Problem updating CLOBs across multiple schemas

Question

I am having a problem trying to update CLOB data in a schema owned by a user other than the logged-in user.
Suppose I have user UA who owns table TA and user UB who owns table TB, and TA and TB contain CLOB columns. TA owns a package PA and TB owns package PB; these packages provide functions for updating the CLOB data via LOB locators.
I have a JDBC connection logged on as user UA, and I can successfully call package PA to update the CLOB data in TA from my Java app. However, I cannot use this connection to similarly call package PB to update the CLOB data in TB - the app successfully calls CallableStatement.executeUpdate() but then I try to get the output stream of the returned CLOB:
oracle.sql.CLOB oOraClob = (oracle.sql.CLOB)oCall.getClob(SQLPAR_CLOBCOL);
Writer oOut = oOraClob.getCharacterOutputStream();
and I get the following exception on the getCharacterOutputStream() call:
java.sql.SQLException: ORA-01031: insufficient privileges ORA-06512: at "SYS.DBMS_LOB", line 498 ORA-06512: at line 1
This is despite user UA having execute privilege on PB and update on table TB.
I only get this problem when I try to update the CLOB directly from JDBC - I have another function in package PA which copies CLOB data directly from TA to TB and that works without any problem. Given this, I tried writing a procedure in PA to act as a kind of proxy between PB's CLOB-update function and user UA, i.e. UA calls a proc in PA which in turn calls PB which returns a LOB locator to PA, which in turn returns the LOB locator to user UA, but this still gave the same error.
Does anyone know what might be causing the problem? Is there some user permission I'm missing?
I don't want to have to use a separate DB connection as user UB just to update the CLOB. The only other solution I can see at present is to pass the string data to PA as a LONG and have PA copy the data to the LOB locator returned by PB. How could I achieve this? Is there a built-in function which enables a LONG to be copied to a CLOB?
Any help would be very much appreciated. Thanks.
Al.
null

Answer 1

Ian - You can use a different schema for each application while keeping the applications in a common workspace. This would allow users to authenticate once and for the applications to share the same authenticated session. In doing this, however, a user has to be given links from one application to another, e.g., from a menu page, in order for the "session continuity" to remain unbroken (a requirement to prevent another login challenge). But since these may be unrelated applications that have no need to access one anothers' session state, it might be better to use Single Sign-On. With this method there is only one login required and a user can access each application which will maintain its own private session.
Scott