I want to create a user/schema in oracle 11g and grant all privileges to the user. How can I do this with a simple script. I looked at the following links but I am not sure which one to use or if these statements are the best way.
http://ss64.com/ora/grant.html
Can you suggest how I may do this in the simplest possible way and securely ?
To create a new user you use the "create user" command. So a typical create user command would be :
create user test identified by test default tablespace mytbsp.
Of course you need to replace the values for the user, password and tablespace with different values. However I'd recommend that you have a look at Oracle's documentation http://docs.oracle.com/cd/B19306_01/server.102/b14200/statements_8003.htm.
The next step is to grant the user the corresponding rights. To give a user all the rights is a very bad approach as you would also give him dba privileges. What you instead is to give him connect privileges and the permissions to his default tablespace. Also it is better to use roles instead of granting the rights directly. So if you have to grant the rights again you only need to grant the role. First step is to create the role:
GRANT CREATE session, CREATE table, CREATE view,
CREATE procedure,CREATE synonym,
ALTER table, ALTER view, ALTER procedure,ALTER synonym,
DROP table, DROP view, DROP procedure,DROP synonym
TO MyRole;
This statement is not complete you might require additional rights (index maintenance for instance), but have a look at the online oracle documentation.
After that you grant the role to the newly created user.
GRANT myrole to test;
Create the user:
create user user_name identified by password ;
Grant the privileges:
grant all privilege to user_name;
If you want to view the number of privileges:
select * from system_privilege_map where neme like '%PRIV%';
If you want to view privileges assigned to the users:
select count (*) , grantee
from dba_sys_privs
where grantee in ('user1','user2')
group by grantee ;
Related
I want to use MySQL partial revokes in MariaDB, but there does not seem to be any reference of it in the docs, so is there are workaround?
I grant user foo privileges on *.*, and I want to partially revoke its permission to select column password on table users - how can I do this?
CREATE USER 'foo'#'%' IDENTIFIED BY 'password';
GRANT SELECT, INSERT, DELETE, UPDATE ON *.* TO 'foo'#'%';
REVOKE SELECT (password) ON production.users FROM 'foo'#'%';
Such thing results in:
ERROR 1147 (42000): There is no such grant defined for user 'foo' on host '%' on table 'user'
Version: 10.3.31-MariaDB-0+deb10u1-log
Perhaps I could do something like this easily with roles? If so, can you give examples to do so?
MDEV-14443 negative grants is actively being worked on so hopefully 10.9.
At the moment creating the grants excluding your password is one option.
The other is putting the password (by which I hope you mean a uniquely salted hash or KDF) in a different table.
I am running Oracle 11.g and the id I am using has DBA role (full access supposedly).
When I tried to create a table under another schema, it works fine. However, when I tried to create a table with organization index, I was prompted
ORA-01950: no privileges on tablespace
I double checked my id has unlimited tablespace. My ID and the targeted schema are both in the same tablespace.
Supplemental info: I am able to run the same creat table statement w/ organization index under my own schema.
Creating objects may require two privileges: your user needs privileges to create the objects, and the schema owner needs privileges to use resources related to that object. So while you have the ability to create a table in another schema, that schema also needs the privileges to write data to the related tablespaces:
alter user $username quota unlimited on $tablespace;
This approach is safer than granting the UNLIMITED TABLESPACE role. That role grants more than necessary, and if someone later tries to cleanup the privileges, revoking that role also undoes individual privileges, as described in this article.
I granted the targeted schedma unlimited tablespace and it's resolved.
Is there an easy way to create a user and grant all privileges to all databases except a specific one?
I've tried this
CREATE USER 'demo'#'%' IDENTIFIED BY 'QbSv9qUj2EJ8mxm2';
GRANT ALL PRIVILEGES ON *.* TO 'demo'#'%';
REVOKE ALL ON id8694160_sqless.* FROM 'demo'#'%'; -- this is the DB I don't want the user to have access to
SHOW GRANTS FOR 'demo'#'%';
But I get the following error:
Error Code: 1141. There is no such grant defined for user 'demo' on host '%'
Is this even possible?
According to the documentation:
Global privileges are granted using *.* for priv_level. Global privileges include privileges to administer the database and manage user accounts, as well as privileges for all tables, functions, and procedures. Global privileges are stored in the mysql.user table.
Database privileges are granted using db_name.* for priv_level, or using just * to use default database. Database privileges include privileges to create tables and functions, as well as privileges for all tables, functions, and procedures in the database. Database privileges are stored in the mysql.db table.
It means that the privileges you grant with GRANT ALL PRIVILEGES ON *.* TO 'demo'#'%'; is represented by one row in the mysql.user table. Revoking privileges for only one database from these global privileges means removing the global privileges from the mysql.user table and add one database privilege for each database except the id8694160_sqless database, in the mysql.db table.
I'm quite sure the REVOKE statement does not do this but you can manually give privileges to all databases except one with a request such as :
INSERT INTO mysql.db
SELECT '%',schema_name,'demo','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y'
FROM information_schema.schemata
WHERE NOT schema_name = 'mysql'
AND NOT schema_name = 'information_schema'
AND NOT schema_name = 'performance_schema'
AND NOT schema_name = 'id8694160_sqless';
FLUSH PRIVILEGES;
I need to know end date of role in Teradata. I know how I get create date
select * from dbc.rolemembers a
join dbc.allrights b
a.rolename=b.rolename
But I can't find where is the end of role. In Teradata Administrator I can't find it too. Please, can you help me?
Thank you
What you are trying to explain is an audit process for the creation of a role, the rights it was assigned and to whom the role was assigned. That is above and beyond the DCL statements to CREATE {role}, GRANT {access} TO {role}, REVOKE {access} FROM {role}, GRANT {role} TO {member}, REVOKE {role} FROM {member}, DROP {role}. It also falls outside the scope of Teradata Administrator or Teradata Studio to track that information.
If you have a security requirement that stipulates you need to track this level of detail, you can either piece it together from sufficient DBQL history or you can create a set of stored procedures that are used by your Security Administrator and/or DBA team to administer role based privileges and user administration.
Beyond that, you can also use Access Logging to track the successful or denied execution of CREATE/DROP USER, CREATE/DROP ROLE, and GRANT statements that are run outside the context of the stored procedures you have put in place to audit the administration of privileges in your environment.
I want to create an application about one user select other users and define there privileges, but this user don't be a Administrator or "dba". A sentence as:
GRANT GRANT TO BIG_USER;
The "Big User" have many privileges, another users the same or less.
Thanks
If you want to grant all grant that have been given to a user to some other users at first you should get that user grants then for each user write a script to give that grant. the following tables show the grant for each user
USER_SYS_PRIVS, USER_TAB_PRIVS, USER_ROLE_PRIVS tables
write a query to get privileges and then give them to other users
Oracle's permission system allows a bit of granularity regarding what you can allow this user to grant.
For objects (tables, etc) you have to either be a dba, the object owner, or have permissions granted with the grant option. So the following should work:
GRANT ALL PRIVILEGES ON mytable TO WITH GRANT OPTION;
You would have to repeat this on every table the user needs to be able to manage permissions on.
This answer is assuming you are looking at permissions on objects (tables etc) rather than system privileges.