This document discusses database user authorization and privileges. It outlines different types of database users, including privileged users, non-privileged users, system users, and power users. It emphasizes granting users only the minimum privileges required to perform their jobs following the principle of least privilege. The document also provides examples of using privileges like CREATE USER, SYSTEM_USER, and partial revokes to restrict access.

1. Principal Member of Technical Staff
MySQL
March 05, 2020
Rahul Sisondia
Multiple DB accounts for an app

2. The following is intended to outline our general product direction. It is intended for
information purposes only, and may not be incorporated into any contract. It is not a
commitment to deliver any material, code, or functionality, and should not be relied upon in
making purchasing decisions. The development, release, timing, and pricing of any features
or functionality described for Oracle’s products may change and remains at the sole
discretion of Oracle Corporation.
Safe harbor statement
Copyright © 2020, Oracle and/or its affiliates2

3. Copyright © 2020, Oracle and/or its affiliates3
4
3
2
1
Asses vulnerability
Users categorization
Overview
Program agenda
Prevention

4. Copyright © 2020, Oracle and/or its affiliates4
DB users
Copyright © 2020, Oracle and/or its affiliates | Confidential: Internal/Restricted/Highly
Restricted
4
Instance
admins
Applications
App admins

5. Copyright © 2020, Oracle and/or its affiliates5
Authorization
Dynamic privileges
• Defined by Server, component
or plugin at run rime
• Administrative operations
- BACKUP_ADMIN, AUDIT_ADMIN
Static privileges
• Built into the server
• Database Operations
- SELECT, INSERT, UPDATE
• Administrative operations
- CREATE USER, PROCESS
• Grant privileges to user
- GRANT SELECT, INSERT, SUPER ON *.* TO
foo_user;
- GRANT SELECT ON db.table TO foo_user;
• Revoke Privileges
- REVOKE SELECT, INSERT ON *.* FROM foo_user;
- REVOKE SELECT ON db.table FROM foo_user;

6. Copyright © 2020, Oracle and/or its affiliates6
Privilege you need to create users ?
CREATE USER Do not have either of the
two privileges
Privileged
User
Non- privileged
User

7. Copyright © 2020, Oracle and/or its affiliates7
Privileged or Non-privileged users
Copyright © 2020, Oracle and/or its affiliates | Confidential: Internal/Restricted/Highly
Restricted
7
Applications
Instance
admins
Privileged
Non-Privileged
Privileged
App admins

8. Copyright © 2020, Oracle and/or its affiliates8
Applicatio
n
App Users
App user accounts management
DB Users
Micro Services
Privileged user Non privileged
user
app.user

9. Copyright © 2020, Oracle and/or its affiliates9
Application
s
App Users
App user accounts management
DB Users
Privileged user Non privileged
user

10. Copyright © 2020, Oracle and/or its affiliates10
Privilege escalation !
Copyright © 2020, Oracle and/or its affiliates | Confidential: Internal/Restricted/Highly
Restricted
10
Root user
App admins

11. Copyright © 2020, Oracle and/or its affiliates11
SYSTEM_USER privilege
- Allows maintaining separation of duty better
DBAs managing instances and NOT data
E.g. Uptime, Backup, High Level Security
DBAs managing data
Users with access to part of data
SYSTEM_USER
ALTER USER root@localhost IDENTIFIED BY
‘voodoo’;

12. System Users
- Granted at least ‘SYSTEM_USER’
privilege, but
not the CREATE USER privilege.
Power Users
- Granted at least ‘CREATE USER’ and
‘SYSTEM_USER’ privilege.
Privileged Users
- Granted at least ‘CREATE USER’ privilege,
but
not the ‘SYSTEM_USER’ privilege.
Non-privileged Users
- Neither ‘SYSTEM_USER’ nor ‘CREATE
USER’ privilege, but may be granted other
privileges.
Copyright © 2020, Oracle and/or its affiliates12
Power Users

13. Copyright © 2020, Oracle and/or its affiliates13
DB users
DB Users
Non-
privileged
users
Privileged
users
Regular
Users
Power Users
System
Users

14. Copyright © 2020, Oracle and/or its affiliates14
Is that sufficient ?
Do not have either of the
two privileges
Privileged
User
Non- privileged
User
CREATE USER
INSERT | UPDATE on mysql
schema
OR

15. Copyright © 2020, Oracle and/or its affiliates | Confidential: Internal/Restricted/Highly
Restricted
15
Partial Revokes
• Allows creating exception to global grants (Everything except ‘this’ and ‘that’)
• Execute GRANT at global level followed by REVOKE at schema level
GRANT INSERT ON *.* TO `foo_admin`;
REVOKE INSERT ON `mysql`.* FROM `foo_admin`;

16. Copyright © 2020, Oracle and/or its affiliates16
• Segregate the users as power users and regular users.
• Principle of least privileges.
• Revoke access to mysql schema from privileged users
Prevention Policy !

17. Copyright © 2020, Oracle and/or its affiliates17
Application
s
App Users
Multiple app admins can be used
DB Users
Privileged user Non privileged
user

18. Copyright © 2020, Oracle and/or its affiliates18
Thank you

19. Copyright © 2020, Oracle and/or its affiliates19
Questions