User can not inherited privilege from Role

DD1 is a new user, CT_GROUP_USER is a role with all tables access right.
1)First, check the privilege of role CT_GROUP_USER
select table_name,privilege from dba_tab_privs where grantee='CT_GROUP_USER'
we can see CT_GROUP_USER have ALL tables' privilege.
2)Second, grant CT_GROUP_USER role to user DD1
GRANT ct_group_ADMINISTRATOR to DD1 with admin option
GRANT ct_group_USER to DD1 with admin option
select * from dba_role_privs where grantee='DD1'
we can see CT_GROUP_USER role here
3)
USE DD1 to access table ct_user, it looks DD1 did not have privilege inherited from  CT_GROUP_USER
4) Do additional operation, grant a table privilege to DD1
grant select,insert,update,delete on CT_ACLENTRY     to DD1 WITH GRANT OPTION
select table_name,privilege from dba_tab_privs where grantee='DD1'
DD1 ONLY have CT_ACLENTRY  privilege.
USE DD1 to access ct_aclentry, it is succeed.
5) RUN below script on Oracle 10g and Oracle 11g, User DD3 can access tables on 10g but failed on 11g.
CREATE USER DD3 IDENTIFIED BY DD3
GRANT CREATE SESSION TO DD3
GRANT CT_GROUP_ADMINISTRATOR TO DD3
GRANT CT_GROUP_USER TO DD3
Question: Is there any setting for GRANT on Oracle 11g?
Additional: ALTER USER DD3 DEFAULT ROLE CT_GROUP_USER
Above command can not let DD3 access tables, DD1 neither

1)
we can see CT_GROUP_USER have ALL tables' privilege.
Can we? You don't post results of this statement, you I can only assume you can see it, but I can't
And granting ALL privileges is a bad idea anyway.
2) Why 'with admin'?
3)
USE DD1 to access table ct_user, it looks DD1 did not have privilege inherited from  CT_GROUP_USER.
For you maybe, but as you don't post any failing SQLs and any error messages, who can tell?
5) 'but failed' on 11g.
Please keep in mind this is a discussion room, not a chat room, and we can't see what you are doing.
You need all these lines to ask 'My car is broke, please fix my car'. I can't see any car from here.
Sybrand Bakker
Senior Oracle DBA

Similar Messages

  • General users can not send emails from SAP themselves except sap_all user

    Dear experts ,
    General users can not send emails from T-CODE: SO00 themselves except the users
    which Assigned SAP_ALL Authorization Profiles .
    We hit SAPconnect trace Error : SO_OBJECT_MIME_GET Exception: 2 .
    No MIME Document Received. Error Code: UNKNOWN .
    How to can i solve the problem ?
    Thanks a lot in advance .

    Thanks for your Reply .
    I had set default domain in SCOT ,and email address in su01 .
    we can send email successful only SAP_ALL users .General users can not send emails from SAP themselves
    Is anybody else to help me ?
    Thanks a lot in advance .

  • One user can not retrieve email from phone

    I have one user can not hear the email from the IP phone, Text-To-Speech configured for this subscriber, listen voice message on the IP phone no problem, from outlook side, no problem, checked everything looks fine. any idea what happened for this?
    Unity 405 UM with Exchange 2003, Callmanager 413.
    Thanks

    Actually this is system wide problem, other users not reported.
    Solution: The unity primary server was out of synch with the exchange message store, restarted the Message Store svc, problem solved.
    Thanks Jeff and other posts, do give me lots of clues.

  • New user can not run ping from shell

    Hello,
    I am an extreme novice, but I have been able to install Solaris 10 on a SunBlade 100 and have created a second user. I want to be able to telnet or ssh to my system as the second user and then run pings and traceroutes from there to other network devices.
    If I remote log in as root I get a # prompt and can run ping. If I remote log in as the second user I get a $ prompt even though the group [0], base directoty [], and shell [sbin/sh] are identical to root in the /etc/passwd file. If I try to run ping I get: ping: not found.
    What do I need to configure for the second user so that the login receives the # prompt and is able to run pings?
    Thanks,
    Greg

    I'm missing something. I want to create a user that is equal to the root. The root has # prompt and can run ping with no extra work. What do I need to do to my second user to get access to the # prompt and the ability to just type and run ping ?Oohhhhhhhhhh, root has that other prompt and his PATH statement is setup properly and mine isn't so I need to be him instead of fixing the user account.
    You can set any users prompt to anything you want. You can make root's prompt a dollar sign instead if you want to and you can set an ordinary users prompt to the # symbol so what does that prove?
    All you need to do is to fix the PATH statement in ~/.profile for bash or sh and the user no longer needs to type the full path or use ./ to run a command.
    You have a lot to learn.
    alan

  • User can not enter value in INPUT field.

    hi experts,
    i have a table control on the screen which have one input field which user needs to fill. But as per he business req. we don't want him to enter any value, values should be enter from the search help only.
    If i make input field Read only it comes in gray color and user get confused. tell me some way so i can create white input field in which user can not enter values from key board.
    Please suggest...
    points will be awarded...

    >
    ashish gupta wrote:
    > hi experts,
    >
    > i have a table control on the screen which have one input field which user needs to fill. But as per he business req. we don't want him to enter any value, values should be enter from the search help only.
    >
    >
    > If i make input field Read only it comes in gray color and user get confused. tell me some way so i can create white input field in which user can not enter values from key board.
    >
    >
    > Please suggest...
    >
    > points will be awarded...
    This you cannot control. because if it is enabled only in that case you can see it white.
    do that thing as suggested by basakar to add a new input field just besides first one with zero padding.
    One workaround is use an image instead of real input field. the image should have the input field as image.
    and besides it create the input field with width 0 and padding also zero.
    i think this can fulfill the requirement.
    Thanks
    sarbjeet singh

  • Can not access CRM from outside the office network - Access denied You do not have sufficient access rights or privileges to perform this action.

    Hi,
    I can not access CRM from outside the office network - Access denied You do not have sufficient access rights or privileges to perform this action.  I can access CRM with same user id and password from our office inside the network.  I can get
    the page to give login details once I have login details I got below error. Please help me to solve this issue.  It was working before.
    Access denied You do not have sufficient access rights or privileges to perform this action. 
    Regards,
    Noushad
    [email protected]

    On Premise system Configured with AD FS server for claims-based authentication you need to update your host file with server url to access it from outside office network.
    Refer
    this on how to update host file.
    Regards, Saad

  • My new users can not upload files via browse

    Hi there;
    When my recent created users can not download files via the browse within the Internet interface.
    When I hit the via browse I face the following:
    500 Internal Server Error
    oracle.ifs.common.IfsException: IFS-10406: Invalid AttributeValue conversion (DIRECTORYOBJECT to Java DirectoryObject)
    oracle.ifs.common.IfsException: IFS-10200: Unable to access object (insufficient privileges)
    Any hint?
    Sasan Ebadian

    Hi Sasan,
    These are the ACL's of IFS:
    PRIVATE Grants no permissions to any other user. Other users cannot view, modify, or delete a user’s document in any way, unless changed by the owner.
    PROTECTED For folders only. Enables other users to see the files in the folder, add documents and folders to the folder, and remove documents and folders they have created from the folder, but are not allowed to delete the folder itself.
    PUBLIC Allows full access to the item. All users can make any changes that the owner can make.
    PUBLISHED Allows other users to view the contents, but they are not allowed to modify or delete the document.
    If you attach the ACL Public it must work!
    Bob

  • Need to raise a restriction that user can not put multiple PO references in PO Number field in Sales Order.

    Hi,
    reference to subject we need a restriction that user can not put different PO reference within an Order. One Sale Order should have one PO reference at Header and Line's of the sales order. Currently what is our issue that all the sales order are created by Quotes from quoting module. Whatever the line items come from quotes into sales order having no PO Number reference with them but when user completing the sales order user puts the PO reference at Sales Order Header which can not be linked or passed on those line items who captured from quotation. Due to this PO reference value difference between Lines and Header system generates multiple AR invoices based on unique PO Number references within an order.
    we need single PO reference per sales order. How can we restrict this if line level PO number reference is different from Header PO number reference that user can not proceed further?
    Regards
    Kaleem A. Bhatti

    Dear Zakir,
    Thanks a lot for your favorable response. The query is solved now by defaulting rules.
    Regards
    Kaleem A. Bhatti

  • Error msg: Current user does not have privileges to perform product Activation

    I am running Adobe Photoshop CS 8.0 on Windows Home Vista platform.
    I keep getting this error message when I try to open Photoshop:
    Current user does not have privileges to perform product activation. Run this application from a user account with administrative privileges or contact your system administrator.
    I am the only owner & user of this software. I have re-installed the SW once (full install), and the error message went away for a while.
    Now it's come back.
    What do I do now?

    2 options:
    Either disable UAC (User Access Controls) or run the application with Administrator rights.

  • Itunes application can not be open the disk can not be read from or writte

    itunes can not be opened the disk can not be read from or written to. That is the warning i get when i click my itunes to open it. Problem...
    there is no disk:) i have no idea what this warning means.. i have restarted and nothing.. i updated itunes and same warning.. there is no disk in the drive at all..
    infact i made sure i was in a room with no other disks.. Help??

    A few things to try:
    • Restore Permissions, using Disk Utility (in ~Applications/Utilities)
    • Set the correct Ownership & Permissions for the iTunes folder:
    Select the iTunes folder in ~/Users/YourUsername/Music.
    Get Info (command-I).
    Expand 'Ownership & Permissions' and 'Details:'
    You must read: 'You can Read & Write': if not, change it.
    Click on the 'Apply to enclosed items...' button.
    Hope this helps.
    M

  • Can not receive emails from third party email accounts

    Recently I started working for a small business which has small business server 2011 and exchange 2010 installed. Before I started there were eight user accounts and they all have unlimited email access. I created a few users through sbs AD and also from
    exchange console a week ago. Unfortunately none of them can not receive emails from third party accounts. they all can receive internal emails and also can send mails to any email accounts internally and externally. 
    This is a night mare for me as new users are having trouble with communicating via mails. I have tried all the methods and now thought of posting this issue on tech net. Please help me on this!!
    Thanks a lot!! 
    Sammy 

    Checklist for testing inbound email problems, I am assuming outbound emails works ok.
    1. Check Port 25 forwarding on all modems routers/firewalls
    2. MX Record is created and pointing to the correct Public IP Address, use MXToolbox.com to verify MX Record and test SMTP flow. Also Verify your public IP has not changed, use whatsmyip.org to check you public IP
    3. If using POP Connector Service, make sure POP accounts are created properly
    4. If using a 3rd party spam host, make sure they forward email to correct public IP address, use step 2 to verify your public IP.

  • Cisco Flex Connect and users can not get IP Address by WAN

    Hello my name is Ivan
    I have a wlc 5508 with license base to 50 aps, i use a deployment flex connect. I already registered all my access points, I use web authentication to authenticate users guest, and the service dhcp is in the central site.
    My issue is the users in each remote site, can not get an ip address by dhcp from the central site, they can authenticate in the guest ssid, but any users can not get an ip.
    The request is passing by the wan in this way
    Central Site DHCP - Router WAN - Remote Site - Users with notebooks. I use flex connect central deployment (all the traffic consulting to the wlc) .
    perhaps i should use local deploy? The wlc is in the central site.
    Can you help me to resolving this issue please? , perhaps any advice?
    Regards
    Ivan.

    Thanks Osita
    If I configure Central Authentication and  I configure central switching I need to create a dynamic interafce for each remote site and each dynamic interface associated with a different VLAN ID, because I can not associate a single interface dynamic to the same  VLAN ID, but in my case the client remote in each remote site have the same network segment with the same VLAN ID with the same SSID for guests. My goal is to configure web authentication with the local DHCP server at each remote site, will this work?.Each remote site have its own server dhcp.
    If I configure authentication central authentication with central switching with web authenticacion as I set in my scenario?
    My issues are the interfaces dynamics, because I have the same network to the customer guest with the same ID VLan in each remote site
    Regards

  • "mount: only root can mount" or "Unprivileged user can not mount NTFS"

    I'm trying to set up an NTFS partition to use as a common data partition between Arch and Windows. I have it added to fstab so that any user in the ntfsuser group can have access to it, but if it gets unmounted accidentally from the "eject" symbol in the nautilus gui, you have to sudo to mount it back up. Is there a way for it to be remounted automatically when you click on the partition again in Nautilus? I've searched all through the forums and looked through several articles on the wiki but haven't been able to come up with anything. The error I get says
    mount: only root can mount /dev/sda4 on /home/adam/UserData
    I've tried adding the users option to fstab, but that only manages to change the error to
    Unprivileged user can not mount NTFS block devices using the external FUSE
    library. Either mount the volume as root, or rebuild NTFS-3G with integrated
    FUSE support and make it setuid root. Please see more information at
    http://ntfs-3g.org/support.html#unprivileged
    I've tried the suggestions at the link in the error, as well as tried the solutions given in [solved] Gnome : mounting NTFS partition as user and a few other posts, but still nothing. If possible, I'd prefer to stay away from the users option in fstab, since it adds a redundant link to the sidebar in nautilus with a different name.

    @Mr.Elendig: It is mounted through fstab normally, but in nautilus there's an eject icon on the sidebar next to the name of the drive which I've accidentally clicked on a couple times if I'm just trying to open the drive real quick. Once its been unmounted like that it won't let me remount unless I use sudo. I'm just looking for something to make it a little more convenient than having to pop open a cli and type in a password.
    I'll try the suid root when I get home tonight, otherwise I'll look into autofs.

  • User can not print

    One user can not print from Photoshop CC. I have test other users from the same computer and they can print.
    I use Windows 7 Ultimate and SBS 2011.
    Is there a way to clear all Photoshop CC from a user profile? it must be the first try.
    Does someone know other user related problem with printing in Photoshop?

    Thanks.
    After lots of work, I found the problem. A corrupt local user profile.
    After logon on another computer and everything work, I try to identify the cause on the user profile.
    After I remove the local profile, I using a network so it creates minor problems, everything works.
    The thing which make me not think about this was that all other program, even Adobe, could print.

  • Can not construct xml from relative xpath expression: //FormVar

    In version 7.0, it was possible to access Form Variables with the (valid) XPath Expression "//FormVariable".
    In 7.2.2, using this XPath Expression leads to a stalled action, with message: "can not construct xml from relative xpath expression: //FormVar". (see full stack trace below)
    What's wrong? How can I fix this?
    Use of relative expression is very very useful during the development phase!
    Best Regards,
    com.adobe.workflow.WorkflowRuntimeException: can not construct xml from relative xpath expression: //FormVar
    at com.adobe.workflow.pat.service.PATExecutionContextImpl.createNodesForXPathExpression(PATE xecutionContextImpl.java:854)
    at com.adobe.workflow.pat.service.PATExecutionContextImpl.setProcessDataValue(PATExecutionCo ntextImpl.java:707)
    at com.adobe.workflow.pat.service.PATExecutionContextImpl.setProcessDataWithExpression(PATEx ecutionContextImpl.java:429)
    at com.adobe.workflow.qpac.set_value.SetValueService.execute(SetValueService.java:72)
    at com.adobe.workflow.engine.PEUtil.executeAction(PEUtil.java:184)
    at com.adobe.workflow.engine.ProcessEngineBMTBean.continueBranchAtAction(ProcessEngineBMTBea n.java:2371)
    at com.adobe.workflow.engine.ProcessEngineBMTBean.asyncInvokeProcessCommand(ProcessEngineBMT Bean.java:512)
    at sun.reflect.GeneratedMethodAccessor709.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
    at java.lang.reflect.Method.invoke(Method.java:324)
    at org.jboss.ejb.StatelessSessionContainer$ContainerInterceptor.invoke(StatelessSessionConta iner.java:683)
    at org.jboss.resource.connectionmanager.CachedConnectionInterceptor.invoke(CachedConnectionI nterceptor.java:185)
    at org.jboss.ejb.plugins.AbstractTxInterceptor.invokeNext(AbstractTxInterceptor.java:84)
    at org.jboss.ejb.plugins.AbstractTxInterceptorBMT.invokeNext(AbstractTxInterceptorBMT.java:1 44)
    at org.jboss.ejb.plugins.TxInterceptorBMT.invoke(TxInterceptorBMT.java:62)
    at org.jboss.ejb.plugins.StatelessSessionInstanceInterceptor.invoke(StatelessSessionInstance Interceptor.java:72)
    at org.jboss.ejb.plugins.SecurityInterceptor.invoke(SecurityInterceptor.java:120)
    at org.jboss.ejb.plugins.LogInterceptor.invoke(LogInterceptor.java:191)
    at org.jboss.ejb.plugins.ProxyFactoryFinderInterceptor.invoke(ProxyFactoryFinderInterceptor. java:122)
    at org.jboss.ejb.StatelessSessionContainer.internalInvoke(StatelessSessionContainer.java:331 )
    at org.jboss.ejb.Container.invoke(Container.java:723)
    at org.jboss.ejb.plugins.local.BaseLocalProxyFactory.invoke(BaseLocalProxyFactory.java:359)
    at org.jboss.ejb.plugins.local.StatelessSessionProxy.invoke(StatelessSessionProxy.java:83)
    at $Proxy285.asyncInvokeProcessCommand(Unknown Source)
    at com.adobe.workflow.engine.ProcessCommandControllerBean.onMessage(ProcessCommandController Bean.java:127)
    at sun.reflect.GeneratedMethodAccessor641.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
    at java.lang.reflect.Method.invoke(Method.java:324)
    at org.jboss.ejb.MessageDrivenContainer$ContainerInterceptor.invoke(MessageDrivenContainer.j ava:458)
    at org.jboss.resource.connectionmanager.CachedConnectionInterceptor.invoke(CachedConnectionI nterceptor.java:185)
    at org.jboss.ejb.plugins.MessageDrivenInstanceInterceptor.invoke(MessageDrivenInstanceInterc eptor.java:62)
    at org.jboss.ejb.plugins.AbstractTxInterceptor.invokeNext(AbstractTxInterceptor.java:84)
    at org.jboss.ejb.plugins.TxInterceptorCMT.runWithTransactions(TxInterceptorCMT.java:315)
    at org.jboss.ejb.plugins.TxInterceptorCMT.invoke(TxInterceptorCMT.java:148)
    at org.jboss.ejb.plugins.RunAsSecurityInterceptor.invoke(RunAsSecurityInterceptor.java:90)
    at org.jboss.ejb.plugins.LogInterceptor.invoke(LogInterceptor.java:191)
    at org.jboss.ejb.MessageDrivenContainer.internalInvoke(MessageDrivenContainer.java:372)
    at org.jboss.ejb.Container.invoke(Container.java:723)
    at org.jboss.ejb.plugins.jms.JMSCont

    Sorry, i just read my own message in the discussion forum and
    discovered all spaces for formating the XML tags where gone.
    It should look like this:
    [-----xml_type---]
    <doc>
    __<role>
    ____actor
    ____<first>
    ______john
    ____</first>
    ____<last>
    ______bond
    ____</last>
    __</role>
    __<role>
    ____actor
    ____<first>
    ______james
    ______</first>
    ____<last>
    ______smith
    ____</last>
    __</role>
    </doc>
    semantic:
    There are two actors: "john bond" and "james smith"
    Querying for "john bond" succeedes which is correct
    Querying for "james smith" succeedes which is correct
    Querying for "james bond" fails which is correct
    Querying for "john smith" succeedes which is an ERROR!
    contains(xdata, 'actor INPATH(//role[./first = "john" and ./last
    = "smith"])' (= 100 ---> ERROR!)
    bye,
    feri

Maybe you are looking for

  • Syncing iPhone and iPad with iTunes

    I have an iPhone 4 and an iPad 2 which I sync to the same iTunes on my home PC. Every time I connect my iPhone to my iTunes, it invariably gets synced with whatever apps, music, movies and books which I synced to my iPad 2.   How do I configure my iT

  • Itunes v8 syncprocesses take an eternity when my iPod Touch 2g is connected

    Ever since my upgrade to itunes v8 (on Windows XP) it take minutes for each step of the sync'ing process where they use to take only seconds. I connect my ipod touch and it take 5 minutes for the icon to appear in the 'devices' section. I literally h

  • Chromecast confusion

    I attempted to install Chromecast, and now my wi-fi default appears to be the Chromecast connection, not my Airport.  Can no longer connect to the internet using wi-fi.

  • CX_SY_CONVERSION_NO_DATE_TIME exception

    hello, I have a problem using this service. http://erp.esworkplace.sap.com/sap/bc/srt/xip/sap/ecc_empltimeeventerpcrtrc/version2?sap-client=800&wsdl=1.1&mode=sap_wsdl if you try it on the Web navigator you get the exception below. http://sr.esworkpla

  • Accessing a AB ControlLogix Ethernet Bridge in LabVIEW

    We have some AB SLC500 series PLCs that are currently reporting to our SCADA system (a P3 running NT 4 and an Access DB-- haha) via a DH+ network.  I'm researching the possibility of updating this system using LabVIEW.  We recently bought a ControlLo