Query dba_users, dba_role_privs, dba_sys_privs

Hi Guys,
I'm currently documenting a database users/role/sys privs in ms word document.
My sql script will actually result in cartesian product making the documentation very huge in size.
Any solution i can reduce the amount of duplicate roles or any better idea?
SELECT U.USERNAME,
U.DEFAULT_TABLESPACE,
U.PROFILE,
SP.PRIVILEGE,
RP.GRANTED_ROLE
FROM DBA_USERS U,
DBA_SYS_PRIVS SP,
DBA_ROLE_PRIVS RP
WHERE (U.USERNAME =SP.grantee
or U.USERNAME =RP.GRANTEE)
and u.account_status = 'OPEN'
order by 1,2,3,4,5;
thanks

What is the version of your database? If >= 10, then use the EM to generate the report.
regards

Similar Messages

Outer join (with (+)) does not work

I started with a working SQL statement:
SELECT DISTINCT username, r.granted_role
FROM dba_users u, dba_sys_privs s, dba_tab_privs t, dba_role_privs r
WHERE u.username = s.grantee
AND u.username = t.grantee
AND u.username = r.grantee
ORDER BY username, r.granted_role;
Fine, now I want to add two columns which indicate which of the users have SYSDBA and SYSOPER privileges.
As in another post told this can be achieved by:
SELECT * FROM V$PWFILE_USERS;
When I want to merge these two SQL statements I need an outer join but the following does not work:
SELECT DISTINCT u.username, r.granted_role, v.SYSDB, v.SYSOP
FROM dba_users u, dba_sys_privs s, dba_tab_privs t, dba_role_privs r, V$PWFILE_USERS v
WHERE u.username = s.grantee
AND u.username = t.grantee
AND u.username = r.grantee
AND u.username = v.username(+)
ORDER BY u.username, r.granted_role;
I got an error message:
SELECT DISTINCT u.username, r.granted_role, v.SYSDB, v.SYSOP
ERROR at line 1:
ORA-06553: PLS-306: wrong number or types of arguments in call to 'V'
Why?

Run this
SELECT DISTINCT u.username, r.granted_role, v.SYSDBA, v.SYSOPER
           FROM dba_users u,
                dba_sys_privs s,
                dba_tab_privs t,
                dba_role_privs r,
                v$pwfile_users v
          WHERE u.username = s.grantee
            AND u.username = t.grantee
            AND u.username = r.grantee
            AND u.username = v.username(+)
       ORDER BY u.username, r.granted_role;- - - - - - - - - - - - - - - - - - - - -
Kamran Agayev A. (10g OCP)
http://kamranagayev.wordpress.com

User rights

Good day,
I was wondering how to get a user privileges using SQL*PLUS. I've checked some of my books and could only find this using oracle graphical tools. There must be a statement that could be execute on the command line to get these informations on a user or on a group???
TIA
Flip

Here's a scripts I found a while back. May need some tweeking since it run slows
set echo off
set feedback off
set pagesize 50000
set linesize 200
col "Username" for a18
col "Obj Owner" for a14
col "Obj" for a30
col "Obj Priv" for a10
col "Sys Priv" for a24
col "Granted Role" for a22
col "dummy" noprint
break on "User"
spool \mydocs\scripts\userprivinventory.txt
select username "Username", owner "Obj Owner", table_name "Obj", privilege "Obj Priv",
' ' "Sys Priv", ' ' "Granted Role", 1 "dummy"
from dba_users u, dba_tab_privs t
where u.username = t.grantee
and u.username not in ('SYS','SYSTEM','DBSNMP')
UNION
select username, ' ', ' ', ' ', privilege, ' ', 2 "dummy"
from dba_users u, dba_sys_privs s
where u.username = s.grantee
and u.username not in ('SYS','SYSTEM','DBSNMP')
UNION
select username, ' ', ' ', ' ', ' ', granted_role, 3 "dummy"
from dba_users u, dba_role_privs r
where u.username = r.grantee
and u.username not in ('SYS','SYSTEM','DBSNMP')
order by 1, 7
spool off
set feedback on
set echo on
null

Why I cannot select on user_tables, user_views etc when I am DBA?

I came across something odd:
I am logged on as DBA, when I do:
Select * from user1.user_tables
It gives me
ERROR at line 1:
ORA-00942: table or view does not exist
I know I can use:
Select * from dba_tables where owner = ‘USER1’
but I am DBA and I can do select on every other thing in USER1 schema; why do I get errors on such statements.

Run the following, send the results :
DEFINE B='YOUHRIS'
Prompt USER INFORMATION
SELECT
' User '||username||'''S Account Information',
' Account Status => '||Account_status,
' Default Tablespace => '||default_tablespace,
' Temp Tablespace => '||temporary_tablespace
from dba_users where username=upper('&&B')
prompt OBJECTS OWNED BY USER
select a.username LoginId,
'User '||nvl(b.owner,'Does Not Own any objects..') ||' Owns ' ||nvl(b.cou,0)|| ' Nos Of ' ||nvl(b.object_type,'Objects')
FROM
dba_users a,
(SELECT OWNER,OBJECT_TYPE,COUNT(OBJECT_NAME) cou FROM DBA_OBJECTS GROUP BY OBJECT_TYPE,OWNER ORDER BY OWNER,OBJECT_TYPE) b
where a.username=b.owner (+) and a.username=upper('! &&B')
Prompt SYSTEM PRIVIELGES GRANTED TO THE USER
SELECT
nvl(b.grantee,'No_System_Privileges_Granted'),nvl(b.privilege,'null')
from
dba_users a,dba_sys_privs b
where a.username =b.grantee(+) and grantee=upper('&&B')
Prompt ROLES GRANTED TO THE USER
SELECT
nvl(b.grantee,'No_Roles_Granted'),nvl(b.granted_role,'null')
from
dba_users a,dba_role_privs b
where a.username =b.grantee(+) and grantee=upper('&&B')
Oded
[www.dbsnaps.com]
[www.orbiumsoftware.com]

Database 9. Generate SQL

Dear people,
I have inherited a database which is running version 9.
I would like to generate a SQL file(s) which have been used to build the database (rather than have to use Enterprise Manager).
With this SQLserver this is possible, and to my great horror an Oracle certified DBA told me its not possible. One has the option apparently when you build a database with the "configuration assistant" but I already have the DB.
Would appreciate any replies on this matter.
Kind regards,
Ben Bookey.

Ben:
Your DBA is partly correct. There is no easy way to generate the scripts required to re-build a database, but it is possible. What Oracle considers a database is a little different than what SqlServer considers a database, a SqlServer database is closer to an Oracle tablespace (although not exactly the same).
Manually creating an Oracle database is a five step process.
1. Create a parameter file
2. Create the base database (i.e system tablespace and Oracle's metadata tables)
3. Create rollback segments
4. Create additional tablespaces for user data etc.
5. Run Oracle supplied catalog scripts.
You can get most of the information you need to generate the CREATE DATABASE command by running:
ALTER DATABASE BACKUP CONTROLFILE TO TRACE
then editing the resulting file.
The views DBA_TABLESPACES and DBA_DATA_FILES will give you the information you need to re-create the tablespaces.
DBA_ROLLBACK_SEGS will allow you to generate the CREATE ROLLBACK SEGMENT scripts.
If you need to re-create users and rolls, then DBA_USERS, DBA_ROLES, DBA_TAB_PRIVS, DBA_ROLE_PRIVS, DBA_SYS_PRIVS and possibly DBA_TAB_PRIVS can give you the required information.
Tables can be generated from DBA_TABLES and DBA_TAB_COLUMNS, indexes from DBA_INDEXES and DBA_IND_COLUMNS, and constraints from DBA_CONSTRAINTS and DBA_CONS_COLUMNS.
Triggers can be found in DBA_TRIGGERS. Other things like functions, procedures and packages can be generated from DBA_SOURCE.
As I said, not easy, but possible. There are lots of scripts out there that do some or all of this.
HTH
John

Creating user in oracle through JDBC

I m trying to create a user in oracle through jdbc. When I m creating user through SQL plus I m able to do it successfully but when I m doing it through java code I can see that user�s entry in dba_users & dba_role_privs tables.But when I am trying to drop that user I get message �User doesn�t exist�. Also when I am trying to logged in through the newly created user (one that I have created through code)in SQL Plus , I get error �ORA-01017: invalid username/password ; logon denied�.If user doesn�t exist then how can I see it�s entry in dba_users & dba_role_privs?? One more thing �. I can drop that user through code but not using SQL Plus.
This is the code�.In this code I have logged in using system-manager & I m trying to create user test88 with password test88.I am granting 3 roles to this user Connect , Resource & DBA same as Scott �Tiger. Please help.
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;
import java.sql.Statement;
public class OracleDB1 {
public static final String isSUCCESS = "SUCCESS";
public static final String isORACLE = "ORACLE";
public static final String isFail = "ERROR";
public String dbDriver;
public String dbURL;
public String dbUserName;
public String dbName;
public String dbPassword;
public String dbType;
private Connection con;
private Statement stmt;
* @param s Username
* @param s1 Indentified by
* @param s2 tablespace
* @param s3
* @return
* @throws SQLException
* @throws ClassNotFoundException
public String createUserOracle(String s, String s1, String s2, String s3)
throws SQLException, ClassNotFoundException {
System.out.println("Creating user method ");
String s4 = "";
if (!s2.equals("")) {
if (!s3.equals("")) {
s4 = new String("CREATE USER \"" + s + "\" IDENTIFIED BY \""
+ s1 + "\" DEFAULT TABLESPACE " + s2 + " QUOTA " + s3
+ " ON " + s2);
else {
s4 = new String("CREATE USER \"" + s + "\" IDENTIFIED BY \""
+ s1 + "\" DEFAULT TABLESPACE " + s2
+ " TEMPORARY TABLESPACE TEMP QUOTA UNLIMITED ON " + s2);
else {
s4 = new String("CREATE USER \"" + s + "\" IDENTIFIED BY \"" + s1
+ "\"");
try {
con = this.init();
System.out.println("The new user statemeent " + s4);
stmt = con.createStatement();
System.out.println("The new user statemeent " + s4);
stmt.execute(s4);
System.out.println("the info success "+stmt.SUCCESS_NO_INFO);
stmt.close();
} finally {
if (null != con) {
con.close();
return "SUCCESS";
public String grantRightsOracle(String s)
throws SQLException, ClassNotFoundException
String s1 = new String("GRANT connect , resource , dba to \"" + s + "\"");
try
con=this.init();
stmt = con.createStatement();
System.out.println("granting "+s+"with the connect priveleges");
stmt.execute(s1);
stmt.close();
finally
if(null != con)
this.close(con);
return "SUCCESS";
public Connection init() throws SQLException, ClassNotFoundException {
System.out.println("initialising");
Class.forName("oracle.jdbc.driver.OracleDriver");
dbURL = "jdbc:oracle:thin:@localhost:1521:priya";
con = DriverManager.getConnection(dbURL, "system", "manager");
return con;
public void close(Connection connection) throws SQLException {
if (!connection.isClosed()) {
connection.close();
public String disableUserOracle(String s) throws SQLException,
ClassNotFoundException {
String s1 = "REVOKE CONNECT, RESOURCE, SELECT ANY TABLE FROM \"" + s
+ "\"";
try {
con = this.init();
stmt = con.createStatement();
stmt.execute(s1);
stmt.close();
} finally {
if (null != con) {
this.close(con);
return "SUCCESS";
public String deleteUserOracle(String s) throws SQLException,
ClassNotFoundException {
String s1 = new String("DROP USER \"" + s + "\" CASCADE");
try {
con = this.init();
stmt = con.createStatement();
stmt.execute(s1);
stmt.close();
} finally {
if (null != con) {
this.close(con);
return "SUCCESS";
public static void main(String args[]) {
String s = "";
OracleDB1 oracleoperations = new OracleDB1();
try {
System.out.println("creating user");
s = oracleoperations.createUserOracle("test88", "test88", "", "");
System.out.println("creating user is " + s);
s=oracleoperations.grantRightsOracle("test88");
System.out.println("granting rights" + s);
//s=oracleoperations.deleteUserOracle("test88");
//System.out.println("deleting user" + s );
} catch (Exception exception) {
exception.printStackTrace();

I read that by default, JDBC uses an operation mode called auto-commit. This means that every update to the database is immediately made permanent.Still for this program I have tried connection.commit() also , Still it is not working.
I think that problem is not with commit otherwise I shouldn't be able to see that newly created user entry in these tables from Sql Plus:-
1)DBA_ROLE_PRIVS
2) DBA_USERS
3) DBA_sys_privs
Ya but these is no entry in DBA_OBJECTS table for this user.

Display a user's privileges

How can I display a certain user's granted
privileges, either system or object privileges?
null

You can try the following SQL:
set echo off
set feedback off
set pagesize 50000
set linesize 200
col "Username" for a18
col "Obj Owner" for a14
col "Obj" for a30
col "Obj Priv" for a10
col "Sys Priv" for a24
col "Granted Role" for a22
col "dummy" noprint
break on "User"
select username "Username", owner "Obj Owner", table_name "Obj", privilege "Obj Priv",
' ' "Sys Priv", ' ' "Granted Role", 1 "dummy"
from dba_users u, dba_tab_privs t
where u.username = t.grantee
and u.username not in ('SYS','SYSTEM','DBSNMP')
UNION
select username, ' ', ' ', ' ', privilege, ' ', 2 "dummy"
from dba_users u, dba_sys_privs s
where u.username = s.grantee
and u.username not in ('SYS','SYSTEM','DBSNMP')
UNION
select username, ' ', ' ', ' ', ' ', granted_role, 3 "dummy"
from dba_users u, dba_role_privs r
where u.username = r.grantee
and u.username not in ('SYS','SYSTEM','DBSNMP')
order by 1, 7
set feedback on
set echo on

Export user

Can you export a single user that has no database objects associated with the user just privileges.

One more thing that can be done is a S.O.S. (Sql Out of Sql), you can query the dba_users and dba_sys_privs and other related tables to perfom a sql script generation:
SELECT 'CREATE USER '||USERNAME||' IDENTIFIED BY VALUES '''||PASSWORD||''':'
FROM DBA_USERS
WHERE USERNAME IN ....
(partial code)
This way you could generate your own code from sqlplus.
Another method, is to generate the script out from the export file, by using the SHOW=y clause.
~ Madrid

Lab_9, SpatialCS.sql

--original line from SpatialCS.sql (Lab 9):
drop index STATES_SIDX;
-- Caused error:
--drop index STATES_SIDX
--ERROR at line 1:
--ORA-01418: specified index does not exist, since name of index was wrong.
--The line below worked, since I used the same naming scheme
--for my STATES index as used for table INTERSTATES in Lab 6_3
drop index IDX_STATES;
-- the program worked fine although the index was not
-- dropped prior to update of SDO_SRID
-- I did not use Spatial Advisor to
-- create indexes, since I couldn't figure
-- out how to do it...

Ben:
Your DBA is partly correct. There is no easy way to generate the scripts required to re-build a database, but it is possible. What Oracle considers a database is a little different than what SqlServer considers a database, a SqlServer database is closer to an Oracle tablespace (although not exactly the same).
Manually creating an Oracle database is a five step process.
1. Create a parameter file
2. Create the base database (i.e system tablespace and Oracle's metadata tables)
3. Create rollback segments
4. Create additional tablespaces for user data etc.
5. Run Oracle supplied catalog scripts.
You can get most of the information you need to generate the CREATE DATABASE command by running:
ALTER DATABASE BACKUP CONTROLFILE TO TRACE
then editing the resulting file.
The views DBA_TABLESPACES and DBA_DATA_FILES will give you the information you need to re-create the tablespaces.
DBA_ROLLBACK_SEGS will allow you to generate the CREATE ROLLBACK SEGMENT scripts.
If you need to re-create users and rolls, then DBA_USERS, DBA_ROLES, DBA_TAB_PRIVS, DBA_ROLE_PRIVS, DBA_SYS_PRIVS and possibly DBA_TAB_PRIVS can give you the required information.
Tables can be generated from DBA_TABLES and DBA_TAB_COLUMNS, indexes from DBA_INDEXES and DBA_IND_COLUMNS, and constraints from DBA_CONSTRAINTS and DBA_CONS_COLUMNS.
Triggers can be found in DBA_TRIGGERS. Other things like functions, procedures and packages can be generated from DBA_SOURCE.
As I said, not easy, but possible. There are lots of scripts out there that do some or all of this.
HTH
John

HOW to find out the tablespace space utilized by a patch after applying the

someone has already applied the patch in test env before recording the tablespace size , so I cannot find out the figure in test env.
So is there any general practice or general guidelines on it?
hOW to find out the tablespace space utilized by a patch after applying the patch?
Thanks & Regards,
Sree.
Edited by: 846579 on Mar 22, 2011 10:50 PM

I think there is no direct way to determine what tablespace is utilized by a patch from the README file. You could check the content of the patch file and see what modules are affected (assuming there are changes and the database level), then query DBA_USERS (DEFAULT_TABLESPACE column) for those schemas which are updated by a patch. Or, you could check the size of the tablespaces before and after applying the patch and you will determine what tablespaces have been utilized (provided that the application services are down, and none of the application users is connected to the application).
Thanks,
Hussein

Grant connect allows viewing of other users

Situation:
In SQL*Plus: Create a user, grant connect to the user. Connect as the new user and try to query dba_users. ORA-00942 error occurs (which is good).
In Raptor, connect as the new user. Expand the users tree and now you, the new user, can see every user in the database (among other data dictionary items). That's not good, right? This occurs in the latest release (0919).

Do you suggest that through raptor you can get access to dba objects with only connect granted? Impossible :) Try this in raptor and sql+
select * from all_users;
select * from dba_users;

Import Error --- needed urgent

Hi,
I am working in oracle 9i and linux 2.4. I have the export .dmp file. if i using import it shows error
ORA-01917: user or role 'CIM_APP' does not exist
IMP-00017: following statement failed with ORACLE error 1917:
"GRANT EXECUTE ON "GEAE_CIMS_CI" TO "CIM_WEB""
IMP-00003: ORACLE error 1917 encountered
ORA-01917: user or role 'CIM_WEB' does not exist
IMP-00017: following statement failed with ORACLE error 1917:
"GRANT EXECUTE ON "GEAE_CIMS_BIZ_ADMIN" TO "CIM_UPDATER""
IMP-00003: ORACLE error 1917 encountered
ORA-01917: user or role 'CIM_UPDATER' does not exist
IMP-00017: following statement failed with ORACLE error 1917:
"GRANT EXECUTE ON "GEAE_CIMS_BIZ_ADMIN" TO "CIM_LOOKER""
IMP-00003: ORACLE error 1917 encountered
ORA-01917: user or role 'CIM_LOOKER' does not exist
IMP-00017: following statement failed with ORACLE error 1917:
"GRANT EXECUTE ON "GEAE_CIMS_BIZ_ADMIN" TO "CIM_APP""
IMP-00003: ORACLE error 1917 encountered
ORA-01917: user or role 'CIM_APP' does not exist
IMP-00017: following statement failed with ORACLE error 1917:
"GRANT EXECUTE ON "GEAE_CIMS_BIZ_ADMIN" TO "CIM_WEB""
IMP-00003: ORACLE error 1917 encountered
ORA-01917: user or role 'CIM_WEB' does not exist
Import terminated successfully with warnings
please explain me the sql query
Gobi.

The following users or roles are not in present in the database in which you are importing the data. There are several ways to handle the problem.
If the users or roles needed to exist in this database and the export was a user level export (import command had the parameter owner=) you need to create the users or roles before importing. First determine in they are are users or roles by query dba_users and dba_roles in the database that the export was created from.
If the users or roles are not needed you can set the parameter grants=n in the import statement to skip the grants.
Finally if the import was created with full=y and the database you are importing into is a fresh database (no users other then Oracle users) you can use full=y on the import command to do a full import that should include the meta data to create the users and roles.

Connection to Oracle Los!

I have application which connect to Oracle 8.1.7. though LAN.
The problem is that when the application is idle for 1-2 hours it looses connection to Oracle.
Can somebody tell me is there any parameter that I can change to fix this?

The first thing to check is the profile setting for connect time limits. Query DBA_USERS and find the user that is connected, and see what the "PROFILE" column is. Then query DBA_PROFILES and see if anything is set to something other than "UNLIMITED" in the LIMIT column, for that user's profile. There is an "IDLE_TIME" resource setting that may be causing the disconnect.

Change user password , when DB is in mount state

Hello,
1. How to check user status , when database is in MOUNT stage. ? (Locked/Expired)
2. Is it possible to change the password of the user SYSTEM , while database is in mount state.?
If DB is open , we can query DBA_USERS table and can get the details of users (username, account_status,lock_date,expiry_date, etc...)
But , is it possible to query these data, when the DB is in MOUNT state.
3. Im having SYS authority. I want to change the password of SYSTEM user, and make SYSTEM unlock in the Standby Database. (Which is in mount state).
How can i do this?
regards,
Zerandib

How to check user status , when database is in MOUNT stage. ? (Locked/Expired)You cannot check the user status when the database is in mount stage. You need to have the database is open mode to check the status of the users.
Is it possible to change the password of the user SYSTEM , while database is in mount state.?It is not possible to change the password of any user when the database is in mount state. Open the database and then change the password.
If DB is open , we can query DBA_USERS table and can get the details of users (username, account_status,lock_date,expiry_date, etc...)
But , is it possible to query these data, when the DB is in MOUNT state.No. Not possible.
3. Im having SYS authority. I want to change the password of SYSTEM user, and make SYSTEM unlock in the Standby >Database. (Which is in mount state).
How can i do this?Answer to this question was given in your previous thread created nearly 12 hours back. It makes no sense to change the password on the standby database. It a mirrored copy of your primary database.
Change the password of the user in primary database and perform a log switch. The password would be changed on the standby as soon as the log is applied on the standby database.
Whenever you try to change the password of a user in mount stage,you get an error message saying "shutdown is in progress". So change it only when the database is open

Authorization schemes & verifing roles

Hi,
I'm having a hard time understanding how to use authorization schemes. My users log in as Oracle users. Each user is assigned to a role (with specific privileges granted to each type of role). I found that the privileges were not being enforced in the application according to the roles assigned to each user. From what I understand, this is because the SQL is being parsed according to the schema owner, not the individual user. So let's say for example I want to have a Create button only appear on a page if the user is assigned to role A or role B. Do I need to use an authorization scheme for this, or do I perform a query to determine the type of role the user is assigned to, and based on the result, conditionally show the button? I know there are lots of postings on authorization schemes in this forum (and I have read the Help manual), but I still do not understand how to get this working. Thank you.

....later same day... 
I've been reading/researching all day and it seems like I need to either a) make a table that defines user/role or b) query the database for the role assigned to this user (which I would have to do in choice a also) and then assign it as an application item. I tried option b, by creating an item on page 1 in my application, using this query: 
SELECT granted_role
FROM dba_role_privs
WHERE grantee = :APP_USER;
 
But I am getting this Oracle error message: 
ORA-00942: table or view does not exist 
Error ERR-1019 Error computing item default value: page=1 name=P1_ROLE.
 
How can I query the dba_role_privs table from within Application Express?
Do I need to GRANT SELECT priviliges to the schema owner to access this table?

Query dba_users, dba_role_privs, dba_sys_privs

Similar Messages

Maybe you are looking for