11g的vault不在是一个独立的安装包了，而是集成在了db的安装产品里，而且安装软件时必须的选上，否则创建db时无法选择oracle database vault.

安装之后可以在类似em的图形化界面里管理vault，第一次登录就磕磕绊绊了，在浏览器里输入：https://lenovo-382e0ef1:1158/dva

提示输入用户名等信息之后收到错误提示：You must have the DV_ADMIN or DV_SECANALYST role granted to your account in order to use this application.

这里用户必须是需要具有DV_ADMIN or DV_SECANALYST角色才能登录，到底哪些用户具有这2个role呢：

SQL> SELECT *
2 FROM DBA_ROLE_PRIVS
3 WHERE GRANTED_ROLE IN ('DV_ADMIN','DV_OWNER');

GRANTEE GRANTED_ROLE ADM DEF
------------------------------ ------------------------------ --- ---
DVSYS DV_OWNER YES YES
DV_OWNER DV_ADMIN YES YES
DBVO DV_OWNER YES YES
DVSYS DV_ADMIN YES YES

SQL>

SQL> create user a identified by a;

用户已创建。

SQL> show user
USER 为 "DBVM"

--======================================

How Are GRANT and REVOKE Operations Affected by the DV_OWNER Role?

Anyone with the DV_OWNER role can grant the DV_OWNER and DV_ADMIN roles to another user. The account granted this role can revoke any granted protected schema role from another account. Accounts such as SYS or SYSTEM, with the GRANT ANY ROLE system privilege alone (directly granted or indirectly granted using a role) do not have the right to grant or revoke the DV_OWNER role to or from any other database account. Note also that a user with the DV_OWNER role cannot grant or revoke the DV_ACCTMGR role.

--=======================================

这里我们看到安装vault时创建的用户dbvo是具有DV_OWNER角色的，有这个角色的话也可以登录https://lenovo-382e0ef1:1158/dva，另外具有DV_OWNER角色的用户可以授予DV_ADMIN给其它用户：

SQL> grant dv_admin to a;

授权成功。

SQL> show user
USER 为 "DBVO"
SQL>