Determine fully access

Question

I am trying to determine whether a user has full access - or rather has all the access requirements that I request. I'd like to do this in a query, rather than in a procedure or function. If that's impractical, just tell me. I'm on 9i.
Each security listing is in it's own record. The requested security_object_id list will be dynamic. So in the list below, if I request (421,422,423,424) then admin_user_id 10 is the only one that has all of those accesses, so I want a return that gives me just that admin_user_id.
admin_user_id security_object_id
10 421
10 422
10 423
10 424
11 421
11 422
11 428
11 429
12 421
12 422
12 423
12 434
Right now, I have it working by querying for the list, grouping them and doing a count. Then I compare the the count to the number of items in the list. However, like the list will always change, so does the count. Currently, I'm adding the count using coldfusion, but I assume that there is a sql-only solution. Here is my current solution, using coldfusion.
SELECT ADMIN_USER_ID from
    (SELECT ADMIN_USER_ID,count(*) cnt from
        (SELECT    AU.ADMIN_USER_ID,ASA.security_object_id
        FROM    ADMIN_USER AU,
                    VW_ADMIN_SECURITY_ACCESS ASA
        AND        AU.ADMIN_USER_ID = ASA.ADMIN_USER_ID
        AND ASA.security_object_id in (421,431,433,434,420,432)  -- the count below and these numbers also by coldfusion
        GROUP BY AU.ADMIN_USER_ID,ASA.security_object_id)
    GROUP BY ADMIN_USER_ID)
WHERE cnt=#insert_num_from_coldfusion#;

Answer 1

Hi,
This would be a lot simpler if you had a table of the security_object_ids sought, one row for each id. You could create a global temporary table for this, and insert as many ids as you need. If you don't want to create a table, then you can use a WITH clause, and use its result set as a table.
Since you didn't post CREATE TABLE and INSERT statements for your osn table, I'll use scott,emp to illustrate. Instead of looking for users who have all of the given security_object_ids, we'll look for deptnos that have all of the given jobs.
First, let's create a table to hold the jobs in question:
CREATE GLOBAL TEMPORARY TABLE  target_jobs
(  job     VARCHAR2 (9)     PRIMARY KEY
ON COMMIT PRESERVE ROWS
;A global temporary table can be populated the same way as a regular table:
-- INSERT INTO target_jobs (job) VALUES ('ANALYST');
INSERT INTO target_jobs (job) VALUES ('CLERK');
INSERT INTO target_jobs (job) VALUES ('MANAGER');The following query finds the deptnos that have all of the jobs, regardless of how many there are (1 or more):
SELECT    e.deptno
FROM       scott.emp     e
JOIN       target_jobs     j  ON     j.job     = e.job
GROUP BY  e.deptno
HAVING       COUNT (DISTINCT e.job) = (
                               SELECT  COUNT (*)
                           FROM    target_jobs
;