Permissions issues on views referencing other users [solved]

Question

Hi,
I've hit a (for me) unexplainable problem;
Situation:
- Table T in schema A
- View V in schema B, referencing the table T from schema A (B has SELECT/REFERENCES privileges on table T)
- User C gets ORA-01031 when trying to SELECT from view V (C has SELECT/REFERENCES privileges on V and T)
In my eyes, user C has more privileges than needed to get the results from view V. Nevertheless, Oracle thinks he has insufficient privileges.
Anyone catches what I'm missing or bumped into the same issue?
Thanks for any comments,
K
(10.2.0.2 Linux 64bit Enterprise)

Answer 1

A wouldn't give access WITH GRANT OPTION to B if B wasn't trusted to
propagate to other users, but what if he isn't?
I'm not saying WITH GRANT OPTION is bad, it's actually very useful in
probably 99% of the cases. I just don't know why it's enforced to be used.I'm not understanding what you're not understanding.
When A grants SELECT on a table to B what they are granting is permission for B and B only to see that data. If B wants a third user C to view A's data there are two options:
(1) B asks A to explictly grant SELECT to C
(2) B asks A to grant them SELECT WITH GRANT OPTION
It doesn't matter whether B wants C to have direct access to A's table or to mediate it through a view of their own, B cannot grant privilege's on A's data to anybody else unless A approves it.
The advantage of granting SELECT WITH GRANT OPTION to B is that A doesn't have to bother issuing lots of grants to people B wants to share with. The downside is that B has to be trusted. If B turns out to be untrustworthy then REVOKE SELECT FROM B must withdraw access not only from B but from every other user who was granted by B.
Note that even if A has grant SELECT to C, if A revokes SELECT WITH GRANT OPTION from B than C will not be able to use B's view on A's table either though C can directly select the data from A's table....
SQL> conn a/a
Connected.
SQL> grant select on t to b with grant option
  2  /
Grant succeeded.
SQL> grant select on t to c
  2  /
Grant succeeded.
SQL> conn b/b
Connected.
SQL> grant select on v to c
  2  /
Grant succeeded.
SQL> conn c/c
Connected.
SQL> select * from b.v
  2  /
        C1 C
         3 C
SQL> conn a/a
Connected.
SQL> revoke select on t from b
  2  /
Revoke succeeded.
SQL> conn c/c
Connected.
SQL> select * from b.v
  2  /
select * from b.v
ERROR at line 1:
ORA-04063: view "B.V" has errors
SQL> conn a/a
Connected.
SQL> grant select on t to b
  2  /
Grant succeeded.
SQL> conn c/c
Connected.
SQL> select * from b.v
  2  /
select * from b.v
ERROR at line 1:
ORA-01031: insufficient privileges
SQL> select * from a.t
  2  /
        C1 C
         1 A
         2 B
         3 C
SQL> So the architecture is quite watertight. Perhaps the problem is that this is not how it's working in your production system. But I would be very surprised if your production system was broken in the way you describe. More likely is that there is some missing part of the jigsaw. But without a complete dump of your system's granted privileges it is hard for us to say what's wrong.
Cheers, APC
Blog : http://radiofreetooting.blogspot.com/