Server Administration :: Unable To Grant SELECT Priv To ROLE?
Dec 6, 2010
i have created one user SVC_LAMR and created one ROLE - SVC_LAMR_ROLE.
i have attachd this role to abv user SVC_LAMR.
i need to grant SELECT privilege on some tables ( from some other schema TPAOWNER ) to this role.so that this user SVC_LAMR can access those tables lying in TPAOWNER schema.
for e.g.
SQL> show user
USER is "SYS"
SQL> grant SELECT on TPAOWNER.USER_APPLICATION to SVC_LAMR_ROLE;
grant SELECT on TPAOWNER.USER_APPLICATION to SVC_LAMR_ROLE
*
ERROR at line 1:
ORA-01031: insufficient privileges
But, if i connect this user: TPAOWNER, and give SELECT privilge directly to this role, it is accepting.
i.e.
SQL> conn tpaowner/*******
Connected.
SQL> grant select on USER_APPLICATION to SVC_LAMR_ROLE;
I have a stored procedure which when executed creates a user and grants some roles to the user and also makes certain roles DEFAULT using "alter user"
The issue comes when i execute the procedure.
I have a User who has a role and this role has the "alter user" privilege, for example lets say that the user1 has the role ABC, and role ABC has the "alter user" privilege.
SQL> grant alter user to ABC; Grant succeeded. SQL> grant ABC to user1; Grant succeeded.
Now, when i run the stored procedure as the user1, it gives me an error on a line saying "insufficient privileges", when i check the line, its this line: alter user user1 DEFAULT ROLE "ROLE1", "ROLE2"
But as far as i know the user1 has the "alter user" privilege
I want to make those two roles ROLE1, ROLE2 DEFAULT because i don't want the other roles ROLE3,ROLE4 to be default, as you know if there are many roles and if we alter user with default for certain roles other roles become DEFAULT=NO.
So i get the error at "alter user" statement though the user has the "alter user" privilege, what do you think might be wrong?
OR is there anyway to grant roles to the user with default=NO option?
Oracle Database 11g Enterprise Edition Release 11.1.0.6.0 - 64bit Production PL/SQL Release 11.1.0.6.0 - Production "CORE 11.1.0.6.0 Production"
Is there a way to grant EXECUTE on a group of procedures/functions/packages to a particular role , in a single statement ? Or we have to do it one by one... like GRANT EXECUTE on event_main to role1, GRANT EXECUTE on event_main2 to role1, GRANT EXECUTE on event_main3 to role1,
I bought Selftestsoftware for 1z0-147 for 9i and 10g. Selftestsoftware is endorsed by Oracle, should be high quality.
But its below sample question and answer seem to be wrong: It says that privilege for subprogram can be granted via role. But from Urman 9i book: the grant the execute privilege must be done explicitly and not through a role.
Did Selftestsoftware made a mistake? Or the question did not mention or assume that the subprogram is based on invoker rights not definer right?
Quote: Question: All users in the HR_EMP role have UPDATE privileges on the EMPLOYEE table. You create the UPDATE_EMPLOYEE procedure. HR_EMP users should only be able to update the EMPLOYEE table using this procedure. Which two statements should you execute? (Choose two.)
GRANT UPDATE ON employee TO hr_emp; GRANT SELECT ON employee to hr_emp; REVOKE UPDATE ON employee FROM hr_emp; REVOKE UPDATE ON employee FROM public; GRANT EXECUTE ON update_employee TO hr_emp;
Explanation: The two statements you should execute are: REVOKE UPDATE ON employee FROM hr_emp; GRANT EXECUTE ON update_employee TO hr_emp;
Unless you are the owner of the PL/SQL construct, you must be granted the EXECUTE object privilege to run it or have the EXECUTE ANY PROCEDURE system privilege. By default, a PL/SQL procedure executes under the security domain of its owner. This means that a user can invoke the procedure without privileges on the procedures underlying objects. To allow HR_EMP users to execute the procedure, you must issue the GRANT EXECUTE ON update_employee TO hr_emp; statement. To prevent HR_EMP users from updating the EMPLOYEE table unless they are using the UPDATE_EMPLOYEE procedure, you must issue the REVOKE UPDATE ON employee FROM hr_emp;
All of the other options are incorrect because they will not meet the specified requirements.
I have a role in my Oracle 10g instance like below:
GRANT ALTER USER TO <role_name> WITH ADMIN OPTION;
And this works fine for any user who has:
GRANT <role_name> TO <user>;
What I need is to limit <user> to only have the ALTER USER privilege to a set of users. Preferrably where the set of users are identified by a column value in a table, something like:
WHERE PeopleTable.InList = "YES"
Or maybe where set of users are defined by their membership in another role.
GRANT ALTER USER TO <role_name> FOR USERS IN MEMBERS_LIST_ROLE;
I created a user and granted connect,resource priviliges. I gave access to this user for only 5 tables. when i check it later, other tables are also given access. How can i avoid this and give access to selected tables.
User1 is having 10000 tables in his schema...How can i grant "select" on a all tables of a user1 to another schema(user2) so that in future when user1 will create tables , the user2 will have "select" access on those tables automatically.
I dont want user2 to have "select any table" privillege.
User2 should not have "drop" privillege on his own tables.
I have a procedure in my schema. I have created a sys context name xyz for passing the date in that i am passing the sysdate to that context which is used in a view.i have used/called that procedure in form.
My problem is that when i am giving Grant select any dictionary to the user then form is compiled otherwise form is giving error procedure name must be declared. But for security reasons i don't to give select any dictionary to that user.
Developers they use Toad and in that they want to use session browser option so that they can see the SQL running and open Cursor,other session specific details...So what grant/ permissions can be given to them so that the Schema they logged on can access those information.
have an automated process which runs on an Oracle 8i database server as user abc. This process creates views/tables in other schemas, on the same database server, which point to objects owned by the abc user.
The issue I'm getting is that when I try to execute GRANT SELECT ON xyz.view123 TO PUBLIC as the abc user, I get an insufficient privileges.I should add that the abc user created the xyz.view123 table/view.
What grants/priviliges or whatever do I have to do to the abc schema?
I have an automated process which runs on an Oracle 8i database server as user abc.This process creates views/tables in other schemas, on the same database server, which point to objects owned by the abc user.
The issue I'm getting is that when I try to execute GRANT SELECT ON xyz.view123 TO PUBLIC as the abc user, I get an insufficient privileges.I should add that the abc user created the xyz.view123 table/view.
What grants/priviliges or whatever do I have to do to the abc schema?
I have two schema named ODI_MASTER and ODI_WORK.Under ODI_WORK there are some tables like TEMP1, TEMP2 Further more when any new tables will create under ODI_WORK, then i need automatically grant select permission to ODI _MASTER schema.
for this purpose i choose trigger, and a Stored procedure.
CREATE OR REPLACE TRIGGER ODI_WORK.TRIG1 AFTER CREATE ON ODI_WORK.SCHEMA ENABLE call sp1 (ora_login_user)
[code]...
I searched a lot over blogs, if EXECUTE IMMEDIATE commands exist under Trigger it gets problem. Insert/update/delete statement on trigger seems no problem.
I am trying to find the unix process for one of my application in the database but I am unable to view the same. To simulate, I did the following.
1. My database runs on different server. 2. I invoked "sqlplus" from another unix box to login to the database. 3. I found that the process id (ps -ef |grep sqlplus). 4. When I execute the below mentioned query it does not display the process id that I am looking for. But the osuser, username, program and machine details are correct. How can I know the process details from the database?
SELECT SYS.GV_$SESSION.OSUSER, SYS.GV_$SESSION.USERNAME, SYS.GV_$PROCESS.SPID, SYS.GV_$SESSION.MACHINE, SYS.GV_$SESSION.PROGRAM, SYS.GV_$PROCESS.PROGRAM ,SYS.GV_$SESSION.SQL_ID FROM SYS.GV_$PROCESS, SYS.GV_$SESSION WHERE SYS.GV_$PROCESS.ADDR=SYS.GV_$SESSION.PADDR and SYS.GV_$SESSION.USERNAME='TEST' and SYS.GV_$SESSION.MACHINE like '%hostname%'
I am getting this error ( ORA-12516: TNS:listener could not find available handler with matching protocol stack ) When I am trying to connect to the server through my application in which I am using SOAP
I am trying to increase the size of sga or you can say that i want to make my sga in automatic memory management...Following is the steps i am trying
SQL> show parameter sga_max_size;
NAME TYPE VALUE ------------------------------------ ----------- ------------------------------ sga_max_size big integer 96M SQL>
after that i am trying to increase the size
SQL> alter system set sga_max_size = 200m; alter system set sga_max_size = 200m * ERROR at line 1: ORA-02095: specified initialization parameter cannot be modified
I have installed Oracle in workgroup, while i workgroup it is working fine. But latter I have change the server from workgroup to domain. At that time Oracle was not working , not able to connect. After that I change the Domain to workgroup again. And same problem exist. But I found that lsnrctl is working fine. But OracleServiceXXX is not able to startup in services.msc
I am installing Oracle 12c R1 on Windows 2012. The windows is configured as a domain controller. I am logged in as the domain administrator.I created a normal domain user -- DomainNameORACUSER. I provided this as the existing user id during Oracle installation.
The software installs fine, but when creating the DB using the database configuration assistant, an error is shown "error in process:...inoradim.exe. Enter password for Oracle service user: DIM-00019: create service error. O/S-Error: (OS 87) The parameter is incorrect". The DB is not created.
I skipped the db creation and completed the installation. When tried to create the db using the database configuration assistant after installation, I received the same error.I performed the same installation on Windows 8 and was successful in creating the db.
I have installed a database in D drive. I want to create another database in the same machine. I tried installing the new database using DBCA. Installation was ok. I added entry in TNS file.
When i try to login to this new database from other machine, i am unable to connect to this database. I made an entry in TNS on my local machine. It says the user id /password is wrong, even though they r correct. I am using the same password to delete the database.
When ever error occurred as "Unable to extend extent", we do add either datafiles or increase the size (autoextend on).But in a interview, i was asked to handle the error without increasing size/adding new datafiles.
how can i handle this error without increasing size?
I have setup a RAC machine of two nodes on Oracle 10GR2(with 10.2.0.4 Patchset). All setup went well. I am able to connect one node from sqlplus but the other node is connected to idle instance. I tried to startup the database with mount and nomount option but it fails. Following is the error :
SQL> startup nomount; ORA-01078: failure in processing system parameters ORA-01565: error in identifying file '+DATA/LCLCLKS/spfileLCLCLKS.ora' ORA-17503: ksfdopn:2 Failed to open file +DATA/LCLCLKS/spfileLCLCLKS.ora ORA-15077: could not locate ASM instance serving a required diskgroup SQL>
I am using ASM and it is running on both nodes even I am able to connect the SQL prompt from it. I am able to view the diskgroups I created from the second node but through "asmcmd" option I can't go inside the disk group. It gives :
ASMCMD> ls DATA/ INDEX/ ASMCMD> cd DATA asmcmd: diskgroup 'data' does not exist or is not mounted
On first node, everything is fine and I am able to import the database on it, as well.
when i try to install Oracle 10g (10.1.0.2) 64- bits on windows server 2003 enterprise edition 64 bits service pack1 and i try for windows server 2003 standard edition 64 bits on a pc,i am getting the below error.
the image file E: is valid, but it is for a machine type other than current machine
[code]SQL> set heading off SQL> set pagesize 0 SQL> set long 1000000 SQL> set feedback off SQL> select 2 dbms_metadata.get_ddl('TABLESPACE','TBLS_DATA') 3 from 4 dual 5 / ERROR: ORA-31603: object "TBLS_DATA" of type TABLESPACE not found in schema "JACK" ORA-06512: at "SYS.DBMS_SYS_ERROR", line 105 ORA-06512: at "SYS.DBMS_METADATA", line 2806 ORA-06512: at "SYS.DBMS_METADATA", line 4333 ORA-06512: at line 1
When i try to extract ddl of tablespace from a schema JACK, i get error.This tablespace TBLS_DATA does exist in the database.
I migrated one database ( DB1) from old database server to new database server where user accounts were locked before migrating the database.But migration was successful and database and accounts got created in new database server.
In old database server , user accounts status is locked and in new database server user accounts are open but still i am unable to connect to database using new user in new database server.
why im unable to connect to database whose accounts are open?
im new to DBA.i installed oracle on my pc but im not able to startup database...im manually creating database ..CRD files r still not created as im unable to startup nomount..im getting this error.
SQL> startup nomount ORA-24324: service handle not initialized ORA-24323: value not allowed ORA-03113: end-of-file on communication channel
i almost worked on this for 10 days but im getting the same error...
