Our DBAs are not allowed to have full DB Admin accounts in production (Company policy). Does the Web 8.5 scripts absolutely need full DB Admin to run?
Is there a list somewhere of the specific privileges a user account must have to successfully run the SDL scripts without having full Admin rights?
Does it requires DB Admin account? I think no, but it requires user which must be able to execute all SQL scripts. These scripts require rights like create/update/delete over both your newly created databases and system databases.
For example, CD_BROKER_CRETE_LOGIN.sql script in installation folder has following command:
IF NOT EXISTS (select * from sys.sql_logins where name='cd_broker_user')
BEGIN
CREATE LOGIN "cd_broker_user" WITH PASSWORD = 'cd_broker_password'
END
GO
As you can see, it requires access to system databases (sys.sql_logins), so you must have these rights. In any case, I suggest you check all sql scripts in your installation folder and check if your uses has rights to execute them all.
P.S.
SQL scripts are in \SDL Web 8.5\Database\Scripts\mssql folder of your installation.
UPDATE:
Official docs found here states that you need to be logged in as a user with sufficient security clearance. Also, following page explains that system db admin must perform setup of SQL server. Besides this, following page states that following is required:
PowerShell scripts prompt you for the following information:
- DBA and user credentials (unless you created an Oracle SDL Web administrator user)
To answer your question in comment, no I don't think that that sort of list exists. I am afraid you will have to analyze all sql scripts and compile list of rights required by yourself. :(
Also, documentation states on multiple instances that DBA is required, so I guess you will have to request it.
GRANT EXECUTE ON DBMS_SCHEDULER even if you have a SYSDBA account in the oracle world, you still need to have the Admin option. I think it does require some level of Admin, hence my question, if there is a list of privilledges that is required then maybe we can create an account with all those rights, not every organisation is wiling to give Admin rights in Production.
Commented
Mar 28, 2018 at 7:34
The answer to this question is No.
Before you create a Content Manager database, run the SQL script CreateTridionSYSUser.sql (for example from SQL*Plus) located in the directory Database\Scripts\Oracle\Tools on your SDL Web installation media
The privileges and roles created for this user are the minimum requirements for database installation.