docs: oracleuserpriv #746
docs: oracleuserpriv #746
Conversation
|
/gcbrun |
docs/connections.md
Outdated
| @@ -155,6 +155,11 @@ Then `pip install cx_Oracle`. | |||
| } | |||
| ``` | |||
|
|
|||
| ### Oracle User permissions to run the validator tool: | |||
| * GRANT CREATE SESSION TO DVT-USER (Create Session Privilege) | |||
There was a problem hiding this comment.
I wonder if it would be better to be consistent with the BigQuery section and simply list the privileges we require?
For example:
Oracle user permissions required to run this validator tool:
- CREATE SESSION
- READ or SELECT on any tables to be validated
Just a suggestion, not an essential change (I just like consistency :-) )
There was a problem hiding this comment.
@nj1973 - Incorporated.
| * GRANT CREATE SESSION TO DVT-USER (Create Session Privilege) | ||
| * GRANT READ ON SCHEMA_NAME.TABLE_NAME to DVT-USER; (Oracle Read table privilege) | ||
|
|
||
|
|
There was a problem hiding this comment.
I was recently pointed to an issue logged in the Oracle alert log that is caused by SQL Alchemy when the user doesn't have read privileges on V$TRANSACTION. I wonder if we should cover this too. For example:
If you encounter "WARNING: too many parse errors" messages in your Oracle alert log relating to a query from your DVT database account then a workaround is to grant READ privilege on SYS.V_$TRANSACTION. See here for background on this: https://docs.sqlalchemy.org/en/14/dialects/oracle.html#transaction-isolation-level-autocommit
Or do you think this is overkill?
There was a problem hiding this comment.
@nj1973 - Looking at the issue you shared ,I concur it should be a pre-requisite to have read on SYS.V_$TRANSACTION but don't see any reason to only give this privilege if the users sees the warning. from the doc
"The cx_Oracle dialect attempts to call the Connection.get_isolation_level() method when the dialect makes its first connection to the database in order to acquire the “default”isolation level."
so it seems to me that we should get a read priv on SYS.V_$TRANSACTION instead of the alternative behaviour which would be getting a background warning and setting to default.
There was a problem hiding this comment.
OK, that makes sense.
Because v$transaction is an unusual privilege to require I think we should include a comment or link to explain why we expect it. Also stating that it is optional (because code continues to function fine without it).
There was a problem hiding this comment.
@nj1973 - have added the same to doc now.
|
/gcbrun |
|
/gcbrun |
docs: add instructions on privileges required by oracle user to connect to DVT