I'll base my answers on a MySQL database. I give all privileges (there are quire a number of them) to the user on the created database. The user also has GRANT privileges, which enables that user to also grant the same privileges to others. I haven't tried creating a user without GRANT privilege, nor have I attempted to determine the minimum number of privileges required for the software to work. By the way, Portal uses Hibernate for its data access, so any posts or blogs that deal with security issues with Hibernate on Oracle should apply to Portal. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4242700#... Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...