VDB User Does Not Have Permission to Perform Action DB_REFRESH (KBA5936)

Issue

If a user account does not have the appropriate privileges to refresh a VDB, the operation will fail with the following error:

Error: The operation could not be completed because the user "xxxxxx" does not have permission to perform action DB_REFRESH for the object test of type ORACLE_DB_CONTAINER.
Action: Ask an administrator to grant user "xxxxxx" the appropriate authorizations and try again.

Applicable Delphix Versions

Click here to view the versions of the Delphix engine to which this article applies

Major Release	All Sub Releases
6.0	6.0.0.0, 6.0.1.0, 6.0.1.1, 6.0.2.0
5.3	5.3.0.0, 5.3.0.1, 5.3.0.2, 5.3.0.3, 5.3.1.0, 5.3.1.1, 5.3.1.2, 5.3.2.0, 5.3.3.0, 5.3.3.1, 5.3.4.0, 5.3.5.0 5.3.6.0, 5.3.7.0, 5.3.7.1, 5.3.8.0, 5.3.8.1, 5.3.9.0
5.2	5.2.2.0, 5.2.2.1, 5.2.3.0, 5.2.4.0, 5.2.5.0, 5.2.5.1, 5.2.6.0, 5.2.6.1
5.1	5.1.0.0, 5.1.1.0, 5.1.2.0, 5.1.3.0, 5.1.4.0, 5.1.5.0, 5.1.5.1, 5.1.6.0, 5.1.7.0, 5.1.8.0, 5.1.8.1, 5.1.9.0, 5.1.10.0
5.0	5.0.1.0, 5.0.1.1, 5.0.2.0, 5.0.2.1, 5.0.2.2, 5.0.2.3, 5.0.3.0, 5.0.3.1, 5.0.4.0, 5.0.4.1 ,5.0.5.0, 5.0.5.1, 5.0.5.2, 5.0.5.3, 5.0.5.4
4.3	4.3.1.0, 4.3.2.0, 4.3.2.1, 4.3.3.0, 4.3.4.0, 4.3.4.1, 4.3.5.0
4.2	4.2.0.0, 4.2.0.3, 4.2.1.0, 4.2.1.1, 4.2.2.0, 4.2.2.1, 4.2.3.0, 4.2.4.0 , 4.2.5.0, 4.2.5.1
4.1	4.1.0.0, 4.1.2.0, 4.1.3.0, 4.1.3.1, 4.1.3.2, 4.1.4.0, 4.1.5.0, 4.1.6.0

Resolution

As the action states, to resolve this issue an administrator will have to grant the user the appropriate authorization to perform the action.

See the Troubleshooting section to verify the privileges assigned to the user.

---

Troubleshooting

The error is likely to be in response to a CLI/API operation, as the GUI will not offer the ability to attempt an operation that the user does not have the appropriate authorization to complete. The user can confirm this by logging into the GUI and verifying whether the option to Refresh is available for the VDB.  

An Administrator can verify what authorizations have been granted to a user for a VDB through the GUI. For example:

1. Click Manage.
2. Click Users.
3. Select the appropriate user, and then click the pencil icon (edit).
4. Click Next to review the priveleges for the user.
5. Filter for the VDB in question

For example:

We can see that this user has the role of Provisioner for the group "GTR" but None set for the VDB "test" (Object). A role of None means no privileges at all. Refer to the online Documentation User Privileges for Delphix Objects for further information on what privileges are granted to a role.

Role	Object Privileges	Group Privileges
Provisioner	Can access statistics on the dSource, VDB, or snapshot such as usage, history, and space consumption Can provision VDBs from owned dSources and VDBs	Can access statistics on all dSources, VDBs, or snapshots in the group such as usage, history, and space consumption Can provision VDBs from all dSources and VDBs in the group

For this user to be able to executy a refresh on this VDB, the Administrator would have to grant the Role of Owner to this User for the VDB (Object). This operation would not change the privileges associated with this user for any other Objects in the Group. 

Role	Object Privileges	Group Privileges
Owner	Can provision VDBs from owned dSources and VDBs Can perform Virtual to Physical (V2P) from owned dSources and VDBs Can access the same statistics as a Reader Can refresh or rollback VDBs Can snapshot dSources and VDBs	Can provision VDBs from all dSources and VDBs in the group Can refresh or rollback all VDBs in the group Can snapshot all dSources and VDBs in the group Can perform Virtual to Physical (V2P) from owned dSources and VDBs Can view Templates for policies. Can not create, edit, or delete a policy template from the policy page. Can assign Owner privileges for dSources and VDBs Can access the same statistics as a Provisioner, Data Operator, or Reader

For example:

 

 

---