Html db over-privileging

Question

I've looked at this in a previous release, and am curious if there is any way to prevent over-privileging when provisioning a workspace using 2.0.0.00.49?
Create a simple user:
SQL> create user htmldbtest identified by htmldb
  2  default tablespace htmldb
  3  temporary tablespace temp
  4  quota unlimited on htmldb;
User created.Now grant the user the only privileges it will require using the principle of least-privilege:
SQL> grant create session,
  2        create table
  3  to    htmldbtest;
Grant succeeded.-- provision a new workspace using the schema --
Let's see what roles and privileges the user has now:
SQL> col granted_role for a24
SQL> col admin_option for a12
SQL> col default_role for a12
SQL>
SQL> select   *
  2  from     dba_role_privs
  3  where    grantee = 'HTMLDBTEST'
  4  order by granted_role;
GRANTEE                        GRANTED_ROLE             ADMIN_OPTION DEFAULT_ROLE
HTMLDBTEST                     CONNECT                  NO           YES
1 row selected.Hey! - I didn't grant the CONNECT role. However, since I am using 10g Release 2, the grant is limited:
SQL> select   *
  2  from     dba_sys_privs
  3  where    grantee = 'CONNECT'
  4  order by privilege;
GRANTEE                        PRIVILEGE                                ADMIN_OPTION
CONNECT                        CREATE SESSION                           NO
1 row selected.But, let's look at the privileges that have now been directly granted to the user:
SQL> select   *
  2  from     dba_sys_privs
  3  where    grantee = 'HTMLDBTEST'
  4  order by privilege;
GRANTEE                        PRIVILEGE                                ADMIN_OPTION
HTMLDBTEST                     CREATE ANY CONTEXT                       NO
HTMLDBTEST                     CREATE CLUSTER                           NO
HTMLDBTEST                     CREATE DATABASE LINK                     NO
HTMLDBTEST                     CREATE DIMENSION                         NO
HTMLDBTEST                     CREATE INDEXTYPE                         NO
HTMLDBTEST                     CREATE JOB                               NO
HTMLDBTEST                     CREATE LIBRARY                           NO
HTMLDBTEST                     CREATE MATERIALIZED VIEW                 NO
HTMLDBTEST                     CREATE OPERATOR                          NO
HTMLDBTEST                     CREATE PROCEDURE                         NO
HTMLDBTEST                     CREATE SEQUENCE                          NO
HTMLDBTEST                     CREATE SESSION                           NO
HTMLDBTEST                     CREATE SYNONYM                           NO
HTMLDBTEST                     CREATE TABLE                             NO
HTMLDBTEST                     CREATE TRIGGER                           NO
HTMLDBTEST                     CREATE TYPE                              NO
HTMLDBTEST                     CREATE VIEW                              NO
17 rows selected.Ouch. I definitely don't want the user to have these privileges especially "CREATE DATABASE LINK", "CREATE LIBRARY", and "CREATE JOB". Rather than manually removing these excessive privileges ex post provisioning is there any option to prevent the granting?
Thanks,
Mark
[edit]
Changed "principal" to "principle"
[edit]
Message was edited by:
Mark A. Williams

Answer 1

Mark,
1. Principle.
2. No, there is no way to prevent it.
3. Your point is well understood. We've pared this back quite a bit in the XE release and I'm sure this change will be carried forward into all versions.
4. Future versions of the product will recognize if a user has obtained privileges via roles which will obviate much direct privilege granting.
Scott