Executing DDL over a DB Link

Question

Hi there gurus...
Version: Oracle Database 10g Enterprise Edition Release 10.2.0.4.0 - 64bit
As a test of something I wish to do, I'm submitting the following CREATE TABLE DDL statement as a job from within a schema over a dblink:
declare
v number;
begin
dbms_job.submit@GL_UPDATE_DBA(v,'
declare v varchar2(2000);
begin
execute immediate ''create table tempcb2 (x number)'';
exception when others then v := SQLERRM; insert into tempcb1 (x) values (v); commit;
raise;
end;');
commit;
end;The DB Link GL_UPDATE_DBA connects to a remote DB instance using a schema called SUPPORT_DBA.
When I run this code, the job is submitted fine within SUPPORT_DBA schema on the remote DB. However, an exception is captured and written to the table TEMPCB1 stating: ORA-01031: insufficient privileges.
When I check the job details on the remote DB using
SELECT * FROM USER_JOBSin the SUPPORT_DBA schema, the LOG_USER, PRIV_USER and SCHEMA_USER all list the proper value: SUPPORT_DBA.
From the documentation description of PRIV_USER, this job should be running with the privileges of SUPPORT_DBA and therefore, to my feable mind at least(!), should be able to create a table within that schema.
Why is the job unable to create a table in the SUPPORT_DBA schema?? Have I misinterpreted the way jobs (and their associated privs) work??
Thanks in advance...

Answer 1

Hi,
Supposedly anonymous PL/SQL blocks run always with invoker's rights but if you're using a fixed-user db link it makes me wonder... fixed should be the fixed user nevertheless. I wish I had another instance to test this here properly.
Anyways, I believe for it to work properly you will need to grant the relevant privileges to SUPPORT_DBA directly, NOT through roles.
Users connect using the username and password referenced in the link. For example, if Jane uses a fixed user link that connects to the hq database with the username and password scott/tiger, then she connects as scott, Jane has all the privileges in hq granted to scott directly, and all the default roles that scott has been granted in the hq database.http://download.oracle.com/docs/cd/E11882_01/server.112/e10595/ds_concepts002.htm
If it doesn't work regardless of the direct grants, could you post your create database link statement please (I don't wanna see the password :p )?