I have 2 schemas:
ARIEL
ARIEL_APEX
All the tables in ARIEL are accessible to ARIEL_APEX and the queries run OK from the ARIEL_APEX schema.
For example,
SELECT * FROM ARIEL.DIM_REGISTRATION_SET
works fine from the ARIEL_APEX schema.
When I try to create a view in ARIEL_APEX:
CREATE VIEW TEST_VIEW AS
SELECT * FROM ARIEL.DIM_REGISTRATION_SET
I get this:
Error at Command Line : 465 Column : 23
Error report -
SQL Error: ORA-01031: insufficient privileges
01031. 00000 - "insufficient privileges"
*Cause: An attempt was made to change the current username or password
without the appropriate privilege. This error also occurs if
attempting to install a database without the necessary operating
system privileges.
When Trusted Oracle is configure in DBMS MAC, this error may occur
if the user was granted the necessary privilege at a higher label
than the current login.
*Action: Ask the database administrator to perform the operation or grant
the required privileges.
For Trusted Oracle users getting this error although granted the
the appropriate privilege at a higher label, ask the database
administrator to regrant the privilege at the appropriate label.
This works absolutely fine in the test and production environment, this is development. DBA saying all is well at their end.
ARIEL_APEX having below privileges.
GRANTEE PRIVILEGE
------------------------------ ----------------------------------------
ARIEL_APEX CREATE JOB
ARIEL_APEX CREATE MATERIALIZED VIEW
ARIEL_APEX CREATE TABLE
ARIEL_APEX CREATE OPERATOR
ARIEL_APEX CREATE VIEW
ARIEL_APEX CREATE TYPE
ARIEL_APEX CREATE SYNONYM
ARIEL_APEX CREATE CLUSTER
ARIEL_APEX CREATE DIMENSION
ARIEL_APEX CREATE TRIGGER
ARIEL_APEX CREATE SESSION
ARIEL_APEX CREATE INDEXTYPE
ARIEL_APEX CREATE PROCEDURE
ARIEL_APEX CREATE SEQUENCE
And we know the grants are OK on the ARIEL objects to ARIEL_APEX as we can execute the query manually.
This is Oracle 12. Never had the issue before we upgraded, but suspect this is related to accessing objects from another schema within a view.
ARIEL_APEX is a member of the ANALYTICS_ROLE, the ANALYTICS_ROLE grants select on all tables in the ARIEL schema, which can be seen to working below.
Works in upper environments, only difference is grants provided by a role...in other environments SELECT grants provided directly on objects.
As noted in the documentation (emphasis added):
The owner of the schema containing the view must have the privileges necessary to either select (READ or SELECT privilege), insert, update, or delete rows from all the tables or views on which the view is based. The owner must be granted these privileges directly, rather than through a role.
If you only have the select privileged on the underlying table granted through a a role then you cannot create a view against it. Even if you move to role generally, you'll have to keep explicit grant on top for any views you want to create.
I imagine this is to do with how roles work. With a direct grant Oracle knows whether you can see the table in the other schema. If you grant select on your view to someone else then when they query the view Oracle knows that the chain of privileges is there. If your direct grant on the table is revoked then there are mechanisms to invalidate dependent objects. But what should happen the role's select privilege on the table is revoked; or your access to the role is revoked; or just within your own session, what should happen if you disable that role - can you still access the view? It's a bit more complicated that it seems at first glance.
Fortunately creating views should be relatively rare and controllable. Most people accessing the table via the role won't need to create a view on it (I assume!).
Another option here is create the view in the ARIEL schema, and then grant privileges to APEX_ARIEL and/or a role. Whether that is appropriate depends on your real view query and your motivation for creating the view.
Related
I would like to know if there is a way to grant permissions to, for example, create table on a schema, from a different user.
I want to do this without granting DBA role, nor granting "ANY" permissions (grant create any table to XXXX).
I use this occasionally to satisfy devs who want a read-only account. This will create DDL that will give appropriate select or execute permissions. It would not be difficult to modify that to include update and delete.
I create user(schema) in oracle. like this
create user EMP_DB identified by netsolpk account unlock;
But when i tried login through schema name and password, login failed. Below is the error message.
user EMP_DB lacks create session privilage; login denied.
I've not created any tablespaces.
For this, do I need to create any tablespace? If needed, how to create a tablespace?
And what more things are required for creating a schema in oracle 11g.
Please help me and give me step by step procedure.
The error user EMP_DB lacks create session privilage; login denied indicates that you need privilege to create a session. So you need to grant the appropriate privilege like,
GRANT CREATE SESSION TO emp_db;
Or You can go with granting the roles(group of privileges), CONNECT and RESOURCE.
CONNECT role has only CREATE SESSION privilege.
RESOURCE has the following privilges,
CREATE TRIGGER
CREATE SEQUENCE
CREATE TYPE
CREATE PROCEDURE
CREATE CLUSTER
CREATE OPERATOR
CREATE INDEXTYPE
CREATE TABLE
To find these PRIVILEGES of a ROLE, You can query the DBA_SYS_PRIVS table with a query like this:
SELECT grantee, privilege, admin_option
FROM DBA_SYS_PRIVS
WHERE grantee='RESOURCE';
Also to use the existing tablespace USERS, You can create a user with QUOTA UNLIMITED statement like,
CREATE USER emp_db IDENTIFIED BY netsolpk QUOTA UNLIMITED on USERS;
the fastest, quickest way to create a new user with privileges is
grant connect, resource to NewUser_name identified by NewUser_password;
by this command you will be sure that errors like above will not displayed.
I'm using Oracle's 10g version.
In the database, I would like to create a configuration table and fill it with data.
Then the other users can not change anything in it, and even better that it was not at all visible to other users. Is it possible to somehow hide the table?
Regards
Create a separate schema for that table. Create a package that provides an API to your configuration data (e.g. to get a value that is needed by another program).
Revoke CREATE SESSION privilege from that schema (i.e. just don't grant any privileges to the schema at all). Don't grant any privileges on the table. The only users who will be able to see the table are those with DBA privileges.
The only thing that database sessions will be able to do is execute the package, IF they have been granted EXECUTE privilege on it.
If you do not grant enough privileges to other users, they could not see your objects.
I have below requirement in oracle database
Create User and grant to all objects in schema "abc"
If i add any tables to schema "abc", then the user should have access by default without executing individual Grant
Current we are executing Grant statements for every objects created in schema, is there any onetime configuration available? Please help
Note: Here user is not a schema owner, for ex. some one who having access to read-only access.
In current versions of Oracle, you could create a DDL Trigger and have this automatically execute a grant on the newly created object to your other user.
See the excellent PSOUG site for an overview: http://psoug.org/reference/ddl_trigger.html
I have access on tables but when I run the same query in Anonymous block it fails with
ORA-00942: table or view does not exist
The Oracle security model means that we cannot build database objects (views, stored procedures, etc) using privileges granted to our account through a role. The privileges have to be explicitly granted to our named account.
This applies to anonymous blocks as well.
So, if you want to build PL/SQL which runs against database objects in other schemas you will have to ask the schema owner - or the DBA - to grant you the privileges you need.