Transactions, Roles & Privileges Oracle and ANSI Standard SQL Lecture 11

Copyright 2006Page 2 Transactions, Roles & Privileges Privileges Privileges Roles Roles Granting Privileges Granting Privileges Revoking Privileges Revoking Privileges Synonyms Synonyms Creating Synonyms Creating Synonyms Droping Synonyms Droping Synonyms Design Structures Design Structures ACID Compliance ACID Compliance

Copyright 2006Page 3 Transactions, Roles & Privileges Privileges: Granted to other users System Privileges System Privileges Session – CREATE SESSION, ALTER SESSION. Session – CREATE SESSION, ALTER SESSION. Table – CREATE TABLE, CREATE ANY TABLE, ALTER ANY TABLE, DROP ANY TABLE, SELECT ANY TABLE, UPDATE ANY TABLE, DELETE ANY TABLE, FLASHBACK ANY TABLE. Table – CREATE TABLE, CREATE ANY TABLE, ALTER ANY TABLE, DROP ANY TABLE, SELECT ANY TABLE, UPDATE ANY TABLE, DELETE ANY TABLE, FLASHBACK ANY TABLE. Index – CREATE ANY INDEX, ALTER ANY INDEX, DROP ANY INDEX. Index – CREATE ANY INDEX, ALTER ANY INDEX, DROP ANY INDEX. Sequence – CREATE SEQUENCE, CREATE ANY SEQUENCE, ALTER ANY SEQUENCE, DROP ANY SEQUENCE. Sequence – CREATE SEQUENCE, CREATE ANY SEQUENCE, ALTER ANY SEQUENCE, DROP ANY SEQUENCE. View – CREATE VIEW, CREATE ANY VIEW, DROP ANY VIEW. View – CREATE VIEW, CREATE ANY VIEW, DROP ANY VIEW.

Copyright 2006Page 4 Transactions, Roles & Privileges Privileges: Granted to other users Object Privileges Object Privileges Select - Enables another user to query data or a sequence value. Select - Enables another user to query data or a sequence value. Insert - Enables another user to enter data from a table or view. Insert - Enables another user to enter data from a table or view. Update - Enables another user to change data from a table or view. Update - Enables another user to change data from a table or view. Delete - Enables another user to remove data from a table or view. Delete - Enables another user to remove data from a table or view. Index – Enables another user to create indexes on a table. Index – Enables another user to create indexes on a table. Reference – Enables another user to reference a primary key in a foreign key constraint. Reference – Enables another user to reference a primary key in a foreign key constraint. Execute - Enables another user to run a stored function, procedure, or package. Execute - Enables another user to run a stored function, procedure, or package. Alter - Enables another user to modify a table or a sequence. Alter - Enables another user to modify a table or a sequence. All – Enables another user to have all priviliges on a table. All – Enables another user to have all priviliges on a table.

Copyright 2006Page 5 Transactions, Roles & Privileges Privileges: Granting Process Object Privileges Object Privileges You grant privileges by using the GRANT command. You grant privileges by using the GRANT command. You revoke privileges by using the REVOKE command. You revoke privileges by using the REVOKE command. Grant Option Grant Option You grant privileges along with the right to grant the same privilege(s) to other users. You grant privileges along with the right to grant the same privilege(s) to other users.

Copyright 2006Page 6 Transactions, Roles & Privileges Roles: Defined Are collections of privileges. Are collections of privileges. Can be granted to users the same way as individual privileges. Can be granted to users the same way as individual privileges. Enable the DBA to manage sets of privileges and change them one place with cascading impacts. Enable the DBA to manage sets of privileges and change them one place with cascading impacts.

Copyright 2006Page 7 Transactions, Roles & Privileges Granting Privileges GRANT GRANT ON ON TO ;

Copyright 2006Page 8 Transactions, Roles & Privileges Revoking Privileges REVOKE REVOKE FROM ;

Copyright 2006Page 9 Transactions, Roles & Privileges Synonyms: Defined Are aliases that enable a relative naming. Are aliases that enable a relative naming. Replace absolute reference by schema name, a dot, and object name. Replace absolute reference by schema name, a dot, and object name. Can be deployed as public or private variants: Can be deployed as public or private variants: Private synonyms are only available in a single schema: Private synonyms are only available in a single schema: They simplify calls to objects. They simplify calls to objects. They translate the synonym to an absolute reference. They translate the synonym to an absolute reference. Public synonyms are available throughout the database instance. Public synonyms are available throughout the database instance. They simplify calls to objects. They simplify calls to objects. They translate the synonym to an absolute reference. They translate the synonym to an absolute reference.

Copyright 2006Page 10 Transactions, Roles & Privileges Synonym: Creating public synonyms CREATE PUBLIC SYNONYM CREATE PUBLIC SYNONYM FOR ;

Copyright 2006Page 11 Transactions, Roles & Privileges Synonym: Creating private synonyms CREATE SYNONYM CREATE SYNONYM FOR ;

Copyright 2006Page 12 Transactions, Roles & Privileges Synonym: Dropping synonyms DROP SYNONYM ;

Copyright 2006Page 13 Transactions, Roles & Privileges Design Structures: Definers’ rights Is the default when creating stored programs. Is the default when creating stored programs. Means that the stored program executes with the same privileges as the defining user. Means that the stored program executes with the same privileges as the defining user. Can mean that calling the stored programs lets it run against any schema level data. Can mean that calling the stored programs lets it run against any schema level data. Typically means that users only access a slice of data in any schema, like a private virtual database. Typically means that users only access a slice of data in any schema, like a private virtual database.

Copyright 2006Page 14 Transactions, Roles & Privileges Design Structures: Definers’ rights

Copyright 2006Page 15 Transactions, Roles & Privileges Design Structures: Invokers’ rights Is the override when creating stored programs. Is the override when creating stored programs. Means that the stored program executes with the local privileges, which generally differ from the definer’s privileges. Means that the stored program executes with the local privileges, which generally differ from the definer’s privileges. Typically means that users only access their own schema data, like a distributed or local database. Typically means that users only access their own schema data, like a distributed or local database.

Copyright 2006Page 16 Transactions, Roles & Privileges Design Structures: Invokers’ rights

Copyright 2006Page 17 Transactions, Roles & Privileges ACID: Defined A – ATOMIC, which means that everything or nothing happens. A – ATOMIC, which means that everything or nothing happens. C – CONSISTENT, which means that everything happens the same whether processed serially or in parallel. C – CONSISTENT, which means that everything happens the same whether processed serially or in parallel. I – ISOLATED, which means partial results are hidden from other users. I – ISOLATED, which means partial results are hidden from other users. D – DURABLE, which means changes become permanent when finalized. D – DURABLE, which means changes become permanent when finalized.

Copyright 2006Page 18 Transactions, Roles & Privileges ACID: DML statements Single DML statements: Single DML statements: Are transactions. Are transactions. Lock affected rows. Lock affected rows. Prevent others from updating locked rows. Prevent others from updating locked rows. Changes are only visible to the session making them until a COMMIT command is executed. Changes are only visible to the session making them until a COMMIT command is executed. Locks are also released when a ROLLBACK command is executed, which undoes the prior change. Locks are also released when a ROLLBACK command is executed, which undoes the prior change.

Copyright 2006Page 19 Transactions, Roles & Privileges ACID: Sets of DML statements Multiple DML statements: Multiple DML statements: Are compound transactions, which means they are made up of smaller transaction units. Are compound transactions, which means they are made up of smaller transaction units. Lock affected rows in more than one table or view. Lock affected rows in more than one table or view. Prevent others from updating locked rows. Prevent others from updating locked rows. Changes are only visible to the session making them until a COMMIT command is executed. Changes are only visible to the session making them until a COMMIT command is executed. Locks are also released when a ROLLBACK command is executed, which undoes the prior change. Locks are also released when a ROLLBACK command is executed, which undoes the prior change.

Copyright 2006Page 20 Transactions, Roles & Privileges ACID: Data Control Statements (DCL) DCL statements are: DCL statements are: The SAVEPOINT command, that sets a marker that enables undoing transactions only to a save point. The SAVEPOINT command, that sets a marker that enables undoing transactions only to a save point. The COMMIT command, which makes permanent the data change. The COMMIT command, which makes permanent the data change. The ROLLBACK command, which can undo everything since: The ROLLBACK command, which can undo everything since: The last COMMIT command. The last COMMIT command. A specific SAVEPOINT command. A specific SAVEPOINT command.

Copyright 2006Page 21 Transactions, Roles & Privileges ACID: ROLLBACK command ROLLBACK [TO ];

Copyright 2006Page 22 Transactions, Roles & Privileges ACID: SAVEPOINT command SAVEPOINT ;

Copyright 2006Page 23 Transactions, Roles & Privileges ACID: COMMIT command SAVEPOINT ;

Copyright 2006Page 24 Summary Privileges Privileges Roles Roles Granting Privileges Granting Privileges Revoking Privileges Revoking Privileges Synonyms Synonyms Creating Synonyms Creating Synonyms Droping Synonyms Droping Synonyms Design Structures Design Structures ACID Compliance ACID Compliance