Temp File Service 'hsitempfile' database user, what permissions does it require?

[Alan_Vidmar]

We're trying to implement the Temp File Service portion of the API server and have run into an issue with the 'hsitempfile' database user not existing. The API Server MRG makes no mention of needing an additional database account for this service. Can I please get information of what permissions are necessary for this account?

Exception: ORA-01918: user 'hsitempfile' does not exist

Thanks,

Alan

[Jeremy_Meyers]

Hello Alan,

Thanks for reaching out to us about this issue. We will be reaching out to you to resolve this issue.

Thank you,

Jeremy

[David_Juhlin]

Is this documented in an MRG somewhere?  I don't like having to use a too-powerful user account in the api server, and especially when it has to sit in a public DMZ.  I understand that when the TempFS is first established, a sufficiently-powerful account is needed to create the user/schema etc. but once created, can we use a different account, and what access does it really need?  I understand 'security by obscurity' but we can better manage accounts/access if we know what is truly needed.

[AdamShaneHyland]

Hi @David Juhlin ,

At this time the documentation is not available for your request.  You are correct in your understanding that there are permissions required for creating the hsitempfile schema (e.g. creating the tables) and then there are permissions needed for the general usage of the service (e.g. selecting, inserting, updating and removing rows from the tables).  

Unfortunately I don't have an answer for you at this time.  Further investigation would be required to determine the specific permissions required and if you could use a different account (or simply change the permissions on the account) after the initial implementation. 

While I can't say this for certain, you can likely reference the Hyland Identity and Access Management MRG under the Operational Database for the User Id ...

https://support.hyland.com/r/Other/Identity-and-Access-Management-Services/3.0/Identity-and-Access-M...

TempFS and the Operational Database implementation are similar.

If you are interested in a more definitive answer, I would recommend working with your first line of support.

Best wishes.

[Tia_Brott-Silke]

Alan - don't hold me to this as we are still implementing this in Oracle for our 23 upgrade so it hasn't bee fully proven but here is what we have:

CREATE USER "hsitempfile" IDENTIFIED BY "xxxxxx"; (xxxxx = db user password)

GRANT UNLIMITED TABLESPACE TO "hsitempfile";
GRANT CREATE SESSION TO "hsitempfile";
GRANT CREATE TABLE TO "hsitempfile";
GRANT SELECT_CATALOG_ROLE TO "hsitempfile";