Definer rights vs. user rights

Question

I must be having a senior moment .... ;-)
Trying to demo definer rights vs. user rights on execution of a procedure.. With apologies to Daniel, I created this test, and then in trying to find the answer to my question I found his nearly identical example at psoug.
SQL> --
SQL> conn system/halftrack@vmora01
Connected.
SQL> drop user bert cascade;
User dropped.
SQL> drop user ernie cascade;
User dropped.
SQL> drop role ernies_role;
Role dropped.
SQL> --
SQL> create user bert identified by bert
  2  default tablespace users
  3  temporary tablespace temp
  4  quota 10m on users;
User created.
SQL> --
SQL> grant create session, create table, create procedure to bert;
Grant succeeded.
SQL> --
SQL> create table bert.berts_table (empid varchar2(15));
Table created.
SQL> --
SQL> CREATE OR REPLACE PROCEDURE bert.user_test  AUTHID current_user IS
  2  v_empcnt number;
  3  BEGIN
  4   select count(*)
  5   into v_empcnt
  6   from bert.berts_table;
  7  END user_test;
  8  /
Procedure created.
SQL> --
SQL> CREATE OR REPLACE PROCEDURE bert.definer_test  AUTHID DEFINER IS
  2  v_empcnt number;
  3  BEGIN
  4   select count(*)
  5   into v_empcnt
  6   from bert.berts_table;
  7  END definer_test;
  8  /
Procedure created.
SQL> --
SQL> create user ernie identified by ernie
  2  default tablespace users
  3  temporary tablespace temp
  4  quota 10m on users;
User created.
SQL> --
SQL> create role ernies_role;
Role created.
SQL> --
SQL> grant create session to ernies_role;
Grant succeeded.
SQL> grant select on bert.berts_table to ernies_role;
Grant succeeded.
SQL> grant execute on bert.definer_test to ernies_role;
Grant succeeded.
SQL> grant execute on bert.user_test to ernies_role;
Grant succeeded.
SQL> grant ernies_role to ernie;
Grant succeeded.
SQL> --
SQL> conn ernie/ernie@vmora01
Connected.
SQL> --
SQL> -- this should succeed
SQL> --
SQL> execute bert.user_test;
PL/SQL procedure successfully completed.
SQL> --
SQL> -- this should fail --
SQL> --
SQL> execute bert.definer_test;
PL/SQL procedure successfully completed.
SQL> spo offOk, the only rights ernie has are via ernies_role. So I would expect his execution of bert.definer_test to fail, but it didn't.

Answer 1

mbobak wrote:
Hi Ed,
In the definer rights case, as long as ernie can execute the procedure owned by bert, he'll be able to successfully execute it, cause definer rights mean that the object (owned/defined by bert) executes w/ bert's rights, and the only object access in the procedure is on bert's objects. So, no problem there.
In the invoker rights case, it works cause even though the proc is owned by bert, ernie is executing and so, rights have to be granted to ernie, and they are.
I don't see a problem in either case. Am I missing something?
My guess is, what you're overlooking is the fact that, in the case of invokers rights, it's ok for necessary privileges to be granted via a role. The restriction against roles, is only on a definers rights procedure.
-Mark
PS See here for more info:
http://download.oracle.com/docs/cd/E11882_01/network.112/e10574/authorization.htm#DBSEG50010
Ok, as I read the explanation in the linked reference, that makes sense. So now I'm having a hard time imagining the situation where inheriting privs via a role comes into play as a problem in dealing with pl/sql blocks.