14-1 Copyright  Oracle Corporation, All rights reserved. Privileges Database security: – System security – Data security System privileges: Gain access to the database Object privileges: Manipulate the content of the database objects Schema: Collection of objects, such as tables, views, and sequences Database security: – System security – Data security System privileges: Gain access to the database Object privileges: Manipulate the content of the database objects Schema: Collection of objects, such as tables, views, and sequences

14-2 Copyright  Oracle Corporation, All rights reserved. System Privileges More than 80 privileges are available. The DBA has high-level system privileges: – Create new users – Remove users – Remove tables – Back up tables More than 80 privileges are available. The DBA has high-level system privileges: – Create new users – Remove users – Remove tables – Back up tables

14-3 Copyright  Oracle Corporation, All rights reserved. Creating Users The DBA creates users by using the CREATE USER statement. SQL> CREATEUSER scott 2 IDENTIFIED BY tiger; User created. SQL> CREATEUSER scott 2 IDENTIFIED BY tiger; User created. CREATE USER user IDENTIFIED BY password; CREATE USER user IDENTIFIED BY password;

14-4 Copyright  Oracle Corporation, All rights reserved. User System Privileges GRANT privilege [, privilege...] TO user [, user...]; GRANT privilege [, privilege...] TO user [, user...]; An application developer may have the following system privileges: – CREATE SESSION – CREATE TABLE – CREATE SEQUENCE – CREATE VIEW – CREATE PROCEDURE An application developer may have the following system privileges: – CREATE SESSION – CREATE TABLE – CREATE SEQUENCE – CREATE VIEW – CREATE PROCEDURE Once a user is created, the DBA can grant specific system privileges to a user.

14-5 Copyright  Oracle Corporation, All rights reserved. What Is a Role? Allocating privileges without a role Allocating privileges with a role Privileges Users Manager

14-6 Copyright  Oracle Corporation, All rights reserved. Creating and Granting Privileges to a Role SQL> CREATE ROLE manager; Role created. SQL> CREATE ROLE manager; Role created. SQL> GRANT create table, create view 2 to manager; Grant succeeded. SQL> GRANT create table, create view 2 to manager; Grant succeeded. SQL> GRANT manager to BLAKE, CLARK; Grant succeeded. SQL> GRANT manager to BLAKE, CLARK; Grant succeeded.

14-7 Copyright  Oracle Corporation, All rights reserved. Object Privilege TableViewSequenceProcedure ALTER  DELETE  EXECUTE  INDEX  INSERT  REFERENCES  SELECT  UPDATE  Object Privilege TableViewSequenceProcedure ALTER  DELETE  EXECUTE  INDEX  INSERT  REFERENCES  SELECT  UPDATE  Object Privileges

14-8 Copyright  Oracle Corporation, All rights reserved. Object Privileges Object privileges vary from object to object. An owner has all the privileges on the object. An owner can give specific privileges on that owner’s object. Object privileges vary from object to object. An owner has all the privileges on the object. An owner can give specific privileges on that owner’s object. GRANTobject_priv [(columns)] ONobject TO{user|role|PUBLIC} [WITH GRANT OPTION]; GRANTobject_priv [(columns)] ONobject TO{user|role|PUBLIC} [WITH GRANT OPTION];

14-9 Copyright  Oracle Corporation, All rights reserved. Using WITH GRANT OPTION and PUBLIC Keywords Allow all users on the system to query data from Alice’s DEPT table. SQL> GRANTselect, insert 2 ONdept 3 TOscott 4 WITH GRANT OPTION; Grant succeeded. SQL> GRANTselect, insert 2 ONdept 3 TOscott 4 WITH GRANT OPTION; Grant succeeded. SQL> GRANTselect 2 ONalice.dept 3 TOPUBLIC; Grant succeeded. SQL> GRANTselect 2 ONalice.dept 3 TOPUBLIC; Grant succeeded. Give a user authority to pass along the privileges.

14-10 Copyright  Oracle Corporation, All rights reserved. Confirming Privileges Granted Data Dictionary TableDescription ROLE_SYS_PRIVSSystem privileges granted to roles ROLE_TAB_PRIVSTable privileges granted to roles USER_ROLE_PRIVSRoles accessible by the user USER_TAB_PRIVS_MADEObject privileges granted on the user’s objects USER_TAB_PRIVS_RECDObject privileges granted to the user USER_COL_PRIVS_MADEObject privileges granted on the columns of the user’s objects USER_COL_PRIVS_RECDObject privileges granted to the user on specific columns

14-11 Copyright  Oracle Corporation, All rights reserved. How to Revoke Object Privileges You use the REVOKE statement to revoke privileges granted to other users. Privileges granted to others through the WITH GRANT OPTION will also be revoked. You use the REVOKE statement to revoke privileges granted to other users. Privileges granted to others through the WITH GRANT OPTION will also be revoked. REVOKE {privilege [, privilege...]|ALL} ON object FROM {user[, user...]|role|PUBLIC} [CASCADE CONSTRAINTS]; REVOKE {privilege [, privilege...]|ALL} ON object FROM {user[, user...]|role|PUBLIC} [CASCADE CONSTRAINTS];

14-12 Copyright  Oracle Corporation, All rights reserved. Revoking Object Privileges As user Alice, revoke the SELECT and INSERT privileges given to user Scott on the DEPT table. SQL> REVOKEselect, insert 2 ONdept 3 FROMscott; Revoke succeeded. SQL> REVOKEselect, insert 2 ONdept 3 FROMscott; Revoke succeeded.