Oracle DBA and Basis Role Separation

[Former Member]

Quick question from a fairly new SAP DBA. I've been an Oracle DBA for MANY years and this is my first "gig" as the Oracle DBA for our SAP implementation. We have segregated the duties for Basis and the Database management piece. We have tried as much as possible to integrate the new SAP databases with our other Oracle databases as far as standards go. We mange quite a few Oracle databases other than SAP and need as much standardization as possible where we can within SAP guidelines of course.

The question I have is this. We, the DBA's, keep getting requests from Basis that they MUST have the sys and system passwords for these databases. If ALL of the database management is being done by the DBA staff, why would they need these passwords? I might add that we have been live for a few years, this is a fully functional production environment. How common is splitting out these roles like we have done here? And when they are split, are they TRULY split? OK....3 questions. Thanks in advance for any responses.

[stefan_koehler]

Hi Dru,

> If ALL of the database management is being done by the DBA staff, why would they need these passwords?

They need these passwords in upgrade / migration scenarios (for SAP tool) or SAP schema password resets (if you have not created a separate Oracle user), but usually not for "daily operation". However such scenarios are planned and the passwords can be reset and shared in such cases.

> How common is splitting out these roles like we have done here?

I have seen several sites where this is handled your way. However you (as a separated Oracle DBA) need to be familiar with SAP tools like BR*Tools (for statistics), the specific SAP database settings and patching strategy to keep it stable and working well.

> And when they are split, are they TRULY split?

They can be truly split, if you also have access to SAP SMP to get the patches, SAP notes, etc.. However it is a "hand-in-hand" work if some database related performance problems occur as you need to know the SAP (DBSL) handling in relation to the issue.

Hope this helps.

Regards

Stefan