Forum Stats

  • 3,750,406 Users
  • 2,250,174 Discussions
  • 7,866,970 Comments

Discussions

Old ORDS_PUBLIC_USER session is still active???

Aaron L.
Aaron L. Member Posts: 11 Green Ribbon

I see an open db session under ORDS_PUBLIC_USER that logged on almost 16 hours ago. I don't really know what that user account is responsible for, but it is kind of scary that I've never seen an old session open for that username. Can someone advise me if it is something I should be concerned with (hacker?), if I can kill the session without worries, how to see what that session is up to, or what that username creates sessions for? (I know, that is a lot to ask)

I also have 3 more sessions that logged in for that user an hour ago that are still open.

The "machine" in v$session is our OHS server that is accessible from outside our intranet.

Or is this a question I should be entering an SR for?

Thanks for any advice

Edit: Sounds like this user executes the RESTful service requests. I tried to see if any v$sql is running for that session, but nothing is returned. If I just kill the sessions, it may just fail to return anything to our web service consumers for those requests?

Best Answer

  • thatJeffSmith-Oracle
    thatJeffSmith-Oracle Distinguished Product Manager Posts: 7,906 Employee
    Accepted Answer

    ords_public_user sessions in your database will live as long as ORDS is running

    After a give amount of time/uses, the connections are destroyed and re-created. That amount of time I'm pretty sure extends past a day.

    If you look at the PREV_SQL_ID you'll probably see something in terms of what the connections are doing - which isn't much. Your REST APIs execute as the REST Enabled schema those APIs are published for. The ORDS_PUBLIC_USER sessions are used to look up what your REST APIs do and the privs required before a jdbc connection proxy session is established to the REST Enabled schema, to run the code attached to the API.

Answers

  • thatJeffSmith-Oracle
    thatJeffSmith-Oracle Distinguished Product Manager Posts: 7,906 Employee

    ords_public_user is used for ORDS connection pools. Are you familiar with ORDS?

  • Aaron L.
    Aaron L. Member Posts: 11 Green Ribbon
    edited Sep 9, 2021 7:14PM

    I don't want to say I'm "familiar" with it, because I'm pretty new to it.

    Here is my experience with ORDS:

    I have it installed on two production databases.

    On one, we provide RESTful web services for 3rd party consumers to GET, PUT, and POST data to and from our db.

    On the other, we use RESTful web services to GET media for our web site and POST objects from our site. If you are "thatJeffSmith", I think you recently (back in March) worked with me and our Oracle consultants on how to replace our mod_plsql with these ORDS functions. 😉

    So my experience is basically "installing" ORDS and creating (and calling) REST Data Services.

    When I previously looked at old sessions (> 1 day), I've never seen this user with open sessions before.

  • thatJeffSmith-Oracle
    thatJeffSmith-Oracle Distinguished Product Manager Posts: 7,906 Employee
    Accepted Answer

    ords_public_user sessions in your database will live as long as ORDS is running

    After a give amount of time/uses, the connections are destroyed and re-created. That amount of time I'm pretty sure extends past a day.

    If you look at the PREV_SQL_ID you'll probably see something in terms of what the connections are doing - which isn't much. Your REST APIs execute as the REST Enabled schema those APIs are published for. The ORDS_PUBLIC_USER sessions are used to look up what your REST APIs do and the privs required before a jdbc connection proxy session is established to the REST Enabled schema, to run the code attached to the API.