CON_ID NAME OPEN_MODE
—— ——— ———-
2 PDB$SEED READ ONLY
3 SALESPDB READ WRITE
4 HRPDB READ WRITE
5 APP_ROOT READ WRITE
6 APP_PDB1 READ WRITE

# 切换到PDB
SQL> ALTER SESSION SET CONTAINER = fgfgfgsalespdb;

Session altered.

# 查看用户
SQL> SELECT username, account_status, created FROM dba_users ORDER BY username;

USERNAME ACCOUNT_STATUS CREATED
—————————— ————— ———
DBSNMP OPEN 01-JAN-26
SYS OPEN 01-JAN-26
SYSTEM OPEN 01-JAN-26

# 创建用户
SQL> CREATE USER fgfgfgsales_admin IDENTIFIED BY “Sales123#”
DEFAULT TABLESPACE users
TEMPORARY TABLESPACE temp
QUOTA 100M ON users;

User created.

SQL> CREATE USER fgfgfgsales_user IDENTIFIED BY “Sales123#”
DEFAULT TABLESPACE users
TEMPORARY TABLESPACE temp
QUOTA 50M ON users;

User created.

# 查看用户
SQL> SELECT username, account_status, created FROM dba_users ORDER BY username;

USERNAME ACCOUNT_STATUS CREATED
—————————— ————— ———
DBSNMP OPEN 01-JAN-26
SALES_ADMIN OPEN 31-MAR-26
SALES_USER OPEN 31-MAR-26
SYS OPEN 01-JAN-26
SYSTEM OPEN 01-JAN-26

# 验证用户创建成功

Session altered.

# 查看角色
SQL> SELECT role FROM dba_roles ORDER BY role;

ROLE
——————————
CONNECT
DBA
EXP_FULL_DATABASE
IMP_FULL_DATABASE
RESOURCE
SCHEDULER_ADMIN

# 创建角色
SQL> CREATE ROLE fgfgfgsales_read_role;

Role created.

SQL> CREATE ROLE fgfgfgsales_write_role;

Role created.

# 查看角色
SQL> SELECT role FROM dba_roles ORDER BY role;

ROLE
——————————
CONNECT
DBA
EXP_FULL_DATABASE
IMP_FULL_DATABASE
RESOURCE
SALES_READ_ROLE
SALES_WRITE_ROLE
SCHEDULER_ADMIN

# 验证角色创建成功

Session altered.

# 授予角色权限
SQL> GRANT CREATE SESSION, CREATE TABLE, CREATE VIEW TO fgfgfgsales_read_role;

Grant succeeded.

SQL> GRANT CREATE SESSION, CREATE TABLE, CREATE VIEW, INSERT, UPDATE, DELETE TO fgfgfgsales_write_role;

Grant succeeded.

# 授予用户角色
SQL> GRANT fgfgfgsales_read_role TO fgfgfgsales_user;

Grant succeeded.

SQL> GRANT fgfgfgsales_write_role TO fgfgfgsales_admin;

Grant succeeded.

# 查看用户权限
SQL> SELECT grantee, granted_role FROM dba_role_privs WHERE grantee IN (‘SALES_ADMIN’, ‘SALES_USER’) ORDER BY grantee, granted_role;

GRANTEE GRANTED_ROLE
———- ——————
SALES_ADMIN SALES_WRITE_ROLE
SALES_USER SALES_READ_ROLE

# 验证权限配置成功

Session altered.

# 查看审计状态
SQL> SELECT name, value FROM v$parameter WHERE name = ‘audit_trail’;

NAME VALUE
———————————— ——————————
audit_trail DB

# 配置审计
SQL> ALTER SYSTEM SET audit_trail = DB SCOPE = SPFILE;

System altered.

# 重启数据库
SQL> SHUTDOWN IMMEDIATE;

Database closed.
Database dismounted.
ORACLE instance shut down.

SQL> STARTUP;

ORACLE instance started.

Total System Global Area 838860800 bytes
Fixed Size 9140416 bytes
Variable Size 503316480 bytes
Database Buffers 318767104 bytes
Redo Buffers 7737600 bytes
Database mounted.
Database opened.

# 验证审计状态
SQL> SELECT name, value FROM v$parameter WHERE name = ‘audit_trail’;

NAME VALUE
———————————— ——————————
audit_trail DB

# 配置PDB审计
SQL> ALTER SESSION SET CONTAINER = fgfgfgsalespdb;

Session altered.

# 审计用户登录
SQL> AUDIT SESSION BY fgfgfgsales_admin;

Audit succeeded.

# 审计表操作
SQL> AUDIT TABLE, UPDATE TABLE, DELETE TABLE BY fgfgfgsales_admin BY ACCESS;

Audit succeeded.

# 查看审计配置
SQL> SELECT user_name, audit_option, success, failure FROM dba_audit_trail_options WHERE user_name = ‘SALES_ADMIN’;

USER_NAME AUDIT_OPTION SUCCESS FAILURE
———— —————– ——— ———
SALES_ADMIN SESSION BY ACCESS BY ACCESS
SALES_ADMIN TABLE BY ACCESS BY ACCESS
SALES_ADMIN UPDATE TABLE BY ACCESS BY ACCESS
SALES_ADMIN DELETE TABLE BY ACCESS BY ACCESS

# 验证审计配置成功

Session altered.

# 查看用户
SQL> SELECT username, account_status, created FROM dba_users ORDER BY username;

USERNAME ACCOUNT_STATUS CREATED
—————————— ————— ———
DBSNMP OPEN 01-JAN-26
SALES_ADMIN OPEN 31-MAR-26
SALES_USER OPEN 01-JAN-26
SYS OPEN 01-JAN-26
SYSTEM OPEN 01-JAN-26

# 测试用户登录
$ sqlplus fgfgfgsales_admin/”Sales123#”@fgfgfgsalespdb

SQL*Plus: Release 19.0.0.0.0 – Production on Fri Mar 31 10:00:00 2026
Version 19.3.0.0.0

Copyright (c) 1982, 2019, Oracle. All rights reserved.

Connected to:
Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 – Production
Version 19.3.0.0.0

SQL> SHOW USER;

USER is “SALES_ADMIN”

SQL> SELECT con_id, name FROM v$pdbs;

CON_ID NAME
—— ———
3 SALESPDB

# 验证用户管理成功

Session altered.

# 查看审计记录
SQL> SELECT username, action_name, obj_name, timestamp FROM dba_audit_trail WHERE username = ‘SALES_ADMIN’ ORDER BY timestamp DESC FETCH FIRST 10 ROWS ONLY;

USERNAME ACTION_NAME OBJ_NAME TIMESTAMP
———- ————– ———— ——————-
SALES_ADMIN LOGON 31-MAR-26 10:00:00
SALES_ADMIN LOGON 31-MAR-26 09:55:00
SALES_ADMIN LOGON 31-MAR-26 09:50:00
SALES_ADMIN LOGON 31-MAR-26 09:45:00
SALES_ADMIN LOGON 31-MAR-26 09:40:00

# 测试审计
SQL> CREATE TABLE test_audit (
id NUMBER,
name VARCHAR2(100)
);

Table created.

SQL> INSERT INTO test_audit (id, name) VALUES (1, ‘Test Audit’);

1 row created.

SQL> COMMIT;

Commit complete.

# 查看审计记录
SQL> SELECT username, action_name, obj_name, timestamp FROM dba_audit_trail WHERE username = ‘SALES_ADMIN’ ORDER BY timestamp DESC FETCH FIRST 10 ROWS ONLY;

USERNAME ACTION_NAME OBJ_NAME TIMESTAMP
———- ————– ———— ——————-
SALES_ADMIN CREATE TABLE TEST_AUDIT 31-MAR-26 10:01:00
SALES_ADMIN INSERT TEST_AUDIT 31-MAR-26 10:01:00
SALES_ADMIN LOGON 31-MAR-26 10:00:00
SALES_ADMIN LOGON 31-MAR-26 09:55:00
SALES_ADMIN LOGON 31-MAR-26 09:50:00

# 验证PDB审计成功