Sec_P1 創(chuàng)建和授予角色

Sec_P1 創(chuàng)建和授予角色

SQL>connect system/oracle

#創(chuàng)建兩個角色

SQL>createrole  usr_role;

SQL>createrole mgr_role;

#為這些角色授予一些權(quán)限，并將usr_role授予mgr_role;

SQL>grantcreate session to usr_role;

SQL>grantselect on sales.t1 on usr_role;

SQL>grantusr_role to mgr_role with admin option;

SQL>grantall on sales.t1 to mgr_role;

SQL>connsystem/oracle

SQL>grantmgr_role to webapp;

SQL>connwebapp/oracle;

SQL>grantusr_role to accounts ;

SQL>insertinto sales.t1 values(sysdate);

SQL>commit;

#擁有查詢權(quán)限，但是沒有插入權(quán)限。

SQL>connaccounts/oracle

SQL>Select* from sales.t1;

SQL>insertinto sales.t1 values(sysdate);

--ORA-01031:insufficient privileges

#對accounts的權(quán)限進(jìn)行調(diào)整，使其可以在默認(rèn)情況下登錄，但無其他權(quán)限。

SQL>connsystem/oracle

SQL>grantconnect to accounts;

SQL>alteruser default role  connect;

#演示角色的啟用和禁用

SQL>connaccounts/oracle

SQL>select* from sales.t1;

--ORA-00942:table or veiw does not exist

SQL>setrole usr_role;

SQL>select* from sales.t1;  --It's OK;

#查看兩個新角色對于的查看權(quán)限

SQL>select * from dba_role_privs

Wheregranted_role in ('USR_ROLE', 'MGR_ROLE');

SQL>selectgrantee,owner, table_name,privilege,grantable

Fromdba_tab_privs where grantee in ( ' USR_ROLE', 'MGR_ROLE')

Union all

Selectgrantee, to_char(null), to_char(null),privilege,admin_option

Fromdba_sys_privs  where grantee in ('USR_ROLE', 'MGR_ROLE')

Order bygrantee;