I'd like to install the UDAF string functions that are pre-packaged in Vertica 7. Specifically would like to install group_concat.
Had previously installed this in Vertica 6 but things seem to have changed a bit. E.g. there is no make file, but there is an install.sql/
Here's what I did:
$ vsql -U dbadmin -w secret
> \i /opt/vertica/packages/txtindex/ddl/install.sql
This yields the following output:
------------------------------------
Vertica Analytic Database v7.2.0-0
(1 row)
ALTER SESSION
vsql:/opt/vertica/packages/txtindex/ddl/install.sql:5: ROLLBACK 4650: Schema "TxtIndex" does not exist
vsql:/opt/vertica/packages/txtindex/ddl/install.sql:6: NOTICE 4214: Object "v_txtindex" already exists; nothing was done
CREATE SCHEMA
ALTER SESSION
CREATE LIBRARY
CREATE FUNCTION
GRANT PRIVILEGE
CREATE FUNCTION
GRANT PRIVILEGE
CREATE FUNCTION
GRANT PRIVILEGE
CREATE TRANSFORM FUNCTION
GRANT PRIVILEGE
CREATE TRANSFORM FUNCTION
GRANT PRIVILEGE
CREATE TRANSFORM FUNCTION
GRANT PRIVILEGE
CREATE TRANSFORM FUNCTION
GRANT PRIVILEGE
CREATE TRANSFORM FUNCTION
GRANT PRIVILEGE
CREATE TRANSFORM FUNCTION
GRANT PRIVILEGE
CREATE TRANSFORM FUNCTION
GRANT PRIVILEGE
It looks like it worked but installation failed:
dbadmin=> \i /opt/vertica/packages/txtindex/ddl/isinstalled.sql
?column?
----------
f
(1 row)
The following query also fails
SELECT id, group_concat(distinct organization) AS orgs FROM myschema.mytable GROUP BY id;
And specifically I get this error:
ERROR 3457: Function group_concat(varchar) does not exist, or permission is denied for group_concat(varchar)
HINT: No function matches the given name and argument types. You may need to add explicit type casts
As far as I can see group_concat() installation is commented in /opt/vertica/packages/txtindex/ddl/install.sql (last two lines in this file).
group_concat() sources might be available in the HAVEN Marketplace.
Related
I've been trying to insert data from a materialized view into a table that belongs to a different scheme using a procedure, but when I compile the procedure I get the error of: table or view doesn't exist. I have checked and I have selection and insertion privileges on that table. create or replace PROCEDURE PROCEDURE_MYPROCEDURE AS
BEGIN
INSERT INTO SCHEME.TABLE
(COLUMN1,COLUM2)
SELECT COLUMN1,COLUMN2
FROM MATERIALIZED_VIEW;
END PROCEDURE_MYPROCEDURE;
this line SCHEME.TABLEshows the message "PL/SQL: STATEMENT IGNORED", "TABLE OR VIEW DOES NOT EXIST"
The most likely cause is that you have access via a role not directly, which means you can run it in SQL but for a PLSQL procedure you need a direct privilege granted.
As per the Application Developer guide:
Privileges Required to Create Procedures and Functions
To create a stand-alone procedure or function, or package specification or
body, you must meet the following prerequisites:
You must have the CREATE PROCEDURE system privilege to create a
procedure or package in your schema, or the CREATE ANY
PROCEDURE system privilege to create a procedure or package in
another user’s schema.
Attention: To create without errors, that is, to compile the procedure
or package successfully, requires the following additional privileges:
The owner of the procedure or package must have been explicitly
granted the necessary object privileges for all objects referenced within
the body of the code; the owner cannot have obtained required
privileges through roles.
If the privileges of a procedure’s or package’s owner change, the procedure
must be reauthenticated before it is executed. If a necessary privilege to a
referenced object is revoked from the owner of the procedure (or package), the
procedure cannot be executed.
An easy way to test things is:
SQL> set role none;
SQL> "statement you want to test to see if it'll work in a procedure"
So you might just be missing some direct grants on those objects.
If the procedure is compiled on user a and the MATERIALIZED_VIEW is owned by user b. When you execute the procedure it will look for the materialized view on user a.
Put the user/schema in front of the MATERIALIZED_VIEW.
You would also need to grant select on MATERIALIZED_VIEW to user a.
This is very strange, and not easy to explain, so please bear with me.
Oracle 12.2.0.1 on Linux x86_64.
We have a user called BATCH who has minimal privileges.
CREATE USER batch IDENTIFIED BY batch
DEFAULT TABLESPACE users
QUOTA UNLIMITED ON users;
GRANT CREATE SESSION TO batch;
GRANT EXECUTE ON DBMS_CRYPTO TO batch;
The is a PLSQL package in a schema called ATLED which is :
CREATE OR REPLACE PACKAGE ALTED.the_pkh AUTHID current_user AS
PROCEDURE crttab;
END;
/
CREATE OR REPLACE PACKAGE BODY ALTED.the_pkh AS
PROCEDURE crttab IS
BEGIN
EXECUTE IMMEDIATE 'CREATE TABLE atled.the_tab AS SELECT id, DBMS_CRYPTO.HASH(cc,2) AS cc FROM ARCHIVE.table_b';
END crttab;
END;
/
We are using Code Based Access Control (CBAC - 12c feature) to restrict/control/allow certain canned actions to an otherwise toothless user, so we create a wrapper procedure, grant that a high priv role, and grant execute on that to the batch user:
CREATE OR REPLACE PROCEDURE ALTED.wrapper_crttab AS
PROCEDURE p1 IS
CURSOR c1 is SELECT * FROM SESSION_PRIVS;
BEGIN
FOR r1 IN c1 LOOP
DBMS_OUTPUT.PUT_LINE( r1.privilege );
END LOOP;
END;
BEGIN
p1;
ALTED.the_pkh.crttab;
END;
/
GRANT IMP_FULL_DATABASE TO ALTED;
GRANT IMP_FULL_DATABASE ALTED.wrapper_crttab;
GRANT EXECUTE ON ALTED.wrapper_crttab TO batch;
Now let's run it:
CONN batch/batch
SET SERVEROUTPUT ON
EXEC ALTED.wrapper_crttab;
This causes the error:
Error at line 1:
ORA-00942: table or view does not exist
The tables referenced do exist.
The call to the p1 proc confirms that all the privileges bundled with IMP_FULL_DATABASE are present, including CREATE ANY TABLE, DROP ANY TABLE, EXECUTE ANY PROCEDURE.
If I do this:
GRANT CREATE ANY TABLE TO batch;
GRANT SELECT ANY TABLE TO batch;
CONN batch/batch
EXEC EXECUTE IMMEDIATE 'CREATE TABLE atled.the_tab AS SELECT id, DBMS_CRYPTO.HASH(cc,2) AS cc FROM ARCHIVE.table_b;
This works.
If I change the CREATE TABLE stmt to remove the DBMS_CRYPTO call, it works as well.
The actual package/proc that is called creates a number of tables fine when run as above, but fails on the case when DBMS_CRYPTO is called in any CREATE TABLE stmt.
If I grant the batch user the CREATE ANY TABLE, SELECT ANY TABLE and EXECUTE ANY PROCEDURE privs directly and run the CREATE TABLE command as batch directly then that works too.
So this is not (I think) a straight ORA-942 error, but something related to a chain of privileges to DBMS_CRYPTO, and only when executed in a package stored procedure, but what exactly I do not know.
UPDATE 1
If I create a wrapper for DBMS_CRYPTO.HASH as follows:
CREATE OR REPLACE FUNCTION batch.crypto_hash ( pcc IN CLOB ) RETURN VARCHAR2 IS
BEGIN
RETURN DBMS_CRYPTO.HASH(pcc,2);
END;
/
Then replace the DBMS_CRYPTO.HASH(cc,2) in the CREATE TABLE stmt with batch.crypto_hash(cc) then it works!!!
So, DEFINITELY not a issue with grants on teh tables being referenced, but more likely something internal with the way DBMS_CRYPTO works. Perhaps it reads a look up table somewhere. I tried GRANT EXECUTE ON UTL_I18N to batch as well before this but that didn't work.
So I have a workaround, but woudl still like to know why this happens.
You're doing this:
... FROM ARCHIVE.table_b
User, who is supposed to select from that table, has to have SELECT privileges on it. It can be granted
via role
directly
If you granted the privilege via role, it works - but not in named PL/SQL procedures. It will work in anonymous PL/SQL, but not in procedures, function, packages, so - check that and, possibly, grant SELECT on table_b directly to that user.
--I'm using a view named V_AREA and it's SYNONYM: AREA
However, when I try to grant select permissions to my role, I get the following error:
GRANT SELECT ON AREA TO MY_ROLE
ERROR at line 1: ORA-02225: only EXECUTE and DEBUG privileges are valid for procedures
I'm not using a procedure, what can I do?
I've tryed to use the following grants:
Grant select on area to my_role; --this one gives the above error
Grant select on 'area' to my_role; --this gives other error
Grant select on "area" to my_role; --this gives the same error as 'area'
EDIT:
I have 2 synonyms created named AREA: one to my view V_AREA and other to OGC_AREA. No procedures involved
grant references to the user on all the base tables used in the view using this
Grant references on your_schema.tablename to target_schema or user;
I have created synonyms for functions/proc/seq in userid YYY from user id XXX.
create SYNONYM my_seq FOR XXX.my_seq
When I try to use the seq in user YYY, I am getting following error :
ORA-00942: table or view does not exist
and with functions : ORA-00904: : invalid identifier
Please let me know where I am doing wrong.
I am going to demonstrate with a simple example. I have two schemas on one server. Schema1 and Schema2.
I logon to Schema1 and run the script below.
-- Create sequence
create sequence originalSeq
minvalue 1
maxvalue 999999999999999999999999
start with 1
increment by 10
cache 20;
GRANT SELECT ON originalSeq TO SCHEMA2;
Then I logon to Schema2 and run the following script.
create or replace synonym pointertooriginalsreq
for SCHEMA1.originalSeq;
select pointertooriginalsreq.nextval from dual
this should work in all versions of Oracle 8.1.7 upwards. Please let me know if you're still facing a problem.
You have to provide grants from XXX user:
GRANT SELECT ON my_seq TO YYY;
Oracle 10g. I'm new to procedures, so maybe I'm missing something obvious.
Schema owner ABC has table T2001_WRITEOFF. First I had granted SIUD to some_update_role, and granted that role to developer user IJK. User IJK then created synonym T2001_WRITEOFF for ABC.T2001_WRITEOFF; This worked with normal SQL DML commands.
However, I read elsewhere on here that grants via a role do not work in stored procedures. I dropped the synonym from IJK; then from ABC, granted SIUD directly to IJK. From IJK, normal SQL DML works.
When I try to create a simple procedure as follows, it throws PLS-00201 identifier 'T2001_WRITEOFF' must be declared, and points to the 2nd line. This error is the same whether I use the role grants or not.
create or replace procedure woof1(
fooname in T2001_WRITEOFF.territory%TYPE, <=== error points here
bardesc IN T2001_WRITEOFF.ind_batch_submit%TYPE) IS
BEGIN
INSERT into T2001_WRITEOFF
VALUES ( fooname, bardesc);
END woof1;
/
Thanks in advance for help
JimR
In order to make role right applicable in stored procedures you might want to look at authid current_user in the oracle documentation. Also helpful: http://docs.oracle.com/cd/E11882_01/appdev.112/e25519/subprograms.htm#LNPLS682