Trying to create a read-only user

Our HR dept would like to have READ only access to a few tables and have asked that I create a user to allow them to pull stuff into MS Access.  Since SAPR3 owns all the tables I thought I just had to, after I created the user, as SAPR3 grant select to those few tables.  Didn't work. What did I miss?
SQL> connect system/*******
Connected.
SQL> CREATE USER "HRRPT"
  2    IDENTIFIED BY "*******"
  3    PROFILE "DEFAULT"
  4    TEMPORARY TABLESPACE "PSAPTEMP"
  5    DEFAULT TABLESPACE "PSAPUSER1D";
User created.
SQL> grant create session to hrrpt;
Grant succeeded.
SQL> connect sapr3/*******
Connected.
SQL> grant select on pevsh to hrrpt;
Grant succeeded.
SQL> connect hrrpt/*******
Connected.
SQL> desc pevsh;
ERROR:
ORA-04043: object pevsh does not exist
SQL> desc 'sapr3'.'pevsh';
SP2-0565: Illegal identifier
What am I missing?
Thanks!

It works here as follows:
> connect system/*****
Connected.
SQL> CREATE USER hr
  2  IDENTIFIED BY hr
  3  PROFILE "DEFAULT"
  4  TEMPORARY TABLESPACE "PSAPTEMP"
  5  DEFAULT TABLESPACE "PSAPBEN620";
User created.
SQL> grant create session to hr;
Grant succeeded.
SQL> connect sapr3/******
Connected.
SQL> GRANT SELECT
  2      ON  "SAPR3"."T000" TO "HR";
Grant succeeded.
SQL> connect hr/hr
Connected.
SQL> select count (*) from "SAPR3"."T000";
  COUNT(*)
        24
SQL> desc "SAPR3"."T000";
Name                                      Null?    Type
MANDT                                     NOT NULL VARCHAR2(9)
MTEXT                                     NOT NULL VARCHAR2(75)
ORT01                                     NOT NULL VARCHAR2(75)
MWAER                                     NOT NULL VARCHAR2(15)
ADRNR                                     NOT NULL VARCHAR2(30)
CCCATEGORY                                NOT NULL VARCHAR2(3)
CCCORACTIV                                NOT NULL VARCHAR2(3)
CCNOCLIIND                                NOT NULL VARCHAR2(3)
CCCOPYLOCK                                NOT NULL VARCHAR2(3)
CCNOCASCAD                                NOT NULL VARCHAR2(3)
CCSOFTLOCK                                NOT NULL VARCHAR2(3)
CCORIGCONT                                NOT NULL VARCHAR2(3)
CCIMAILDIS                                NOT NULL VARCHAR2(3)
CCTEMPLOCK                                NOT NULL VARCHAR2(3)
CHANGEUSER                                NOT NULL VARCHAR2(36)
CHANGEDATE                                NOT NULL VARCHAR2(24)
LOGSYS                                    NOT NULL VARCHAR2(30)
You need to grant explicitly including schema name.
Markus

Similar Messages

  • Creating a read-only user account

    I am trying to create a read-only user account. Reason being,
    when our users may be able to use MS Access to pull information
    and modify changes (if possible). I was told there is a way to
    do this. Help?

    I'm connecting using ODBC with a user account that I created.
    This dummy account will be available to approx 15 users so they
    can generate reports using Crystal. But, if there is someone
    that wants to generate queries using MS Access, they can still
    modify the data. So, how do I create only select statements to
    disallow users from using MS Access to link to the oracle
    database and change data?

  • Want to create a Read Only user for a given app owner user

    Hi Folks,
    We have an application owner schema, lets call it OWNER, which has different objects living under it.
    Now, for certain reasons, the app group wants a read only user which should be able to view objects living only in OWNER. It would only be able to read things, and have no create or alter types of priv to be able to change anything.
    The first idea was to create a new user (e.g. RO) and give this explicit grants (select only) for all objects in OWNER. Though this works, is a maintenance havoc, since everytime there is a new object in OWNER, you have to remember to give explicit grants to all RO (or RW ) kind of users.
    What i am looking forward to is, some sort of privilege or role concept that apply on the user level, and not on object level. something that allows me to say, all objects of this schema (e.g. OWNER) are visible to user RO. Other restrictions on RO would control read or write behaviour.
    Does this thing exist ? please point me to the documentation/example..
    regards
    raghav..

    CREATE OR REPLACE TRIGGER myTest.trg_mytest
    AFTER DDL
    ON myTest.SCHEMA
    DECLARE
         lv_obj_type VARCHAR2(20) := TRIM(UPPER(ora_dict_obj_type));
         lv_evt_type VARCHAR(20)      := TRIM(UPPER(ora_sysevent));
         lv_obj_name     VARCHAR2(30) := trim(UPPER(ora_dict_obj_name));
         lv_role_name     VARCHAR2(30) := 'myTest_RO';
         lv_stmt          VARCHAR2(4000) := NULL;
         ln_job_nr     NUMBER;
    BEGIN
         IF lv_evt_type != 'GRANT' --lv_obj_type <> 'OBJECT PRIVILEGE' --
         THEN
              DBMS_JOB.SUBMIT(ln_job_nr,'begin execute immediate ''grant ' || ' select on ' ||
                                       lv_obj_name || ' to ' || lv_role_name || '''; END;');
         END IF;
       INSERT INTO TB_EVT_LOG(d_date, description)
       VALUES(SYSDATE,  lv_obj_name || '~~~~ created ' || lv_obj_type || '~~~~' || lv_evt_type );
       EXCEPTION
         WHEN OTHERS THEN
           RAISE;
    END trg_mytest;
    /This works. But, my problem is that it is not able to filter out the Grant statement itself, Its logging an entry for the grant (as a ddl operation as well).
    what am I doing wrong here ?
    regards
    raghav..

  • Authorization RADIUS - read-only user on FWSM

    Hi support community,
    I am experiencing an issue while trying to create some read-only users on my FWSM.
    I've setup the authentication on my RADIUS Server, which works fine, and put the aaa authorization command LOCAL  command.
    I've also set the commands - associated priviege :
    privilege show level 3 mode configure command dhcpd
    privilege show level 5 mode configure command privilege
    All this things works great when i authenticate locally on the FWSM.
    However, this is not working whe authenticating via the RADIUS server:
    aaa authentication enable console MY_RADIUS LOCAL
    aaa authentication http console MY_RADIUS LOCAL
    aaa authentication ssh console MY_RADIUS LOCAL
    And i set up the authorization locall, because i dont run any TACACS server :
    aaa authorization command LOCAL
    I managed to make this work on ASA, by sending RADIUS attributes (cf a document that i can't find anymore...).
    So what are exactly the differences between asa and FWSM ?
    On my ASA there was a command i could not run on the FWSM :
    aaa authorization exec authentication-server
    (i am running version 4.1 on FWSM and 8.4 on ASA).
    Thank you for your help.
    Florian

    You really need to see the example given here,
    [Read only user for a schema|http://arjudba.blogspot.com/2008/09/create-read-only-user-for-schema.html]
    [Global read only user|http://arjudba.blogspot.com/2008/09/how-to-make-global-read-only-user.html]

  • A question about creating READ ONLY users.

    Dear all,
    I have a question about read only user accounts and I would appreciate if you could kindly give me a hand. I have a schema named SCHEMA1. Whenever I want to connect by using sqlplus I run the following:
    sqlplus user1/[email protected] SCHEMA1.WORLD is the entry in the tnsnames.ora referring to the schema SCHEMA1.
    I need to create a read only user who is able to SELECT all tables and views created by user1 on SCHEMA1 (this user will not modifiy anything at all. The user is used only for a person using SQL queries to read data). for several tables I write the grants explicitly, for example:
    CREATE USER user2 IDENTIFIED BY user2;
    GRANT CREATE SESSION to user2;
    GRANT SELECT ON S001_COR_ECLASS TO user2;
    GRANT SELECT ON REF_ECLASS511 TO user2;Is there anyway to do the same thing but for all the tables (because there are a lot of tables and views)? Besides, even with these granted permissions when the user connects with SQL Developer to the database, he is not able to view the list of tables/views in SQL Developer GUI. What causes this problem?
    Thanks in advance,
    Dariyoosh

    Hello Dariyoosh,
    he is not able to view the list of tables/views in SQL Developer GUIyou can either go to "Other Users" - user1 - tables. There you see every table you have permission to select.
    Or you can create a synonym in schema2 for each table in schema1 and set a filter on the tables node of user2 "Include synonyms".
    Regards
    Marcus

  • Read only user in weblogic throwing error messages in logs

    Hi,
    We have a requirement to create a read only user with monitor access.
    our requirement is to monitor em console using moniotr user, i.e. this user will login to em console, monitor order flow from instances tab by entering order no. and dates, and logout from em console.
    we have done below steps to create monitor user,
    Admin Console->Security Realms >myrealm >Users and Groups-> new
    created user Monitor_User_1 and assigned group as Monitors.
    but whenever this user logs in or searches we are getting below error message:
    <Sep 15, 2013 7:25:21 PM EST> <Warning> <oracle.jps.admin> <BEA-000000> <Access denied. Required roles: Operator, Admin, executing subject: principals=[Monitor_User_1, Monitors]
    java.lang.SecurityException: Access denied. Required roles: Operator, Admin, executing subject: principals=[Monitor_User_1, Monitors]
    we even did below steps:
    With admin access login into EM Console. Select soa_infra, right click mouse -> Security -> Application Roles. On right side, click green arrow and see list of Roles shown. Select the role named SOAMonitors, click on this. And add a Monitor_User_1 to this.
    but we are still getting same error.
    Kindly let us know if we are missing something while creating monitor user and how to get rid of these messages.
    Please note that we are already in Production and our log files are filled with these messages.
    Thanks & Regards,
    Vivek Vishal

    moving this discussion to WebLogic Server - General thread.

  • Read-only user for Weblogic 6.1 sp2 console

    Is there a way to restrict a user to read-only priv. on the weblogic
    console? Either by using acl's or other means.
    Thanks in advance,
    Brown

    "Seb" <[email protected]> wrote in message news:3f33c3e2$[email protected]..
    >
    Hello,
    I'd like to create a read-only user for a customer that gives him acces tothe
    Console only for reading all the configuration. I don't him to modifyanything
    Is there a simple way to do this ?A previous post mentioned that this is not possible in 6.1.
    Brown,
    This functionality is not available in 6.1. The newest version of wls
    8.1 has this feature depending on the role that the user is in.
    ~satya

  • Read only user for Weblogic Server Console (6.1)

    Hello,
    I'd like to create a read-only user for a customer that gives him acces to the
    Console only for reading all the configuration. I don't him to modify anything
    Is there a simple way to do this ?
    Thanks in advance.
    --Seb

    "Seb" <[email protected]> wrote in message news:3f33c3e2$[email protected]..
    >
    Hello,
    I'd like to create a read-only user for a customer that gives him acces tothe
    Console only for reading all the configuration. I don't him to modifyanything
    Is there a simple way to do this ?A previous post mentioned that this is not possible in 6.1.
    Brown,
    This functionality is not available in 6.1. The newest version of wls
    8.1 has this feature depending on the role that the user is in.
    ~satya

  • How to configure read only user on IAP?

    Requirement:
    In environments, such as enterprises and campus universities, there are instances where few administrators only monitor the IAP clustered networks. For such users, a read only user can be configured on IAP.
    Solution:
    In IAP software, a provision is given is to configure a read only user in the system settings, under "Admin" tab.
    Configuration:
    Follow the below steps to configure radius authentication in IAP:
    Login to IAP web interface
    Select "System" from the main menu and then click on "Admin" tab
    Under View Only settings, enter the username and password.
    Verification
    Logout of the IAP web interface and try logging in using the username and password created for read only user.
    This read only user will no longer be able to see configuration options. Below screenshot shows the difference of menu options between an administrator and read-only user:

    HG,
    Please check this link.
    http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808d9138.shtml
    We need to set up command authorization.
    Regards,
    ~JG
    Do rate helpful posts.

  • Is it possible to create read-only users in OM

    We have several tasks where creating Read-Only access for non-OM users who require information from specific data fields in OM on a regular basis would be helpful. Currently those users must interrupt the daily work of those Oracle users with OM access in order to get their queries answered; obviously this can be quite disruptive.
    Have been told by our IT dept/OM users that creating read-only users is not possible and have not found any general information about the topic via Internet search, so I am posting this general query.
    Are there license issues that would prevent this?
    Security issues?
    Customized OM?
    Or is it just too complex to do without creating headaches for a firm's IT department?
    Thanks
    Lisa

    You will have to create new functions with parameter query-only = Yes.
    And then create a new menu with those new functions.
    And then attach the new menu to the Read only responsibility.
    Also see Re: How to change OM responsibility as read-only in oracle applications 11i and the links in that thread.

  • ADF: Read only user access to application role on BTFs

    Hi,
    My JDeveloper version is 11.1.1.5
    I am trying to create read only users in my adf application. But I am unable to give read only permissions to the user on bounded task flows/ .jssf page which have editable tables and forms.
    I have searched for the information, I did not find any solution.
    Could some one please help me?
    Many thanks in Advance
    --Anil
    Edited by: 977652 on Apr 5, 2013 6:50 AM

    If you are using ADF BC, you can protect fields at EO level or protect the entire EO (check the security tab). The frontend will then render fields as read-only if your user is only allowed read permissions.
    If you are not using ADF BC, you can implement a custom resource permission as described here (ignore the fact that this is for an entity, the principle remains the same) http://www.oracle.com/technetwork/developer-tools/adf/learnmore/76-insert-update-entity-protection-334421.pdf
    You must then add an el expression to each fields readOnly attribute or you can implement a phaselistener that traverses all fields enclosed within a form and make them readonly.

  • "Read-only" user account

    Hi All,
    Although the systems in question run Solaris 8, I am asking in this Solaris 10 forum because the way to implement what I am trying to do will most likely be the same on Solaris 8 as Solaris 10 (basic user, group, and permissions related functions have not changed much). There are also alot more posts and answers in this forum so I'm likely to receive a response more quickly.
    My question is: I have been asked to create a "read-only" account for IBM to support some of the applications on a couple of our systems (app support has recently been outsourced to them). I don't really understand why they would be needing a "read-only" account as they wouldn't be able to do anything to resolve problems or install new versions etc., but anyway the question is there and they seem to be insisting on creating such an account. So what is involved with creating a so called "read-only" account? I have never been asked to create one of these before and I've been working with UNIX for quite some time.
    I know one could do something like create a very basic user who is only a member of a new group I would create called e.g. "readonly" and then use things like "chmod" to set permissions so that all files on the system have no write or execute permissions for "other" users (e.g. -rwxrwxr--), or I can use restricted shell (e.g. rksh, rbash) etc. However, setting all files globally to no write and execute permissions for "other" can and probably would cause all sorts of problems, and I already gave them a restricted shell but this was not suitable for them as they are unable to change directory or browse other parts of the filesystem they need to check.
    Please let me know how I can create one of these so-called "read-only" accounts.
    Thanks in advance.
    Regards,
    David.
    Commonwealth Bank
    David Stofberg
    UNIX Systems Administrator
    Enterprise IT Operations
    Level 9, 363 George Street
    Sydney NSW 2000
    P: +61 (2) 9303-2898
    M: +61 (434) 220-893
    E: [email protected]
    Our vision is to be Australia's finest financial services organisation through excelling in customer service.

    most normal users dont have the ability to write to most critical areas of the system by default. if you need more restrictions, deploy RBAC. you can create custom rights profile to limit what a certain role can do.
    [http://docs.sun.com/app/docs/doc/816-4557/prbactm-1?a=view] solaris 10
    [http://docs.sun.com/app/docs/doc/805-7229/6j6q8svdf?l=en&a=view] solaris 8 (update 10/01)

  • Read only user creation for Oracle EM Console 11.1.1.5

    Dear All.
    I have created Read only user for Oracle EM Console.
    I have followed below link to do the same
    http://moshe-soa.blogspot.com/2011/09/blog-post.html.
    I have noticed with read only user is that TEST button in EM Console is active means user with read only user can create a trans, in Prod scenario it is a risk.
    Raised a CR with Oracle and found that it is a bug
    Bug 14082464 - CANNOT DISABLE TEST/TEST WEB SERVICE BUTTON IN SOA EM COSOLE is there in Metalink.
    So my question is there any way by which i can disable the TEST button in EM Conasole.
    I think there are some WLST script or servlet java class available to resolve this issue.
    Can any one confirm this and please suggest if any one aware of any alternative method.
    Thanks,

    Hi, have you got any solution to this problem? I am having exact the same issue in 11.1.1.6.

  • How to create a read only access for database

    I am developer but willing to lear some of the dba tasks. I would like to know the steps that i need to take to creat a read only access database that is going to be used for the report development.
    I really appreciate if you tell me all the steps I need to create that. I have a full right to do this in the develpment database. thanks

    thank you for your reply but it does not tell me how i can set up a read only access acccount for the user. Do i need to create a role and assign the role to the users?

  • Problem with Read-only user being able to add and delete files and folders.

    The setup:
    Computer #1
    iMac (intel) running 10.5.5
    File sharing ON
    Sharing folder on external USB drive called 'iTunes' (but not the drive volume itself)
    Users:
    - Everyone = Read Only
    - Admin(me) = Read/write
    - UserA = Read Only (with account PW and username identical to local login for computer below)
    Computer #2
    UserA's iBook G4 running 10.4.11
    When I go to finder>network>iMac>connect it prompts me to login which I do and then select 'iTunes' folder which is visible and mounts successfully. I can see all files, access them all. Life seems great. Then I discover that I can also modify and delete files from the iBook, and create and delete directories.
    I'm new to networking and although I've setup and managed minimal networking tasks on PCs before, this is my first foray into the Mac networking world. Please help.
    What am I doing wrong? What haven't I set?
    Thanks in advance.

    Sorry, I should have clarified this in the first email.
    When I login from the iBook, I am logging in under a read-only user (not as myself, who is admin on the iMac). The user on the iBook has only been given read-only permissions on the iMac yet is able to add and delete files.
    This read-only login/PW however, is the admin account on the iBook, but that shouldn't allow this person to write on the iMac so far as I understand things...right?

Maybe you are looking for

  • How to do a tabular report

    Please can someone tell me how to do a tabular report ? I have the following data in the table User_id     Date 111     10-JAN-06 13:33:00 112     11-JAN-06 14:33:00 113     11-JAN-06 14:33:00 114     13-JAN-06 13:33:00 115     13-JAN-06 16:33:00 116

  • Paneltab always remember user prev selection but not programmatic disclosed

    Hi, Like the similar post Programmatic disclosure of showDetailItem under panelTabbed i would like the tab to be selected / disclosed based on the button the user click. I have a paneltabbed component in a page called site which consists of 3 showdet

  • How to install and configure OID using 11g R2 installers

    Hi, I need to install and configure OID, I am having installers of Oracle Identity and Access Management 11g (11.1.2.1.0). Please let me know how to install and configure OID. Thanks

  • When trying to transfer book i have borrowed from library to my nook ...

    when trying to transfer book i have borrowed from library to my nook using adobe digital editions 3.0 i get the following message..   CE_COPY_NOT_ALLOWED - No permission to copy book.     why is this????

  • Sluggish MBP - Should I buy new?

    My MBP is now 4 years old. It's been showing sluggish performance for at least 18 months now.  I've had independent people look at it, and I've brought it to the Store and had a Genius take a look.  I get a lot of pinwheels, applications can take up