Deleting Administrators

Only Super Administrators can delete regular Enterprise Manager administrators. You cannot delete yourself and the Repository owner cannot be deleted.

When deleting an administrator, the Super Administrator performing the deletion is given two options:

Delete Cascade - this will delete the administrator and all associated Job Types, Jobs, Corrective Actions, Report Definitions, Reports, Templates. Blackouts will not be deleted.
Reassign Objects - this will allow the administrator's objects be reassigned. A list of all Job Types, Jobs, Corrective Actions, Report Definitions, Reports, Templates and Blackouts belonging to the user will be displayed. Each object will have a list of available administrators to which the object can be reassigned. The credentials belonging to the administrator will be deleted from the Management Repository before any reassignment takes place. After reassignment, an unsolicited e-mail will be sent to each owner that has been reassigned objects and will list the objects that have been reassigned and any action that needs to take place to make them work again.

Blackouts can be reassigned to any administrator that has OPERATOR privilege on all the targets that the blackout operates on.

Jobs can be reassigned to any user but all credentials associated with the Job will be removed leaving the job in a state called Suspended - No Credentials. This requires the new job owner to explicitly set the credentials, since the job can no longer run. Already running executions will be allowed to continue running, since they are already using the credentials of the original owner. Once the new owner sets the credentials, the job goes back to the SCHEDULED state. The original user name is maintained as a hint to the new owner, under the following conditions:

The original job had override credentials
The original job used preferred credentials, but only had one target
The original job used preferred credentials, and all targets had the same username
The original user name is not maintained for the following more common case:
The original job used preferred credentials and several targets had different credentials.
As a result nothing related to the original credentials will be kept.

The original credentials are removed from the job in order to prevent an unethical Super Administrator from reassigning the job to another administrator with FULL_JOB privileges and then running malicious code. For example, a Super Administrator could create non-existent administrator 'D', create a malicious job as that administrator, grant administrator 'U' FULL_JOB privileges on that job, and then, in deleting administrator 'D', reassign the job to administrator 'U', thereby having the job access to administrator U's preferred credentials.

Corrective Actions behave similar to Jobs, except that you can only reassign a Corrective Action to a user that has OPERATOR on the target.

Blackout and Job History for the user being deleted will not be purged. Historical Jobs and Blackouts can be reassigned but will be marked as non-retryable to prevent the new owner from being able to retry executions that use the old owner's credentials. New executions that are spawned from the reassigned Jobs, will be retryable as they are using the new owner's credentials.

Report Definitions, Reports and Monitoring Templates can be reassigned to any user.

Secure Sign-On: If an SSO user is deleted, the associated user in the Oracle Internet Directory will not be deleted. If an existing Oracle database user was converted into an Enterprise Manager administrator, that database account will not be deleted, but the MGMT_USER database role will be revoked.

Deleting Administrators

Related Topics