HELP - ALTER USER

Question

Hi,
Here is the situation:
- When I use "FORMS_DLL(alter user....)" inside the Forms, it's ok.
- When I use "EXECUTE IMMEDIATE('alter user....)" inside a Package, it gives me an error: "Insuficient Privilegies".
The user has permission to execute the package. The "execute immediate" is ok when using another command, like "alter table", "create table", etc...
What's the problem? Is there another command to grant the usage of "alter user" inside the package?
Thanks!

Answer 1

SQL> CREATE SYNONYM t_syn FOR dept;
Synonym created. I have ROLE for creating synonyms but not direct privilege thats why i can create
synonoym from SQL through ROLE but for creating synonyms through procedure
ROLE are ignored or volatile for stored procedure to get it done from procedure
you should have DIRECT PRIVILEGE.You have privilge through ROLE not
DIRECT PRIVILEGE.
SQL> create or replace procedure cpr (p in varchar2)
  2  as
  3  begin
  4  execute immediate 'create synonym syn_'||p||' for a';
  5  end;
  6  .
SQL> /
Procedure created.
SQL> execute cpr('A');
BEGIN cpr('A'); END;
ERROR at line 1:
ORA-01031: insufficient privileges
ORA-06512: at "SCOTT.CPR", line 4
ORA-06512: at line 1
With Invoker Right using AUTHID CURRENT_USER privileges are checked at
runtime not Role so below code will run successfully
SQL> create or replace procedure cpr (p in varchar2)
  2      AUTHID CURRENT_USER  
  3  as
  4  begin
  5  execute immediate 'create synonym syn_'||p||' for a';
  6  end;
  7  .
SQL> /
Procedure created.
SQL> execute cpr('A');
PL/SQL procedure successfully completed.You can get it done by getting direct privilege as well creating synonyms on the fly
using stored procedure if you give DIRECT PRIVILEGE.
SQL> GRANT CREATE SYNONYM TO scott;
Grant succeeded.
SQL> create or replace procedure cpr (p in varchar2)
  2  as
  3  begin
  4  execute immediate 'create synonym syn_'||p||' for a';
  5  end;
  6  .
SQL> /
Procedure created.
SQL> execute cpr('B');
PL/SQL procedure successfully completed.
As documented
The reason is that, for a definer's rights procedure, the database checks privileges
at compilation time, not at execution time. That is, the database verifies that the
owner of the procedure has necessary privileges--granted directly, not through a
role--at the time the procedure is compiled.
Khurram