Distribution and recovery of oracle permissions
Allocation of permissions:
1. Grant is used to assign roles, system permissions and object permissions to users and roles.
2. Prerequisites for empowerment:
System permissions: have the system permissions of "grant any privilege" and use "admin option" when granted the system permissions
Role permissions: 1) grant role permissions with "admin option"; 2) be granted "grant any role" system permissions; 3) be the creator of the role.
Object permissions: 1) is the owner of the object; 2) the object permission is granted with "grant option"; 3) it is granted the "grant any object privilege" permission
3. Grammar:
Grant [grant_system_privileges | grant_object_privileges]
Grant_system_privileges:
{system_privilege | role | ALL PRIVILEGES}
[, {system_privilege | role | ALL PRIVILEGES}].
TO grantee_clause [WITH ADMIN OPTION]
Grantee_clause:
{user [IDENTIFIED BY password] | role | PUBLIC}
[, {user [IDENTIFIED BY password] | role | PUBLIC}].
Grant_object_privileges:
{object_privilege | ALL [PRIVILEGES]}
[(column [, column]...)]
[, {object_privilege | ALL [PRIVILEGES]} [(column [, column]...)]].
On_object_clause TO grantee_clause [WITH HIERARCHY OPTION] [WITH GRANT OPTION]
On_object_clause:
ON {[schema. ] Object
| | DIRECTORY directory_name |
| | EDITION edition_name |
| MINING MODEL [schema.] Mining_model_name
| JAVA {SOURCE | RESOURCE} [schema. ] Object
}
Remember "grant privilege to user".
-
Recovery of permissions:
1. Grammar
REVOKE {revoke_system_privileges | revoke_object_privileges}
Revoke_system_privileges:
{system_privilege | role | ALL PRIVILEGES}
[, {system_privilege
| | role |
| | ALL PRIVILEGES |
}
]...
FROM grantee_clause
Revoke_object_privileges:
{object_privilege | ALL [PRIVILEGES]}
[, {object_privilege | ALL [PRIVILEGES]}].
On_object_clause
FROM grantee_clause
[CASCADE CONSTRAINTS | FORCE]
Grantee_clause:
{user [IDENTIFIED BY password]
| | role |
| | PUBLIC |
}
[, {user [IDENTIFIED BY password]
| | role |
| | PUBLIC |
}
]...
On_object_clause:
ON {[schema. ] Object
| | DIRECTORY directory_name |
| | EDITION edition_name |
| MINING MODEL [schema.] Mining_model_name
| JAVA {SOURCE | RESOURCE} [schema. ] Object
}
Remember "revoke permissions from user"
System permissions cannot be cascaded and object permissions can be cascaded.
-
