Restricting SYS user to View other schema's Tables

Hi All,
Oracle DB Version - 10R2
O/S - UNIX
Could anyone share docs or steps to prevent SYS user to view other schema's tables;
Thanks,
Deepak

Dear Deepak_DBA,
If you revoke every privilege and role from the SYS user i presume the SYS will continue to select any table from the relevant schema. SYS is a special user and not like the others.
For instance if you want to revoke the SYSDBA and the SYSOPER from the SYS user;
SQL> revoke sysdba, sysoper from sys;
revoke sysdba, sysoper from sys
ERROR at line 1:
ORA-01998: REVOKE failed: user SYS always has SYSOPER and SYSDBAI have never seen such documentation that describes how to revoke everything or at least the SELECT ANY TABLE privilege from the SYS user.
Please see more about the SYS and the SYSTEM users;
SYS and SYSTEM Users;
http://download.oracle.com/docs/cd/E11882_01/server.112/e10897/users_secure.htm#ADMQS12003
Regards.
Ogan

Similar Messages

  • Restrict the users to view the column, row details

    Experts
    For example restrict the sales users to view the purchase price, and restrict the purchase users to view the selling price.
    Any inputs highly appreciated

    Hi,
    Restrict the users to view the column can be done through form settings.
    I don't think it is possible to restrict the users to view the particular row details. If user can open the form, no option to hide any rows through authorization.
    Thanks,
    Gordon

  • How to restrict the user from accessing other screens before submittingdata

    Hi All,
      I have some screens developed in Webdynpro ABAP and all these have been linked to Portal as pages. In Portal If i click on the link in detailed navigation i can see the corresponding screen on the right side. Now in one screen i have to input some data and submit the data, Now my problem is if i enter some data and before submitting the data if i click on any other link in the detailed navigation, that corresponding screen is opening and all the data of the previous screen is lost.
    Can any one suggest me, how can i restrict the user from accessing other screens before submitting the data of that screen from portal perspective.

    Hi Prasanna,
    The pages can be restricted from the user access by using the ACL permission or you can restrict the page by making invisible in navigation area which you do not want to show to the user . Open the page properties and select navigation category in the drop down and select the Invisible in navigation area property to yes.By default this property is No.Change the property for all pcd pages which want to hide from user access.
    Hope this helps you...
    Regards,
    Rudradev Devulapalli
    Reward the points if helpful....

  • Access other schema's table without specify the schema name

    Hi, need ur help again,
    I would like to access other schema's table without specify the schema name. for example,
    select * from hr.jobs;
    What priviledges i need if i want to select the data in this way:
    select * from jobs;
    Thanks!

    Public synonyms have their place, but are not generally a good idea as they will cause conflicts with other schemas and applications. Another think that you can do is issue the
    ALTER SESSION set CURRENT_SCHEMA = schema;
    The CURRENT_SCHEMA (8i and above) parameter changes the current schema of the session to the specified schema. Subsequent nqualified references to schema objects during the session will resolve to objects in the specified schema. The setting persists for the duration of the session or until you issue another ALTER SESSION SET CURRENT_SCHEMA statement. CURRENT_SCHEMA is a session parameter only, not an initialization parameter.
    This setting offers a convenient way to perform operations on objects in a schema other than that of the current user without having to qualify the objects with the schema name. This setting changes the current schema, but it does not change the session user or the current user, nor does it give you any additional system or object privileges for the session.

  • How to restrict some users from viewing a screen of standard transaction

    Hi All,
    I need to restrict certain user ids from viewing the 'Payment Transactions' screen for the below mentioned transactions.
    FK01, FK02, FK03, MK01, MK02, MK03, XK01, XK02, XK03
    The Basis consultant has tried to configure it. However its not working. So need to find other solution.
    For all transactions other than FK01, MK01, XK01 (create vendor), the BAdi GOS_SRV_SELECT is called before the payment transaction screen appears. But for transactions FK01, MK01and XK0, no such BAdi is there.
    Also I'm not able to figure out how to restrict that particular screen using Badi GOS_SRV_SELECT. What will be the service name for this?
    Please help !!!
    Thanks in advance,
    Radhika

    hi,
    u can do this using user exits.
    identify the appropriate exit for ur transaction and thn put condition like
    if username = ...
    loop at screen.
    hide..
    endloop.
    i was just trying to give u some hint .make it to ur best.
    reward if hlpful.

  • Inconsistent logic for viewing others schemes objects in browser

    A while ago when we upgraded our db's to Oracle 10 we also replaced our famous green friend for Sql Developer with our entire development crew.
    Among a few other things, people were not all that happy, seeing that they lost the desired "check for access to dba views option". But as long as we could rely on a consistent view in the "other schema" in all possible views (via table, or directly in the navigator) we could defend this way of thinking for not being able to see everything.
    But unfortunately, in the latest version "1.5.1 5440", we still see inconsistent things...
    for example :
    via browser (other users schema)
    => Indexes are not visible in the indexes branch point, but they do show up on the indexes tab for the corresponding table.
    => For the same "other users scheme", Triggers do show up in the triggers branch point, but then when we check the trigger tab for the corresponding table, they are not shown
    It looks like waiting for yet another version is no option and we will be forced to retreat to the green commercial swamp on high demand of our developers...
    Ribbit :-(

    There are still a few glitches in the queries used for certain things - I cannot remember the problem you mention with indexes being posted before (although I get the same problem with indexes visible in all_indexes not appearing on other users index node), but the trigger tab problem has been discussed before (1.5PROD/EA3/EA2/EA1: Only table owners triggers show in Table's trigger tab
    theFurryOne

  • How to restrict a user to view the file from web URL

    Hi,
    I want to restrict any user who are trying access any js file or any client side file from web URL.
    For eg. if user put www.test.com/js/sample.js in browser then he will able to view the code.
    Is there any way to restrict the same.
    Please suggest.
    Any suggesion.
    Thanks In Advance
    Manoj
    Edited by: user12780476 on Dec 28, 2011 12:18 AM

    Does the javascript file is really a private resource?
    Assuming it is a private resource, here are the few things you can do :
    1. Don't put it into document root at all.
    2. Put it in a location where access is denied e.g.
    /mydocs/private/
    <If uri =~ '/private'>
    PathCheck fn="deny-existense"
    </If>
    3. Use access control list (acls) to deny access to private resources.
    4. Use <If> else around send-file SAF e.g.
    <If uri !~ "*.js">
    Service fn="send-file"
    </If>
    5. Use htaccess to deny access to those resources.
    So it all depends on what you really want to achieve.

  • Readonly user can access other schema and change them

    Hello everybody,
    I created a readonly user like this in oracle 11g r2
    SQL> CREATE USER readonly IDENTIFIED BY readonly;
    SQL> GRANT CREATE SESSION ,CREATE SYNONYM TO readonly;
    SQL> GRANT SELECT ON SA.vCustomerService TO readonly;
    But when I connect to the database and do a select like:
    SQL> SELECT * FROM ACC;
    I get the data from that table, even if I do an update on that table it works.
    What am I doing wrong that my readonly user still has full acces on the other schema?
    Thanks in advance for your help!
    Best regards,
    GIL GOMES Dany

    Dan_lu wrote:
    Hello everybody,
    I created a readonly user like this in oracle 11g r2
    SQL> CREATE USER readonly IDENTIFIED BY readonly;
    SQL> GRANT CREATE SESSION ,CREATE SYNONYM TO readonly;
    SQL> GRANT SELECT ON SA.vCustomerService TO readonly;
    But when I connect to the database and do a select like:
    SQL> SELECT * FROM ACC;
    I get the data from that table, even if I do an update on that table it works.Check the permissions for that table -- maybe some operations on this table are granted to publc?

  • Restricting the user to view his information

    Hi frnds,
    I have a report which is having the information of Actual sales and Planned sales of all employees.
    If a user i.e the employee login into the portal is able to all employees Actual sales and Planned sales information.
    But here my requirement is the user who ever loged in has to see his Actual sales and Planned sales information only not the others.
    So here how can I restrict the user who ever loged in can see his sales information only?
    I think it is possible through authorizations. Am i correct?
    If yes How can i proceed?
    Thanks & Regards,
    sridhar

    Hi Sridhar,
    Check this thread..
    /message/1143264#1143264 [original link is broken]
    Might help u in some way..
    -Pradnya

  • How to Restrict a user to a access a particular table

    HI ,
    how to restrict an user to a one particular table and he should have only dispaly authorization for that , can anyone suggest me how to do this.

    Hi,
    Is it a standard table ? S_TABU_DIS (Client Dependant) and S_TABU_CLI (Cross client) are the the authorization objects that controls table maintenance. With Authorization group and activity 03, you can give user access only to Display.
    You can look at table TDDAT to find the authorization group of the table. If it is a custom table for which original t-code is SM30 ( You can look at SU24 to verify that) and it does not have authorization group assigned to it, then you can ask your developer to assign authorization group to the table using t-code SE54. then again make use of S_tabu_dis with activity 03 and Auth group as designed to restrict access.
    Also something to look for is Note 1481950 - New authorization check for generic table access using new auth object S_TABU_NAM. Remember Bernhard talking about it.
    Edited by: Nishant Sourabh on Oct 1, 2010 8:13 PM

  • How to restrict payroll users from viewing IT0002 or other personnel data?

    Hi,
    We need to device a authorization for payroll users in such a way, that they are allowed to access and edit  IT 0014, IT0015, IT0580 to IT591 but they are not even allowed to view infotype IT0000 to IT0007.
    They will still be allowed to do payroll processing of all employees.
    Problem is - if we disable PA20 to PA40 transaction for these users, then they will not be able edit IT 14, 15 etc and vice-versa.
    Please advice how can we do this.
    Effective solutions will rewarded

    Am just wondering like this -
    for a User who will update IT8 etc infotypes and run payroll for all employees:
    Allow infotype access to all Infotypes via P_ORGIN/P_ORGINCON and then
    exclude Infotype access to IT0000 to IT0007 via P_ORGIN/P_ORGINCON
    Does Payroll run after the above if executed by this employee? because in my view the user has access to IT08 and other payroll related infotypes and hence should run (but I think IT0, IT1 &2 might also be required for for various reasons for payroll to run - not sure);
    Or probably you might need to think of executing/triggering the Payroll process via Batch process (thru a batch user Id which has access to all)...because it wont be a best practice to have manually initiate the Payroll process...
    Regards
    Chandra
    Message was edited by:
            Chandramouly V

  • How to view other schema's job status ?

    Hi,
    My application is in schema A. User B has just enough rights to do specific tasks in A. One of them is to call a function that creates a job in schema A.
    The view user_jobs in A shows the job.
    How can I make this job visible to user B without granting B access to dba_jobs?
    I tried granting select on a.user_jobs to B and hoped that the job would show up in B's all_jobs view but that did not work.
    Any ideas?
    Rene

    Create a customised version of USER_JOBS and grant select on the view to B. See catjobq.sql - note how USER_JOBS is based on DBA_JOBS anyway.
    I usually have some sort of admin user (which may or may not be the application owner) which owns all these types of customisations.
    PS: ALL_JOBS is actually a synonym for USER_JOBS.

  • Viewing Other Schema Objects in SqlDeveloper

    I'm running SQL Developer 1.5.1.54.40 against 10g 10.1.0.5, and am unable to view package bodies in schemas other than my own. I know there has been some discussion on this, but I'm unsure of the status. Is there a workaround, or plan to provide this functionality in the near future?

    Sue,
    There is still a problem in 1.5.0 and 1.5.1 (on win XP going against a 10.2.0.3 database) in viewing the columns of a view that is owned by another user. This worked / still works in 1.2.1.
    Regards,
    Erick
    Message was edited by:
    ESlazinski

  • Restriction of Users to access other Profit Center Data

    Hi All,
    We have a Ztable to maintian User Id and Profit Center ranges (from to).
    This well help us to enter an user id and a Profit Center range in the Ztable.
    Later this particular User will be having access to only these (mentioned in the Ztable) Profit Centers while doing any Transaction.
    But how exactly this User will get such restriction..????
    I believe something has to be done apart from entering such details in the Ztable.
    What exactly should be done, so that the User will have access to particular set of Profit Centers...??????
    Kindly guide me in this regard.....
    Regards
    Pavan

    Hi,
    Contact your basis consultant.....he may be able to help you with the authorisations.
    Aravind
    Assign points if helpful

  • Viewing Other Schema In SQL Developer

    Hi,
    I did a search in the Forum and none of the posts I have found has been able to solve my problem so I'm here with my hat in hand asking for some advice. I was recently given SQL Developer to replace what I had been using and, on my own, have been able to convert all of my previous queries for use in SQL Developer. However, the only Tables I see in the Left Window of SQL Developer are those Tables that I have personally created. I checked with our DBA and I do have SELECT permission granted on all Tables in our company's Oracle DB, but I can't see them in SQL Developer so I can't use Query Builder or the Drag and Drop option, etc.
    Thanks for reading this and for your help.
    If you need any further details, let me know and we can work out a contact method other than the forum.

    You need to ask the DBA what the user / schema name is of the tables you have access to. What you see when you expand other users are all the users in the database you are currently connected to. Expanding the tables node for these users will only display the tables when you have select access. Another way to see the different schemas that have objects that you can see is by adding a filter to Other Users. Right click on other users and select the filter. Now in the dialog change the initial drop list to object_count and change the next two fields so that you create an expression that shows row_count > 0. Now only those users with objects in that you can see will display in the list.
    In the query builder you have to change to the user for each set of tables you want to use.
    Sue

Maybe you are looking for