We are facing an issue with force view in oracle. Certain underlying objects of the view were modified to add new columns. Post that when we are compiling the view with alter view < view name> compile, we are getting the error
warning: view altered with compilation errors.
On checking the error, we got :
ORA-00942: table or view does not exist.
But when we are executing the view select query it is executing fine and extracting data.
Can somebody help me to fix this issue with view compilation?
"we are executing the view select query it is executing fine "
So it seems the underlying query selects data from a table in another schema i.e. not the schema trying to create a view, or in some other way references an object in another schema.
What has happened is the table owner granted privileges on its table to a role, which is granted to the querying schema. Privileges granted through a roles allow us to write SQL against the granted objects but not to build programmatic objects (PL/SQL, views, etc). To do that, the table owner needs to grant the privileges directly to the querying user.
This is a limitation imposed by the Oracle security model. There is no other workaround.
Related
I worked on an App using my personal workspace. Exported the same and later installed it on a Developer Team workspace.
Several of my pages are getting the ORA-00942: table or view does not exist while running, which doesn't make sense since the tables do exist (I tested this using the 'SQL Commands' option).
Funny thing is that the same code I'm using is actually applied on a different app within the same workspace and it runs perfectly.
Is this normal behavior? Might be due to workspace's configuration?
Thanks!
It could be a "permissions" issue:
http://www.dba-oracle.com/sf_ora_00942_table_or_view_does_not_exist.htm
Answer: There are several common operations that cause a ORA-00942
error:
Table owner name not specified when logged-in as a non-creator of the table.
ORA-00942 on table import (imp or impdp).
ORA-00942 on materialized view refresh.
...
This ORA-00942 error on insert is common when the user you are
signed-on as does not have permission to see the table!
Either make the table public and grant DML privileges:
connect myuser/mypass
create public synonym testtable for myuser.testtable
grant insert, select, update, delete on mytable to public;
Also, review the various replies to this thread. For example:
https://stackoverflow.com/a/36165446/421195
Because this post is the top one found on stackoverflow when searching
for "ORA-00942: table or view does not exist insert", I want to
mention another possible cause of this error (at least in Oracle 12c):
a table uses a sequence to set a default value and the user executing
the insert query does not have select privilege on the sequence. This
was my problem and it took me an unnecessarily long time to figure it
out.
First thing I would check is the parsing schema for the application - see Shared Components -> Security Attributes.
If this is not the same between the two instances of your application, that's the likely explanation.
How to create a user in Oracle that could only view the source code of packages and procedures without changing them and view table fields but not the data in tables?
I know that you could grant a view to specific user, but how to deny access to tables data without hiding fields?
I appreciate any help.
There is a role to view data dictionary info. So the user will be able to view the definition of the tables, view, packages, system objects, etc.
grant select_catalog_role to user;
Or the Select Any Dictionary grant.
But with this grants the user will be able to see many more data than he needs.
An alternative is to grant select on DBA_SOURCE, DBA_TABLES views.
See a discution on dba.stackexchange.com here.
I've found a solution.
You need to create a view on DBA_SOURCE and grant a user SELECT on this view. In that case user will be able to see the code of packages and procedures and table structures, but not execute them.
The given database contains a masterdata (MD) Schema and an application specific Schema (APP). In the APP Schema we have a view which provides the applications data from one table in the scheme joined with data from the MD Schema.
Example: Think of an address book application, which holds an address table, but cities and ZIP codes are joined from a masterdata table in another Schema which is maintained centrally.
CREATE VIEW view_adress AS
SELECT app.ID, app.Street, app.ZIP, zip.CITYNAME
FROM APP.adress app
LEFT OUTER JOIN MD.zipcodes zip
ON app.ZIP = zip.ZIP
This is very simplified. The actual view I use is a lot more complicated like that and therefore I implemented an INSTEAD OF INSERT, UPDATE Trigger to map INSERTs on the view to the correct base table in my APP Schema.
The application users (role) is granted SELECT,INSERT,UPDATE,DELETE on all tables inside this APP Schema. They are also granted SELECT on that zipcode table in the master data Schema.
When I insert on that view, I get an "ORA-01720: Grant Option Does Not Exist"... I don't know the exact cause of this error, but it can be assumed that the INSTEAD-OF Trigger never INSERTS on the ZIP Code Table, only on the address table.
I understand, that granting the application users INSERT privilege on the zipcode table would probably resolve this issue, but I am feeling uncomfortable granting INSERTs on tables to users which they never should edit in any way, because these are only lookups.
Is there another, possibly "the correct way" to solve this?
By "insufficient permissions error" do you mean this?
ORA-01720: grant option does not exist for 'MD.ZIPCODES'
*Cause: A grant was being performed on a view or a view was being replaced
and the grant option was not present for an underlying object.
*Action: Obtain the grant option on all underlying objects of the view or
revoke existing grants on the view.
If so, the solution is that you need to grant the relevant permissions to the schema owning the view - not to the roles that use the view:
grant insert on md.zipcodes to app with grant option;
It's true that you are still having to grant a permission that is logically not required, but you are not granting it to users, only the app schema.
I would simply like to allow a colleague to view and edit the Database I've created.
I've tried:
GRANT ALL on FISHTABLE to CDEMARES;
and it returned Grant succeeded but nothing changed for him and he still wasn't able to view my table.
I also tried
GRANT SELECT smahala.fishtable to cdemares#sole.nefsc.noaa.gov;
but that failed with SQL Error: ORA_00990: missing or invalid privilege.
Is my issue that I don't have the administrative authority to allow someone else to view my Oracle table? Any advice is appreciated, thanks.
Your colleague needs to prefix your table with your schema name, otherwise Oracle doesn't know where to look for it, e.g.:
select * from smahala.fishtable
If they don't do that, and simply try to use:
select * from fishtable
then Oracle will look for the table in their own schema, and then look for a view, or a private synonym, or a public synonym. Your colleague could create a synonym if they'll be accessing this table a lot (and they don't have their own table with the same name). It's also possible to change their session's current schema, but that will make it harder to see their own objects.
You can read more about object naming and how to refer to objects in the documentation.
SQL Developer allows you to browse objects in other schemas. If your colleague was connected when you granted the permissions, they can refresh the object list, or disconnect and reconnect. Either way they should then be abke to see your table under your schema.
(Your second grant statement is missing an on, and you can't grant permissions across a database link, if that's what you're trying to do.)
I have a select statement in a stored procedure that I'd like to pull out and put into a view. The select statement pulls from dba_tables, dba_tab_partitions, and dba_tab_subpartitions.
If I run the statement on its own, it works fine. If I wrap it in a create view statement:
CREATE OR REPLACE VIEW "MYSCHEMA"."V_XWMS_TEST"
(
"OWNER"
,"SEGMENT_NAME"
,"PARTITION_NAME"
,"SEGMENT_TYPE"
,"TABLESPACE_NAME"
)
AS
SELECT "OWNER"
,"SEGMENT_NAME"
,"PARTITION_NAME"
,"SEGMENT_TYPE"
,"TABLESPACE_NAME"
FROM
[Original query]
then depending on which user I'm logged in as, I get either ORA-01031: insufficient privileges or ORA-00942: table or view does not exist. Again, with both users I can create views and I can run this select statement, but I can't run the select statement in the context of creating a view.
This might be caused by the difference between the system privilege SELECT ANY DICTIONARY and the role SELECT_CATALOG_ROLE.
On the surface they do the same thing by granting users access to the data dictionary. Either one of them would enable a user to run a query against tables like DBA_TABLES.
The difference is that roles are not enabled when creating objects with definer's rights, and views are always definer's rights. So to make the view work the user will need the system privilege SELECT ANY DICTIONARY, or a similar direct grant on individual objects.
ORA-01031: insufficient privileges or ORA-00942: table or view does not exist.
This error means that the new table from which the view is created doesn't have synonyms and grants created to be accessed by the schema in which the view is created.