establish the means by which Oracle permits access by the user.

Prerequisites

You must have CREATE USER system privilege. When you create a user with the CREATE USER statement, the user's privilege domain is empty. To log on to Oracle, a user must have CREATE SESSION system privilege. Therefore, after creating a user, you should grant the user at least the CREATE SESSION privilege.

Syntax

create_user::=

Text description of create_user

Semantics

user

Specify the name of the user to be created. This name can contain only characters from your database character set and must follow the rules described in the section "Schema Object Naming Rules". Oracle recommends that the user name contain at least one single-byte character regardless of whether the database character set also contains multibyte characters.

IDENTIFIED Clause

The IDENTIFIED clause lets you indicate how Oracle authenticates the user.

BY password

The BY password clause lets you creates a local user and indicates that the user must specify password to log on. Passwords can contain only single-byte characters from your database character set regardless of whether this character set also contains multibyte characters.

Passwords must follow the rules described in the section "Schema Object Naming Rules", unless you are using Oracle's password complexity verification routine. That routine requires a more complex combination of characters than the normal naming rules permit. You implement this routine with the UTLPWDMG.SQL script, which is further described in Oracle9i Database Administrator's Guide.

EXTERNALLY Clause

Specify EXTERNALLY to create an external user. Such a user must be authenticated by an external service (such as an operating system or a third-party service). In this case, Oracle to relies on the login authentication of the operating system to ensure that a specific operating system user has access to a specific database user.

GLOBALLY Clause

The GLOBALLY clause lets you create a global user. Such a user must be authenticated by the enterprise directory service. The 'external_name' string can take one of two forms:

• The X.509 name at the enterprise directory service that identifies this user. It should be of the form 'CN=username,other_attributes', where other_attributes is the rest of the user's distinguished name (DN) in the directory.
• A null string (' ') indicating that the enterprise directory service will map authenticated global users to the appropriate database schema with the appropriate roles.

  Note: You can control the ability of an application server to connect as the specified user and to activate that user's roles using the ALTER USER statement.

  See Also: Oracle Advanced Security Administrator's Guide for more information on global users ALTER USER Oracle9i Application Developer's Guide - Fundamentals and your operating system specific documentation for more information "Creating a Global Database User: Example"

DEFAULT TABLESPACE Clause

Specify the default tablespace for objects that the user creates. If you omit this clause, objects default to the SYSTEM tablespace.

Restriction on Default Temporary Tablespaces

You cannot specify a locally managed tablespace (including an undo tablespace) or a dictionary-managed temporary tablespace as a user's default tablespace.

TEMPORARY TABLESPACE Clause

Specify the tablespace for the user's temporary segments. If you omit this clause, temporary segments default to the SYSTEM tablespace.

Restrictions on a User's Temporary Tablespace

• The tablespace must be a temporary tablespace and must have a standard block size.
• The tablespace cannot be an undo tablespace or a tablespace with automatic segment-space management.

  See Also: CREATE TABLESPACE for more information on undo tablespaces and segment management

QUOTA Clause

Use the QUOTA clause to allow the user to allocate up to integer bytes of space in the tablespace. Use K or M to specify the quota in kilobytes or megabytes. This quota is the maximum space in the tablespace the user can allocate.

A CREATE USER statement can have multiple QUOTA clauses for multiple tablespaces.

UNLIMITED lets the user allocate space in the tablespace without bound.

PROFILE Clause

Specify the profile you want to assign to the user. The profile limits the amount of database resources the user can use. If you omit this clause, Oracle assigns the DEFAULT profile to the user.

PASSWORD EXPIRE Clause

Specify PASSWORD EXPIRE if you want the user's password to expire. This setting forces the user (or the DBA) to change the password before the user can log in to the database.

ACCOUNT Clause

Specify ACCOUNT LOCK to lock the user's account and disable access. Specify ACCOUNT UNLOCK to unlock the user's account and enable access to the account.

Examples

Creating a Database User: Example

If you create a new user with PASSWORD EXPIRE, the user's password must be changed before attempting to log in to the database. You can create the user sidney by issuing the following statement:

CREATE USER sidney 
    IDENTIFIED BY out_standing1 
    DEFAULT TABLESPACE example 
    QUOTA 10M ON example 
    TEMPORARY TABLESPACE temp
    QUOTA 5M ON system 
    PROFILE app_user 
    PASSWORD EXPIRE;

The user sidney has the following characteristics:

• The password welcome
• Default tablespace example, with a quota of 10 megabytes
• Temporary tablespace temp
• Access to the tablespace SYSTEM, with a quota of 5 megabytes
• Limits on database resources defined by the profile app_user (which was created in "Creating a Profile: Example")
• An expired password, which must be changed before sidney can log in to the database

Creating External Database Users: Examples

The following example creates an external user, who must be identified by an external source before accessing the database:

CREATE USER app_user1
   IDENTIFIED EXTERNALLY
   DEFAULT TABLESPACE example
   QUOTA 5M ON example
   PROFILE app_user;

The user app_user1 has the following additional characteristics:

• Default tablespace example
• Default temporary tablespace example
• 5M of space on the tablespace example and unlimited quota on the temporary tablespace of the database
• Limits on database resources defined by the app_user profile

To create another user accessible only by the operating system account app_user2, prefix app_user2 by the value of the initialization parameter OS_AUTHENT_PREFIX. For example, if this value is "ops$", you can create the user ops$app_user2 with the following statement:

CREATE USER ops$external_user
   IDENTIFIED EXTERNALLY
   DEFAULT TABLESPACE example
   QUOTA 5M ON example
   PROFILE app_user;     

Creating a Global Database User: Example

The following example creates a global user. When you create a global user, you can specify the X.509 name that identifies this user at the enterprise directory server:

CREATE USER global_user
   IDENTIFIED GLOBALLY AS 'CN=analyst, OU=division1, O=oracle, C=US'
   DEFAULT TABLESPACE example
   QUOTA 5M ON example;