Grant access to specfic schema

Is there any way that these permissions could be created without the ANY clause?
CREATE ANY CONTEXT
DROP ANY CONTEXT
EXECUTE ANY PROCEDURE
EXECUTE ANY TYPE
I got access to only one schema ..Client side DBA are not permitting access to "ANY" clause but they are ready to grant access like create context, drop context etc ..Is there any access like CREATE CONTEXT, DROP CONTEXT,EXECUTE PROCEDURE,EXECUTE TYPE for to give access to one user alone..etc ???
Advice me on this !!
Regards
dkoracle

Pl post details of OS and database versions.
Have you read the documentation ?
http://download.oracle.com/docs/cd/E11882_01/server.112/e26088/statements_5002.htm#i2060927
http://download.oracle.com/docs/cd/E11882_01/server.112/e26088/statements_8008.htm#i2099532
If so, what have you found ?
If not, I think it is time to read up !
Srini

Similar Messages

Grant access to all the views created in user schema to another schema

How to grant access for all the views created in own HAGGIS schema to comqdhb schema on the HAGGIS database.
Oracle Grant Privileges
===============
Object privileges assign the right to perform a particular operation on a specific object
I read that we can use select 'grant select on' ||view_name||'HAGGIS' user_views where owner='COMQDHB'
Is this right
Oracle System Privileges
===============
System privileges should be used in only cases where security isnt important,because a single grant statement could remove all security from the table
Role based security
============
Role security allows you to gather related grants into a collection-since the role is a predefined collection of privileges that are grouped together.privileges are easier to assign to users.
[http://www.dba-oracle.com/art_builder_grant_sec.htm]
can we grant select update to all the views at a time to the other schema.
Are there any other ways to secure the data other than creating users and assigning roles.
Thank you
Edited by: Trooper on Dec 23, 2008 9:24 AM

I think what was suggested was that you use SQL to generate the grants on each and every view, that is, you use SQL to generate SQL where the SQL being generated is "grant select on view_name to role'"
If you users to connect to Oracle you have to create usernames for them though if the users only connect via an application the application might run just as one user and access to the application is controled via application security. The control on the application can be via Directory Services such as OID or MS Active Directory. User access to Oracle can also be controlled via OID.
To connect to Oracle you can use OS authenication (not recommended), usernames with passwords, or via Advanced Security Option which supports single sign-on products like Kebros or Oracle Internet Directory etc....
Example using SQL to generate SQL
How do I find out which users have the rights, or privileges, to access a given object ?
http://www.jlcomp.demon.co.uk/faq/privileges.html
HTH -- Mark D Powell --

Grant access to all object/tables in other schemas to a user

Is there any and simple way to grant access to all object/tables in other schemas (more than one) to a scheme/user?
Thanks.
Tarman.

HI.
grant SELECT ANY TABLE,delete any table, insert any table to user; Giving this delete,insert ANY TABLE privilege to a user can be dangerous and the use can mislead it. Its better to create a dynamic script and then grant it.
E.g Suppose you want to give select,inert,delete,update privileges to user A on user B's object.
sql> spool grants.sql
sql> select 'grant select,insert,update,delete on '||owner||'.'||table_name||' to A;' from dba_tables where owner='B';
sql>@grants.sqlHTH
Anand

Accessing a different schema in Oracle

Hi,
I currently have a great deal of code that assumed it would have access to the same database schema as the logged on user e.g.
"Select * from TABLE_NAME" (no need to specify schema name).
I have found out that we will now be using a system where the user that logs on, will be granted select, update and delete priviledges on another schema. So now after setting up the connection, my code would have to read: "Select * from ANOTHER_SCHEMA.TABLE_NAME" where ANOTHER_SCHEMA is the schema that contains the tables.
My question is, since I would have to modify a great deal of code at this point, is there any way to change the user on an existing connection so that I would not have to manually affix the new schema name to all table references? I would have to be able to do this without logging on as this alternate user since we will not have the password for that user (for security reasons).
I have considered creating views in the initial schema that access the alternate schema (e.g CREATE VIEW TABLE_NAME AS SELECT * FROM ANOTHER_SCHEMA.TABLE_NAME), however I was wondering if there might be a better way to do this?

Yes he would have to change his code. I am just used to using "S_" and it is the standard Oracle naming convention for synonyms. (Also it makes it clear that you are referencing the table via a synonym rather than hitting the table directly.
Why not encode all table names in an abstract class.
Eg
package utils;
public class TableNames
public static final String TABLE_NAME1 = "S_TABLE_NAME1";
public static final String TABLE_NAME2 = "S_TABLE_NAME2";
//etc etc
This class can then be used in the building of sql statements. If the table name happens to change at any time then a change is only required in TableNames class.

Create a user that can only access to one schema - please help!!

Hi all,
I want to create one user in a Oracle DB that can only access to one schema. I did the following:
CREATE USER "TEST" PROFILE "DEFAULT"
IDENTIFIED BY "test" DEFAULT TABLESPACE "USERS"
TEMPORARY TABLESPACE "TEMP"
ACCOUNT UNLOCK;
GRANT SELECT ON "TESTDTA"."F0007" TO "TEST"
GRANT "CONNECT" TO "TEST";
I have done a test and the user TEST can access all schemas, when I only gave explicit permissions to the schema TESTDTA.
Any suggestion/clarification???
Many thanks in advance.
Víctor.

Hello Andreas and Pavan,
I have launched the query:
select * from dba_tab_privs
where grantee = 'PUBLIC'
and owner = 'PRODDTA'
and table_name= 'F0009';
And the result:
GRANTEE OWNER TABLE_NAME GRANTOR PRIVILEGE GRA HIE
PUBLIC PRODDTA F0009 PRODDTA ALTER NO NO
PUBLIC PRODDTA F0009 PRODDTA DELETE NO NO
PUBLIC PRODDTA F0009 PRODDTA INDEX NO NO
PUBLIC PRODDTA F0009 PRODDTA INSERT NO NO
PUBLIC PRODDTA F0009 PRODDTA SELECT NO NO
PUBLIC PRODDTA F0009 PRODDTA UPDATE NO NO
PUBLIC PRODDTA F0009 PRODDTA REFERENCES NO NO
PUBLIC PRODDTA F0009 PRODDTA ON COMMIT REFRESH NO NO
PUBLIC PRODDTA F0009 PRODDTA QUERY REWRITE NO NO
PUBLIC PRODDTA F0009 PRODDTA DEBUG NO NO
PUBLIC PRODDTA F0009 PRODDTA FLASHBACK NO NO
11 rows selected.
Then I supose that I have to change the value on column GARANTEE. How can I do that?
Thanks a lot for your help!!
Víctor.

GRANT ACCESS with sys user

hi
i have an user with objects, tables, views and procedures but it doesn't´t have dba privileges... how can i grant access to all the user to these objects? (with the sys or system user).
thanks for your help.
alex

Hello,
Every user in database has its objects and DBA privileges are not for everyone.
how can i grant access to all the user to these objects? (with the sys or system user)<<<<<<Can explain these lines ?? What's your requirment ?? Please state clearly...
As far as i got your problem, you require that all other users of databse should be able to access the objects of user (lets say A) which you specified in first line.
For this purpose create public synonyms for all objects of user A and grant. So, everyone can use the objects of "A's" schema.
Please update..... if you got the point or not...

Stopping apps access to certain schemas

Hi
I trying to implement an fga solution in oracle e-business suite, however after creating the custom schema and users. The apps user still has access to the tables, procedures created this is despite not adding grants etc.. This means anyone with the apps password could theoritically tamper with the data stored here. I was wondering if there was a way to block APPS access to tables, schemas.
thanks for any help

ORA-01927: cannot REVOKE privileges you did not grantPlease see these docs.
OERR: ORA 1927 original grantor must REVOKE privileges (Doc ID 19216.1)
ORA-1927 While Revoking Object Privileges as the Object Owner (Doc ID 121384.1)
Revoking Privileges On A Package Errors Out with ORA-1927 (Doc ID 471863.1)
Unable to Revoke Rights from Object Owner (Doc ID 170973.1)
Thanks,
Hussein

Sql server grants access to specific login to database.

i have created website for intranet and hosted it on server. for that i needed to create login "IIS APPPOOL\hi" in sql server 2008 for my application
to access my "reportdb" database. "IIS APPPOOL\hi" has sysadmin and public server roles in sql server 2008. And i have default login"sa" same
as "IIS APPPOOL\hi". these are working correctly. Now I want these two logins to access"reportdb" for all
operations in database and remaining all logins should be denied to access"reportdb". My Sql Server 2008 is having mixed mode (windows authentication and Sql authentication). plz help me

I think what Tauseef is requesting is to keep access for the 2 sysadmins & deny access to everyone else, correct?
As Uri mentioned, by being part of sysadmin role, “IIS APPPOOL\hi” & “sa” would have access to everything in the server, and nobody else should have access to the DB unless explicitly being granted access.
If you would really deny anyone else access to the database, you can potentially deny connect to public, and only sysadmins (who override permissions) would be able to connect; although I would strongly recommend against such practice.
Something else I would like to recommend against is the usage of sysadmin for what may not be a DBA role (IIS appPool). Following the least-privilege principle, I would recommend having a non-administrator user for applications that has enough capabilities
to perform the tasks needed.
The main risk is that a SQL injection (SQLi) bug in your application would lead to a complete compromise of your SQL server.
If there are app tasks that would require elevated permissions, I would recommend encapsulating the logic in a stored procedure and either use impersonation or digital signatures to accomplish a controlled elevation of privileges instead. If you have any
question on this topic I will be glad to assist.
I hope this information helps,
-Raul Garcia
SQL Server Security
This posting is provided "AS IS" with no warranties, and confers no rights.

Update to IOS 6 has been a nightmare. Facebook would allow me to save pictures unless I granted access to my foto album. Does this mean my pictures are going be planted all over the web? The safari keeps crashing and loading is slow.

update to IOS 6 has been a nightmare. Facebook would allow me to save pictures unless I granted access to my foto album. Does this mean my pictures are going be planted all over the web? The safari keeps crashing and loading is slow. Most infuriating is that YouTube was deleted from my entertainment apps and I now have to pay for it if I want it back!! This is a bloody disgrace.

Back up all data.
Boot into Recovery by holding down the key combination command-R at the startup chime. Release the keys when you see a gray screen with a spinning dial.
Note: You need an always-on Ethernet or Wi-Fi connection to the Internet to use Recovery. It won’t work with USB or PPPoE modems, or with proxy servers, or with networks that require a certificate for authentication.
When the OS X Utilities screen appears, follow the prompts to reinstall the OS. You don't need to erase the boot volume, and you won't need your backup unless something goes wrong. If your Mac was upgraded from an older version of OS X, you’ll need the Apple ID and password you used to upgrade, so make a note of those before you begin.

Why doesn't Photoshop touch ask for access to local photos on my iPad so I can grant access and edit?

Why doesn't Photoshop touch ask for access to local photos on my iPad so I can grant access and edit?

That's odd. Does this mean that you want to have the request or that you can't see the photos even though you enabled it over the privacy/photos?
If you enable it - it's not necessary to get the request. If you want the request the safest way to get it back is to reset the privacy settings by going to iPad settings/General/Reset/Reset Location & Privacy
thanks,
Ignacio

Problem Granting access on Business Area to Role

Hello everybody,
I am trying to grant access on a Business Area to a role but when I try to do so, the role does not appear in role list. It only shows role connect and resource.
The version of Discoverer I am using is 10.1.2.
Anyone has the same issue?
Phil
Message was edited by:
[email protected]
Message was edited by:
[email protected]

Hello everybody,
I am trying to grant access on a Business Area to a role but when I try to do so, the role does not appear in role list. It only shows role connect and resource.
The version of Discoverer I am using is 10.1.2.
Anyone has the same issue?
Phil
Message was edited by:
[email protected]
Message was edited by:
[email protected]

How to grant access to sharepoint for the user from different Domain

Hi All
I need to grant access to user from different domain.
Where I can able to view the users in people picker (different domain).
Thanks in Advance.
Raj

Hi
Trevor Seward
Sorry to disturb
you again.
I am trying to restrict user from search from other domain, say we have domain A and Domain B, where I am trying to restrict all the user from domain B (Search users)for a site collection. I have found couple of stsadmin command to do so. but none
of them works. Below are the commands I have tried
STSADM.exe -o setproperty -pn peoplepicker-searchadforests -pv "domain:<Name>.domain" -url "http://Site URL"
stsadm -o setproperty -pn peoplepicker-searchadcustomquery -pv “(canonicalName=<Name>.domain*)” -url "Site URL"
we have two way trust.
Can you suggest any solution.
Thanks
Raj

Grant access to individual content

Hello,
I'm currently implementing a UCM solution and I came upon a customer requirement that I don't even know if it is possible to implement with UCM.
I will try to explain by giving an example:
The company has 2 Departments: Department 1 and Department 2 and for each department it was created a Security Group.
SG_DEP_1 for Department 1 and SG_DEP_2 for Department 2.
The company also has 2 users, one for each department, with full accesses:
BOB_1 has RWDA to SG_DEP_1 and EDDIE_2 has RWDA to SG_DEP_2.
Each user can manage its own Security_group, but what happens if BOB_1 needs to show a document to EDDIE_2 (example: for asking EDDIE_2 for an legal advice on a given document). Could BOB_1 grant read access to EDDIE_2 on that specific document ? (I'm not talking about granting access to SG_DEP_1, just the document).
Note: in my specific projects, there are at least a dozen Departments, each tightly secured, but with needs to show 'some' content on a daily basis. What the customer really needs it the hability to specify access permissions individually on each content item (groups or specific users).
How would you implement such a use case? I'm starting to consider the possibility on having to implement a BPM, or something like that to provide this level of control.
Thanks
Luís Duarte
Edited by: user10359998 on Sep 25, 2008 4:19 AM

Hi!
In the HowtoComponents, there is a component named "SecurityFilter" :
"This component demonstrates how to use the 'alterUserCredentials' filter to temporarilly boost a user's security privileges for one request. This filter is useful for dynamicly granting accounts and roles for specific service requests, or for specific users." quoting the readme of the component.
You can download it there : http://www.oracle.com/technology/products/content-management/ucm/samples/index.html
Hope it helps!
romain.

Grant access to DBlink

We are facing a small issue . the problem is as follows.
=========================================================
1. I have two databases
     Namely
          Database1
          Database2
2.Database2 has a table say EMP
3.I want to select , insert update EMP from Database1
4.Hence I have created a db link in Database1 named Dblink1
5. I don't want to user the @ symbol (alias -- EMP@Dblink1) in my query. I just want to access directly.
6. When I tried to give grant access from Database1 , It gives me an error.
Please suggest how to acheive this

5. I don't want to user the @ symbol (alias -- EMP@Dblink1) in my query. I just want to access directly.This is simply not possible to access the table which is in another database without using dblink. i..e you have to have the dblink to access the other database tables.
>> 6. When I tried to give grant access from Database1 , It gives me an error.
What's error you got??
Regards,
Sabdar Syed.

Grant access to application

Hi All,
I am working with Olite 10gR2;
I created and deployed my application with data subsetting parameter using wtgpack; I published the application successfully.
I then created a group and granted access to my application to the group.
I created user's and added the users to the group. This worked fine last week in dev and I was able to add all 90 users to the group.
Problem: I was able to add two users now; when I tried adding a third user I got this error message -
"Error in executing " Save application ":oracle.lite.web.resource.ResourceException: CONS-10049: Consolidator Exception: Closed Statement "
When I tried granting access to my application, to individual users as an alternative to adding users to group with access to the application, I get this error;
Error Message: "Virtual Path Is Null"
I will appreciate any solution on this error message. I need to be able to add more users to the group.
Thanks for your time.

I created a servlet filter for faces-servlet
Don't map filter to servlet.
Use URL mapping, something like:
<filter-mapping>
<filter-name>YourFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
Also have a question about ReadOnlySQLAuthenticator. Mentioning sensitive queries like query to get the password of the user from the table etc, is it secure? will it lead to any type of security threat like if a user get access to console and get the query etc?
Your sql queries shouldn't be 'sensitive'
Best practice is to store secure hash(for example: SHA1 or better) instead of encrypted password.
(ReadOnly)SQLAuthenticator can use encrypted passwords or secure hash(check Provider Specific Configuration). To make this to work, you will need to create secure hash and append {ALGORITHM_TYPE} to begin of hash.
For example: {SHA1}asdsijifndfbj=
And of course, you need to protect your WLS admin console(and enterprise manager, if deployed).
Use strong admin password and restrict access to console url (if possible).
Dario

Grant access to specfic schema

Similar Messages

Maybe you are looking for