# ORA-01031: insufficient privileges **URL:** \ **Category:** General Discussion\ **Created:** [May 4, 2021, 2:19pm UTC](https://forum.liquibase.org/t/ora-01031-insufficient-privileges/5416 "2021-05-04T14:19:25Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![mohsink](https://avatars.discourse-cdn.com/v4/letter/m/3da27b/32.png) [@mohsink](https://forum.liquibase.org/u/mohsink)\ **Post date:** [May 4, 2021, 2:19pm UTC](https://forum.liquibase.org/t/ora-01031-insufficient-privileges/5416/1 "2021-05-04T14:19:25Z")
Leveraging Oracle’s schema only user (18c+) and heres the LB properties file : url=jdbc:oracle:thin:least\_priv\_user/@0.0.0.0:1521/XEPDB1 username: liquibase\_admin password: liquibase\_admin123 Pre-Steps ( outside of the liquibase ) grant create session to liquibase\_admin; alter user least\_priv\_user grant connect through liquibase\_admin; Question : Upon doing an liquibase update 1. why does this work only if GRANT ALL PRIVILEGES to liquibase\_admin; 2. db change logs tables gets created in both schemas - Not sure why If a GRANT ALL PRIVILEGES to liquibase\_admin privileges is not given : The below error occurs : Unexpected error running Liquibase: ORA-01031: insufficient privileges [Failed SQL: (1031) CREATE TABLE LIQUIBASE\_ADMIN.DATABASECHANGELOGLOCK (ID INTEGER NOT NULL, LOCKED NUMBER(1) NOT NULL, LOCKGRANTED TIMESTAMP, LOCKEDBY VARCHAR2(255), CONSTRAINT PK\_DATABASECHANGELOGLOCK PRIMARY KEY (ID))] 1. If the lb\_admin is only given create TABLE privileges then the below error occurs when processing changelog : Reason: liquibase.exception.DatabaseException: ORA-01031: insufficient privileges … ---
**Author:** ![daryldoak](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.liquibase.org/daryldoak/32/764_2.png) [@daryldoak](https://forum.liquibase.org/u/daryldoak)\ **Post date:** [May 4, 2021, 2:23pm UTC](https://forum.liquibase.org/t/ora-01031-insufficient-privileges/5416/2 "2021-05-04T14:23:37Z")
The user that Liquibase is using to connect to the database is expected to have privileges to CREATE, ALTER, etc all object types. You need to expand your set of privileges. ---
**Author:** ![mohsink](https://avatars.discourse-cdn.com/v4/letter/m/3da27b/32.png) [@mohsink](https://forum.liquibase.org/u/mohsink)\ **Post date:** [May 4, 2021, 2:25pm UTC](https://forum.liquibase.org/t/ora-01031-insufficient-privileges/5416/3 "2021-05-04T14:25:40Z")
Thanks , but even the below doesnt help either grant create view … grant create table … grant alter session … grant create cluster … grant create session … grant create synonym … grant create trigger … grant create sequence … grant create procedure … grant create database link … ---
**Author:** ![daryldoak](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.liquibase.org/daryldoak/32/764_2.png) [@daryldoak](https://forum.liquibase.org/u/daryldoak)\ **Post date:** [May 4, 2021, 2:31pm UTC](https://forum.liquibase.org/t/ora-01031-insufficient-privileges/5416/4 "2021-05-04T14:31:55Z")
I see you are running Liquibase as “lb\_admin”, but your schema in the sql is “LIQUIBASE\_ADMIN”. In order to create a table in another schema lb\_admin would need the “CREATE ANY TABLE” privilege. ---
**Author:** ![mohsink](https://avatars.discourse-cdn.com/v4/letter/m/3da27b/32.png) [@mohsink](https://forum.liquibase.org/u/mohsink)\ **Post date:** [May 4, 2021, 2:58pm UTC](https://forum.liquibase.org/t/ora-01031-insufficient-privileges/5416/5 "2021-05-04T14:58:02Z")
Thanks , it is liquibase\_admin, I had only updated it up on this forum post . I edited the original post. The errors still occurs. ---
**Author:** ![mohsink](https://avatars.discourse-cdn.com/v4/letter/m/3da27b/32.png) [@mohsink](https://forum.liquibase.org/u/mohsink)\ **Post date:** [May 4, 2021, 3:17pm UTC](https://forum.liquibase.org/t/ora-01031-insufficient-privileges/5416/6 "2021-05-04T15:17:38Z")
Yes updated grants with “create any …” privileges but it does **not** seem to help. ---
**Author:** ![daryldoak](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.liquibase.org/daryldoak/32/764_2.png) [@daryldoak](https://forum.liquibase.org/u/daryldoak)\ **Post date:** [May 4, 2021, 3:50pm UTC](https://forum.liquibase.org/t/ora-01031-insufficient-privileges/5416/7 "2021-05-04T15:50:13Z")
Why do you have “least\_priv\_user” in your jdbc string? ---
**Author:** ![mohsink](https://avatars.discourse-cdn.com/v4/letter/m/3da27b/32.png) [@mohsink](https://forum.liquibase.org/u/mohsink)\ **Post date:** [May 4, 2021, 4:09pm UTC](https://forum.liquibase.org/t/ora-01031-insufficient-privileges/5416/8 "2021-05-04T16:09:25Z")
The least privileged user in that jdbc string is the user used to have proxy connection to the liquibase\_admin. Heres more info on that type of accounts : > **[Schema Only Accounts in Oracle Database 18c](https://oracle-base.com/articles/18c/schema-only-accounts-18c)** > > Schema only accounts don't allow direct connections, so administration of their objects is done via a DBA user or a proxy user. ---
**Author:** ![daryldoak](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.liquibase.org/daryldoak/32/764_2.png) [@daryldoak](https://forum.liquibase.org/u/daryldoak)\ **Post date:** [May 4, 2021, 4:15pm UTC](https://forum.liquibase.org/t/ora-01031-insufficient-privileges/5416/9 "2021-05-04T16:15:00Z")
All of my Liquibase connections use proxy connections. I’m not familiar with the technique you are trying, I would recommend you try this: 1. remove least\_priv\_user from the jdbc string 2. change username to: least\_priv\_user[liquibase\_admin] That is how all of my proxy connections are done with Liquibase. ---
**Author:** ![mohsink](https://avatars.discourse-cdn.com/v4/letter/m/3da27b/32.png) [@mohsink](https://forum.liquibase.org/u/mohsink)\ **Post date:** [May 4, 2021, 6:12pm UTC](https://forum.liquibase.org/t/ora-01031-insufficient-privileges/5416/10 "2021-05-04T18:12:32Z")
Hey , thanks it helped though it was more than adjustment to URL. It was a combination of : alter grant connect statement , adjustment to the jdbc url & the additional grants that the DDL needed ( for constraints ) So it worked. thanks 😀