roles and privileges
I created a user and the roles to access the tables.
SQL > create role trans_role;
SQL > grant select, insert, delete, update on pmms.table1 to trans_role;
SQL > grant select, insert, delete, update on pmms.table2 to trans_role;
SQL > grant trans_role User1, User2.
SQL > grant connect User1, User2.
But there is error when user1, user2 connected and tried to select tables.
SQL > select * from pmms.table1;
Select * from pmms.table1
*
ERROR on line 1:
ORA-00942: table or view does not exist
SQL >
Hello
don123 wrote:
... I know that the password is case sensitive but I don't know if username is also case sensitive in oracle? ...
Yes, the user names are case-sensitive in Oracle. "User1" is not the same user name "user1".
(Passwords are case-sensitive in Oracle 11.1 and upward, not in earlier versions.)
Tags: Database
Similar Questions
-
Cannot run script queued for roles and privileges
Hi all;
I'm recreating a u1 user and also try to attempt to define the roles and privilege from the file put on hold.
but I get the error message.
$ cat f1.sql
GRANT CONNECT to u1
Grant RESOURCE to u1
Grant CREATE SESSION to u1
Grant UNLIMITED TABLESPACE to u1
Grant CREATE TABLE to u1
Grant CREATE ANY TABLE to u1
Grant CREATE the CLUSTER to u1
Grant CREATE SYNONYM to u1
Grant CREATE VIEW to u1
Grant CREATE SEQUENCE to u1
Grant CREATE ANY SEQUENCE to u1
Grant CREATE DATABASE LINK to u1
Grant CREATE PROCEDURE for u1
Grant CREATE TRIGGER to u1
Grant CREATE TYPE U1
GRANT CREATE OPERATOR to u1
Grant CREATE INDEXTYPE U1
SYS > create the u1 user identified by u1;
Created by the user.
SYS > @f1.sql;
5
DB version is 11.2.0.1 on redhat 4.7
Thank you
Where are you semicolons? Each command must end with a semicolon.
Hemant K Collette
-
Roles and privileges, I'm really confused, 1st edition
I'm having some trouble with the privileges assigned through roles. I read a few articles on the topic, but I'm still confused. I have actually some problems and I am speaking to them in two separate threads: this one and 'roles and privileges, I'm really confused, 2nd edition.
To begin with, I am familiar with the following statement.
, The owner of the schema containing the view must have the necessary privileges to either select, insert, update, or delete rows from all tables or views on which the opinion is based. The owner must be granted these privileges directly, rather than a role.
Here's what's happening.
I have a role, say ROLE1 has the privilege of system CREATE SEQUENCE (without the GRANT OPTION) are attributed to him. I then set ROLE1 User1 (it's just a dummy user and a role, if they conflict with reserved roles or accounts, they are not the real names of role and the user that I use). User1 has also created a package in its schema that calls a SEQUENCE to CREATE breast in a package procedure.
When the user runs the package procedure we get an insufficient privileges error. When we do a SELECT * FROM SESSION_PRIVS the CREATE SEQUENCE privilege is listed; This should mean that the user can create a sequence, right? However, when the privilege is assigned directly to the user directly to the user, not by a role, the statement runs without error.
I don't understand this. The user has the CREATE SEQUENCE privilege through the role, verified by the SESSION_PRIVS table (or view), but is not able to create the sequence, unless this privilege is assigned directly to the user - if this is true, that I seem to contradict the purpose of having roles.
Anyway, anyone know how I can get it to work properly?DBelt wrote:
We are talking about all rights of the DEFINER vs applicant rights. I won't use the rights of the appellant, I like the guarantee of the rights of the author. WO what should I do to get things to work with the rights of the author?Grant privilege explicitly to the user, not a role.
-
Trying to auto generate roles and privileges
Hello all,.
Oracle 11g v11.2.0.1.0 on Windows Server 2008 Enterprise
I have a database with many schemas. One of the patterns is referred to as the CM_MASTER schema in that it was granted the following: s/n, create user, drop user, alter user, create any table, select any table and a few others, all with the clause "with admin option".
We have developers who need to select only the access to tables and views non-maitre patterns. My plan was to create a unique ROLE for each schema, then grant select on each table and discovers in this scheme to this unique role. Then grant the role appropriate to every developer therefore giving them only read access.
I can accomplish the above manually when you are logged in as the CM_MASTER schema.
I am creating a procedure owned and run by the schema CM_MASTER which creates a new role and then give this role. The procedure accepts a parameter that contains the username of the target schema. The procedure is able to create the role (create a role scott_r) successfully.
However, I get an error of insufficient privileges (see below), after that the role was created, trying to issue the command "grant select on scott.some_table to scott_r" via "immediate execution".
Any ideas, what privilege (s) the user needs CM_MASTER to be able to issue the grant (s) for the role?
Error message below:
exec ('scott') gen_schema_role;
Error report:
ORA-01031: insufficient privileges
ORA-06512: at "CM_MASTER. GEN_SCHEMA_ROLE', line 30
ORA-06512: at line 1
01031 00000 - "insufficient privileges".
The procedure code is below:
Utl_file.put_line commands have been added for debugging, but nothing came out.
When the "immediate execution" lines are commented, the utl_file.put_line command output displays the correct SQL create and grant statements.
create or replace
procedure gen_schema_role (p_db_user in varchar)
as
v_role_name varchar2 (30);
v_bat_out utl_file.file_type;
cursor get_object_names is
Select object_name dba_objects
where owner = upper (p_db_user)
and object_type in ('TABLE', 'SEE')
and status = "VALID".
and object_name not like "DR$ %.
and object_name not like '% XT;
Start
v_bat_out: = utl_file.fopen ('SR_BACKUP', 'Create_Roles.sql', 'W');
v_role_name: = substr (p_db_user, 1, 28). '_r';
UTL_FILE.put_line (v_bat_out, ' ');
UTL_FILE.put_line (v_bat_out, 'create role' | v_role_name);
run immediately "create role" | " v_role_name; < <-this seems to work, the role is created
for a get_object_names in
loop
UTL_FILE.put_line (v_bat_out,' grant select on ' | p_db_user |) '.' || a.object_name | « à » || v_role_name);
run immediately ' grant select on "| p_db_user | '.' || a.object_name | « à » || v_role_name;
end loop;
UTL_FILE.fclose (v_bat_out);
end gen_schema_role;
Thank you
SnydsHello
It seems that CM_MASTER needs to GRANT any OBJECT PRIVILEGE.
And this should be given directly to him (not by the role DBA, which you shouldn't use anyway)
My guess is, however, that this will not work unless scott has actually created his own one or more tables.
Concerning
Peter -
Roles and privileges of the sys schema default APPS
Dear all
What are all the privileges system & roles should be there, and unlimited tablespace should be there?
Guru cleared my doubt that DBA should not be there for apps schema. but I need information please.
Thank you and best regards,
Apps user must have quota access on the following storage spaces:
APPS_TS_ARCHIVE
APPS_TS_INTERFACE
APPS_TS_MEDIA
APPS_TS_NOLOGGING
APPS_TS_QUEUES
APPS_TS_SEED
APPS_TS_SUMMARY
APPS_TS_TX_DATA
APPS_TS_TX_IDX
APPS_TS_TX_INTERFACE
You can use this command for the applications of the user to have unlimited quotas on the tablesapces above - alter apps on
unlimited user quota. Thank you
Hussein
-
vCenter roles and privileges to migrate virtual machines
I created a custom role named 'Build VMs' that I have assigned to an ad group. This role is assigned in the data centers, all spread and no. folder where elsewhere. The role was designed to allow a specific group of users to manage virtual machines (create, move, delete, but not clone, etc.).
For the most part, it works fine, but I have a problem: they cannot migrate powered off VMs. vMotion is available and works, but I need to move a cluster virtual machines to a different (more old hw & 3.5 to new hw & 4.1).
The role has the following privileges:
Name Id
---- --
Anonymous System.Anonymous
View System.View
Read System.Read
Create the folder Folder.Create
Allocate space Datastore.AllocateSpace
Update of virtual machine files Datastore.UpdateVirtualMachineFiles
Configure Network.Config
Affect the Network.Assign network
Change DVSwitch.Modify
Operation of DVSwitch.PortConfig port configuration
Setting of port DVSwitch.PortSetting operation
Change DVPortgroup.Modify
Create the virtual machine Host.Local.CreateVM
Reconfigure the virtual machine Host.Local.ReconfigVM
Create new VirtualMachine.Inventory.Create
Create existing VirtualMachine.Inventory.CreateF...
Register VirtualMachine.Inventory.Register
Delete VirtualMachine.Inventory.Delete
Unregister VirtualMachine.Inventory.Unregister
Move VirtualMachine.Inventory.Move
Power VirtualMachine.Interact.PowerOn
VirtualMachine.Interact.PowerOff power off
Suspension VirtualMachine.Interact.Suspend
Discount to zero VirtualMachine.Interact.Reset
Question answer VirtualMachine.Interact.AnswerQu...
Console interaction VirtualMachine.Interact.ConsoleI...
Device connection VirtualMachine.Interact.DeviceCo...
Configure support CD VirtualMachine.Interact.SetCDMedia
Configure floppy media VirtualMachine.Interact.SetFlopp...
VMware Tools install VirtualMachine.Interact.ToolsIns...
Buy tickets to control comments VirtualMachine.Interact.GuestCon...
Defragmentation of disks all VirtualMachine.Interact.Defragme...
Turn on the VirtualMachine.Interact.CreateSe of fault tolerance...
Disable VirtualMachine.Interact.TurnOffF of fault tolerance...
Test failover VirtualMachine.Interact.MakePrimary
Restarting the VM VirtualMachine.Interact.Terminat secondary...
Disable VirtualMachine.Interact.DisableS of fault tolerance...
Enable fault tolerance VirtualMachine.Interact.EnableSe...
Record session on Machine virtual VirtualMachine.Interact.Record
Review the session on virtual computer VirtualMachine.Interact.Replay
Backup operation on a virtual machine VirtualMachine.Interact.Backup
Create a screenshot VirtualMachine.Interact.CreateSc...
Rename VirtualMachine.Config.Rename
Add a disk existing VirtualMachine.Config.AddExistin...
Add the new disk VirtualMachine.Config.AddNewDisk
Remove the VirtualMachine.Config.RemoveDisk disc
Raw device VirtualMachine.Config.RawDevice
Host VirtualMachine.Config.HostUSBDevice USB device
Change the number of CPU VirtualMachine.Config.CPUCount
Memory VirtualMachine.Config.Memory
Add or remove devices VirtualMachine.Config.AddRemoveD...
Change the settings of the device VirtualMachine.Config.EditDevice
Parameters VirtualMachine.Config.Settings
Change resources VirtualMachine.Config.Resource
Updating of the virtual hardware VirtualMachine.Config.UpgradeVir...
Reset the VirtualMachine.Config.ResetGuest customer information...
Advanced VirtualMachine.Config.AdvancedCo...
Lease of disk VirtualMachine.Config.DiskLease
Swapfile placement VirtualMachine.Config.SwapPlacement
Extend the virtual disk VirtualMachine.Config.DiskExtend
Change disk monitoring VirtualMachine.Config.ChangeTrac...
Unlock the virtual machine VirtualMachine.Config.Unlock
Queries files without owner VirtualMachine.Config.QueryUnown...
Reloading the way VirtualMachine.Config.ReloadFrom...
Compatibility VirtualMachine.Config.QueryFTCom of the fault tolerance of queries...
Customize the VirtualMachine.Provisioning.Cust...
Promote records VirtualMachine.Provisioning.Prom...
Deploy the model of VirtualMachine.Provisioning.Depl...
Clone model VirtualMachine.Provisioning.Clon...
Mark as virtual machine VirtualMachine.Provisioning.Mark...
Read about the customization VirtualMachine.Provisioning.Read...
Edit the VirtualMachine.Provisioning.Modi customization specifications...
Allow access to the disk VirtualMachine.Provisioning.Disk...
Allow access to the read-only disc VirtualMachine.Provisioning.Disk...
Assign the virtual machine resources... Resource.AssignVMToPool
Migrate from Resource.HotMigrate
Query vMotion Resource.QueryVMotionIt is the main thing I thought it would take to a simple move of a virtual machine while it is turned off:
Name Id
---- --
Move VirtualMachine.Inventory.MoveI gave to create a folder because some of the permissions were not yet allowing the creation of virtual machines, even though it probably isn't necessary.
Any ideas?
~ Luc
http://thephuck.comWhat happens if you add resources > permission to move?
-
problem users, roles and privileges!
Hello world
I use oracle 10.2.0.
I have a (dba1) user who is the owner of the tables in my database. I have connected to sqlplus as sysdba and created the admin role < b > < /b > and granted the admin privileges.
Then I gave the admin < /b > < b > user dba1 role:SQL> grant all privileges to admin; Grant succeeded. SQL>
I created another role, sel_role and gave privileges to select tables. For example:SQL> grant admin to dba1; Grant succeeded.
Now, I created another user, Anton and gave this user the sel_role role:SQL> grant select on kund to sel_role; Grant succeeded.
Now when I try to login as anton and try to use the select statement that is given to Anton by sysdba, using the sel_role, to select the kund table, I get an error:grant sel_role to Anton; Grant succeeded.
What could be the solution to this problem?SQL> connect anton/oracle Connected. SQL> select * from kund; select * from kund * ERROR at line 1: ORA-00942: table or view does not exist
Thanks in advanceOops, has nothing to do with provoleges. Kund table is not owner by user anton, right? Therefore, you must perfix with the owner, that is, based on "I have a (dba1) user who is the owner of the tables in my database", dba1. Then issue:
Select * from dba1.kund;
SY.
-
A query involving roles and privileges.
I am trying to create the following query:
Given a table (or view) and a user, I wish that the query to list all the ways of the roles with which the user has been granted given privilege (for example "SELECT") to the selected table. The path will look something like
TABLE = > ROLE1 = > ROLE2 = > 3 = > USER
If the user only has the right to SELECT on the table that the query will return well on lines. If there is more than one path through which the user gets the privilege, then the query returns multiple lines.
Can someone help please
GeorgeHi, Girard,.
Sorry, I can't reproduce the problem. I get ouptut like this:
PATH -------------------------------------------------------------------------------- DBA_TS_QUOTAS => SELECT_CATALOG_ROLE => DBA => FUBAR DBA_TS_QUOTAS => SELECT_CATALOG_ROLE => FUBAR DBA_TS_QUOTAS => SELECT_CATALOG_ROLE => EXP_FULL_DATABASE => DBA => FUBAR DBA_TS_QUOTAS => SELECT_CATALOG_ROLE => IMP_FULL_DATABASE => DBA => FUBAR DBA_TS_QUOTAS => SELECT_CATALOG_ROLE => OLAP_DBA => DBA => FUBAR
Message from the query that you run in fact, even if you copied it just of my message. There may be an error in editing.
All the names within quotation marks are correctly capitalized?
This query works for any table and the user? Try on a few cases where you know exactly why (or at least a reason why) a certain user has privileges on a table of some.What system user privileges GEO2 there? View the results of
SELECT privilege FROM dba_sys_privs WHERE grantee = 'GEO2' ;
This doesn't apply right now, but remember that the name you may know a synonym. The view used in this query, dba_role_privs, and dba_tab_privs, only covers the real table names. DBA_SYS_PRIVS is a synonym, but it happens be the actual name of the display also, so, as I said, which is not causing your current problem. Just keep in mind if you use the data dictionary views that contain $ in their names.
Published by: Frank Kulash, 17 December 2010 15:34
I just saw your discussion with Justin; I see you have already posted the system privileges.
I guess that any role GEO2 has, directly or indirectly, might have a privilege of system as SELECT ANY DICTIONARY.
What happened to you?WITH all_roles AS ( SELECT granted_role , SYS_CONNECT_BY_PATH (granted_role, '/') AS path FROM dba_role_privs START WITH grantee = 'GEO2' CONNECT BY grantee = PRIOR granted_role ) SELECT r.granted_role , r.path , p.privilege FROM all_roles r JOIN dba_sys_privs p ON r.granted_role = p.grantee WHERE privilege LIKE 'SELECT ANY%' ;
Published by: Frank Kulash, 17 December 2010 15:47
-
Hi, I am using db oracle 10g, sql developer 4.0.2
I create a user called "MED" and he has granted privileges "Role DBA, ALTER SYSTEM, SELECT ON V_$ SESSION."
I export it and then import it again, it will have these privileges or any other privilege I granted him his?
-I do not understand because each user you create, you must grant "create session and select,..." etc", but when I tried after him granting the privileges above,.
I found it can establish a connection and can choose, but cannot select session $ v for example (as I remember)!
What is the role here please? and what do I do to import the user with privileges, I give him?
Thank you
Hello
Export will retrieve roles and privileges of access granted to a user. However, it will not extract direct subsidies to the system objects. So in your case, all will be loaded by import outside the selection on v_$ session
see you soon,
rich
-
Dump the roles and permissions
I want to empty the roles and privileges for my virtual Center for audit purposes. How can I do this? Sorry for not not googling and asking questions here directly.
Get-PSSnapin -Registered | Add-PSSnapin -ErrorAction SilentlyContinue Connect-VIServer -Server myVC.fqdn -User myUser -Password myPass $si = Get-View ServiceInstance $am = Get-View $si.Content.AuthorizationManager $am.RoleList | % { $_.Name $_.Privilege | Sort | % { "`t" + $_ } } | Out-File c:\dumpRole.txt | Notepad c:\dumpRole.txt
-
CUCM: Roles and permissions for Reset/restart of the phone or apply Config
Can someone tell me what the authorization must be added to a role to allow a user to this role of restart/reset (or apply config - same thing really) a phone device?
The popup once you press reset/retart or apply config shows just "user is not authorized to access this page."
Thank you
Ben.
Hi Ben,
What is your version CUCM? you use any custom for these end-users role which reset/restart?
If so, please add privileges to read/set up-to-date for the resource ' Voice Mail pilot web pages "to the custom role and check.
Please check this bug ID: CSCug29903
-
Re: Script to retrieve vCenter roles and responsibilities
Hello guys,.
I need a script to do the following
The script should generate the following details in a csv format: vCenter roles and responsibilities-> AD groups assigned to this role-> privileges assigned to this role.
vCenter roles name
(List of all roles)Details on using
(Inscription on the groups or users
added to the particular role)List each of the role privilege.
For example: data center-> Global etc...Thank you
VK
Hello
Always try to LucD scripts, it is one of the best scripter, check below one of his screenplay
http://communities.VMware.com/message/1642302
Thank you
-
Role and authorization in VC for each user
Hello world
I want to pull-out user role and permissions for all users exist in the VC findout this privilege they have and that members that they belong and also at what level of Powercli script in csv. Any help on this appreciated.Thank you
vmguyYou want to say that the XML file attached to your previous answer?
Yes, I did. And it is empty (except for the XML framework).
This seems to indicate that the script was not able to retrieve the roles and permissions.
Led me to believe that the 'Get-View Manager' does not work for one reason or the other.
-
Hello
I am trying to install a role and authorization in vCenter 4.1 so that another user of vCenter 'read only' access can display CapacityIQ. Documents say to seek a role capacity IQ, but I have not found one. By the documentation.
Procedure
1. reboot the vSphere Client.
2. Add the global privilege CapacityIQ in a new or existing role.
3 right click on the folder root of the server vCenter in the inventory tree and select Add permission.
4 in the dialog box assign permissions, assign the new role or existing user that accesses CapacityIQ.The global privilege CapacityIQ there simply isn't. How can I add this to so I can grant the necessary access?
Thoughts anyone?
Best regards
Edward L. Haletky
Host communities, VMware vExpert,
Author: VMware vSphere and Virtual Infrastructure Security,VMware ESX and ESXi in the 2nd business edition
Podcast: the Podcast for security virtualization of resources: the virtual virtualization library
Hey Ed,.
I see my Caron, there is a privilege 'CapacityIQ' in the category 'Global' of roles. What do you see in your environment? I do not see a role 'default' created by Caron, so think you must associate a user with this privilege. I'm running the 1.5.0 last version of Caron, if this can help
-
Security roles and workflow management groups
People,
There is a section on Workflow management groups and security roles in vCloud Request Manager Installation and Configuration Guide - Guide of Directors Chapter 5 and 6. I have difficulty working on the relationship between the two settings.
My first question is around the goal of the WM default checkbox that the specific guide is used to set the default user workflow management group.
What would a never used default WM? I mean, what would he ever substitute the other workflow management groups that you define.
In addition, in the guide, it say cloud Blueprint Admin and Asset Manager security role is a combination of the Admin of Blueprint of cloud and the Asset Manager. Is cloud Blueprint Admin & Asset Manager being the two groups of workflow management, reasonable to assume that a security role is composed of workflow management groups?
And when I select agent, I do not see a cloud Blueprint Admin and Asset Manager security role listed?
Finally, is there a way to determine the exact permissions that contains a workflow management group/security role?
Thank you
Cormac
The Group Management (WM) default workflow is largely an artifact of vSM based vRM.
VSM, a group of WM is a collection of agents used to apply security and route of tasks, among other responsibilities. (For the purpose of vRM, an agent can defined as users who have access to the vRM admin interface).
vRM mainly use WM groups as a way to deliver relevant communications to users based on their responsibilities for example vCD Admins, Asset Managers etc. vRM does not require other functions related to WM groups.
For functional reasons, vSM requires that each officer with access to the capabilities of WM belong at least a WM group. In addition, at least one of these groups must be designated the default WM for this officer group. These functional reasons are not immediately relevant to the specific use of vRM rest however case the constraint. Suffice to say for vRM, every WM user must have a WM group by default even if this information must never be used.
Roles and groups are separate entities. A role defines a set of privileges to access a particular functional area of the admin interface for example a role WM sets permissions to interact with the workflow. of the roles of management (CM) configuration sets permissions to review and modify records in the repository of vRM.
A special role of WM can be associated with one or more groups WM. When this WM role is assigned to a user, that user inherits groups associated with this role, WM allowing to simplify the administration of groups. An individual user can also have other WM assigned groups to them directly, complementary to those inherited from their role of WM.
At an abstract level, vRM defines three types of users of the admin interface:
1 vCD Admins
2. plan Admins
3. managers
However, the security of MSM model requires that each individual user must be implemented with several components. By default, vRM sets a "Asset Managers" WM Group of what assets all managers must belong. However, WM groups cannot be used to give access to the features as well, so a separate from the "Asset Managers" WM role is obliged to grant access to these features asset managers. By default, the role of "Asset Manager" WM is associated with the "Asset Managers" group such that any user who is assigned the role automatically belongs to the Group also. There is also a separate 'Asset Managers' CM role that gives asset managers they need to the repository vRM for example the possibility to add new licenses for software products.
This model of definitions is repeated for 3 personas above with a group and several roles defined for each. When an administrator assigns a user to one of these characters they should assign the groups and roles appropriate according to the documentation. They should not need to be concerned by the distinctions between each component.
The role of the "Plan Director Admin and Asset Manager" reflects that a user may need to be asset manager and a Director of Blueprint. Because a user can have a role to the maximum by functional area, vRM provides a compound that provides two sets of permissions. However, a user can belong to several groups WM, so it is never necessary to provide a composite group.
The role of composite is there; just maybe not where you expect to find. Blueprint Admins do not need to access WM, so there is not a 'Blueprint' Admin or a composite WM role. Blueprint Admins do need access to configuration management so it's an "Admin blueprint" and a role of CM composite.
The details of the user screen provides:
a summary of all groups to which a user belongs
provides a 'Détails' button to drill down on each role assigned to the user to inspect the permissions granted by this particular role
You must be a vCD Admin to see areas of the screen.
Maybe you are looking for
-
How to get the Bluetooth works on Satellite U300-155 and Linux Kubuntu 8.04
I bought Toshiba Satellite U300-155 and I have Kubuntu 8.04 languages, but I don't see bluetooth when I turn it on.How can I use bluetooth under kububtu 8.04?
-
Satellite A100 compatible with DDR 667 memory?
HelloI have a question about the compatibility of memory, it seems that the Toshiba Satellite A100 series has the new motherboard (945 PM). The site intel, he says that this motherboard supports DDR 667. Although if you look closely at the specificat
-
I can't add a child to the FSS
Hello I'm trying to add a child to my security account for the family, but I can't.I created a new account in my security software for the family, then connected to the Web site and clicking on "contact management". I don't get any ADD"" button. I ge
-
I think that my printer is confused. I can print to the printer itself, IE the settings page. I can print Web form, IE Manual HP and some documents from the IRS. I cannont do is print my documents folder. I can't print an adobe or Microsoft docum
-
Can I uninstall the software and reinstall it on another pc/mac
I have a temporary cell phone. I need the cloud creative adobe on this, but as I have on my iMac as well; This keeps me it from uninstalling the software on the laptop in the future and put it back on a new? Thank you.