数据库基本功之用户访问控制(下)

-- 在19c中resource里不再包含unlimited tablespace系统权限 

SQL> col role format a20 
SQL> select * from role_sys_privs where role='RESOURCE';

ROLE                 PRIVILEGE                                                                                                                ADMIN_OPT COMMON    INHERITED
-------------------- ------------------------------------------------------------------------------------------------------------------------ --------- --------- ---------
RESOURCE             CREATE SEQUENCE                                                                                                          NO        YES       YES
RESOURCE             CREATE PROCEDURE                                                                                                         NO        YES       YES
RESOURCE             CREATE CLUSTER                                                                                                           NO        YES       YES
RESOURCE             CREATE INDEXTYPE                                                                                                         NO        YES       YES
RESOURCE             CREATE OPERATOR                                                                                                          NO        YES       YES
RESOURCE             CREATE TYPE                                                                                                              NO        YES       YES
RESOURCE             CREATE TRIGGER                                                                                                           NO        YES       YES
RESOURCE             CREATE TABLE                                                                                                             NO        YES       YES

8 rows selected.

SQL>

11g需要注意两点: (在19c中resource里不再包含unlimited tablespace系统权限)

  1. 在resource角色里包含了unlimited tablesapce 系统权限,意思是不限制用户使用任何 TBS,此权限太大,它包括可以访问 system TBS,在实际应用中一般要将此权限收回,然后再对用户限制 TBS配额(quota).
  2. sys将resource角色授权给用户,其中有9个系统权限,只有unlimited tablespace可以单独收回(从角色里收回系统权限的特例).

7.3.4 指定用户 TBS及大小

7.3.4.1 创建 TBS

SQL> 
SQL> show user;
USER is "SYS"
SQL> show con_name;

CON_NAME
------------------------------
PDB1
SQL> drop user pandas cascade;

User dropped.

SQL> create tablespace pandas_tbs datafile '/u02/oradata/CDB1/pdb1/pandas01.dbf' size 10m;

Tablespace created.

SQL> 

7.3.4.2 分配用户 TBS


SQL> 
SQL> create user pandas identified by pandas default tablespace pandas_tbs;

User created.

SQL> 

7.3.4.3 授权

SQL> show user;
USER is "SYS"
SQL> grant connect,resource to pandas;

Grant succeeded.

SQL>

SQL> show user;
USER is "SYS"
SQL> conn pandas/pandas@PDB1;
Connected.
SQL> show user;
USER is "PANDAS"
SQL> select * from session_privs;

PRIVILEGE
------------------------------------------------------------------------------------------------------------------------
CREATE SESSION
CREATE TABLE
CREATE CLUSTER
CREATE SEQUENCE
CREATE PROCEDURE
CREATE TRIGGER
CREATE TYPE
CREATE OPERATOR
CREATE INDEXTYPE
SET CONTAINER

10 rows selected.

SQL> 

7.3.4.4 分配 TBS大小

SQL> conn / as sysdba
Connected.
SQL> show user;
USER is "SYS"
SQL> alter session set container=PDB1;

Session altered.

SQL> show user;
USER is "SYS"
SQL> show con_name;

CON_NAME
------------------------------
PDB1
SQL> alter user pandas quota 10m on pandas_tbs;

User altered.

SQL> 


7.3.4.5 查看用户 TBS配额:

SQL> show user;
USER is "SYS"
SQL> 
SQL> 
SQL> select tablespace_name, username, max_bytes from DBA_TS_QUOTAS where username='PANDAS';

TABLESPACE_NAME                                                                            USERNAME            MAX_BYTES
------------------------------------------------------------------------------------------ ------------------ ----------
PANDAS_TBS                                                                                 PANDAS               10485760

SQL> 

7.4 几个有关权限的知识点

7.4.1 sys, system 拥有普通用户的所有对象权限,并有代理授权资格.

7.4.2 系统权限里的any含义

赋予创建任何表的权限

SQL> conn / as sysdba
Connected.
SQL> alter session set container=PDB1;

Session altered.

SQL> grant create any table to pandas;

Grant succeeded.

SQL> conn pandas/pandas@PDB1;
Connected.
SQL> create table scott.t100(id int);
Table created.

SQL> 

7.4.3 对象权限一般由对象拥有者授予,也可由sys或system代理授予.

7.4.3.1 赋予某用户表的select权限

SQL> show user;
USER is "PANDAS"
SQL> 
SQL> select * from scott.t100;
select * from scott.t100
                    *
ERROR at line 1:
ORA-01031: insufficient privileges


SQL> conn / as sysdba
Connected.
SQL> alter session set container=PDB1;

Session altered.

SQL> grant select on scott.emp to pandas;

Grant succeeded.

SQL> 

7.4.3.2 可使update对象权限精确到列:

SQL> 
SQL> conn scott/tiger@PDB1;
Connected.
SQL> grant select,update(sal) on emp to pandas;

Grant succeeded.

SQL> 

7.4.3.3 只能根据整个表REVOKE而不能根据列REVOKE

SQL> 
SQL> show user;
USER is "SCOTT"
SQL> revoke update(sal) on emp from pandas;
revoke update(sal) on emp from pandas
             *
ERROR at line 1:
ORA-01750: UPDATE/REFERENCES may only be REVOKEd from the whole table, not by column


SQL> show user;
USER is "SCOTT"
SQL> revoke update on emp from pandas;

Revoke succeeded.

SQL> 

7.4.3.4 授予pandas对scott.emp的所有对象权限

SQL> 
SQL> show user;
USER is "SCOTT"
SQL> grant all on scott.emp to pandas;

Grant succeeded.

SQL> 

7.4.4 几个需要注意的地方

-- 1)	系统权限和对象权限语法格式不同,不能混合使用
grant create table,select on emp to pandas			-- 错(知识点)
-- 2)	系统权限和角色语法相同可以并列授权
grant connect,create table to pandas					-- 对
-- 3)	一条授权语句中可以授权给多个用户
grant connect to klaus,max							-- 对
-- 4)	通过授权建立用户,如max用户不存在,
grant connect,resource to max identified by max;	-- 对
-- 5)	权限可以赋予给public
-- Roles are named groups of related privileges that can be granted to users or other roles

7.5 系统权限的传递与回收:WITH ADMIN OPTION 选项

7.5.1 建立用户

SQL> conn / as sysdba
Connected.
SQL> alter session set container=PDB1;

Session altered.

SQL> drop user pandas cascade;

User dropped.

SQL> create user pandas identified by pandas;

User created.

SQL> drop user max cascade;

User dropped.

SQL> create user max identified by max;

User created.

SQL> 

7.5.2 sys授予pandas系统权限

SQL> 
SQL> show user;
USER is "SYS"
SQL> grant create session to pandas with admin option;

Grant succeeded.

SQL> 

7.5.3 pandas授予权限给max


SQL> conn pandas/pandas@PDB1;
Connected.
SQL> grant create session to max;

Grant succeeded.

SQL> 

7.5.4 sys收回pandas系统权限

SQL> conn / as sysdba
Connected.
SQL> alter session set container=PDB1;

Session altered.

SQL> revoke create session from pandas;

Revoke succeeded.

SQL> 

7.5.5 Max的权限没有收回

SQL> conn max/max@PDB1;
Connected.
SQL> show user;
USER is "MAX"
SQL> 

7.6 对象权限的传递与回收:WITH GRANT OPTION 选项

SQL> conn / as sysdba
Connected.
SQL> alter session set container=PDB1;

Session altered.

SQL> grant create session to pandas;

Grant succeeded.

SQL> 

7.6.1 scott为pandas授权


SQL> conn scott/tiger@PDB1;
Connected.
SQL> grant select on emp to pandas with grant option;

Grant succeeded.

SQL> 

7.6.2 pandas为max授权


SQL> conn pandas/pandas@PDB1;
Connected.
SQL> grant select on scott.emp to max;

Grant succeeded.

SQL> 

7.6.3 检查pandas和max都已可以访问scott.emp

SQL> conn pandas/pandas@PDB1;
Connected.
SQL> show user;
USER is "PANDAS"
SQL> set pagesize 200 linesize 200
SQL> select * from scott.emp;

     EMPNO ENAME                          JOB                                MGR HIREDATE               SAL       COMM     DEPTNO
---------- ------------------------------ --------------------------- ---------- --------------- ---------- ---------- ----------
      7369 SMITH                          CLERK                             7902 17-DEC-80              800                    20
      7499 ALLEN                          SALESMAN                          7698 20-FEB-81             1600        300         30
      7521 WARD                           SALESMAN                          7698 22-FEB-81             1250        500         30
      7566 JONES                          MANAGER                           7839 02-APR-81             2975                    20
      7654 MARTIN                         SALESMAN                          7698 28-SEP-81             1250       1400         30
      7698 BLAKE                          MANAGER                           7839 01-MAY-81             2850                    30
      7782 CLARK                          MANAGER                           7839 09-JUN-81             2450                    10
      7788 SCOTT                          ANALYST                           7566 24-JAN-87             3000                    20
      7844 TURNER                         SALESMAN                          7698 08-SEP-81             1500          0         30
      7876 ADAMS                          CLERK                             7788 02-APR-87             1100                    20
      7900 JAMES                          CLERK                             7698 03-DEC-81              950                    30
      7902 FORD                           ANALYST                           7566 03-DEC-81             3000                    20
      7934 MILLER                         CLERK                             7782 23-JAN-82             1300                    10
      7839 KING                           PRESIDENT                         8000 17-NOV-81             5000          0         10

14 rows selected.

SQL> conn max/max@PDB1;
Connected.
SQL> set pagesize 200 linesize 200
SQL> select * from scott.emp;

     EMPNO ENAME                          JOB                                MGR HIREDATE               SAL       COMM     DEPTNO
---------- ------------------------------ --------------------------- ---------- --------------- ---------- ---------- ----------
      7369 SMITH                          CLERK                             7902 17-DEC-80              800                    20
      7499 ALLEN                          SALESMAN                          7698 20-FEB-81             1600        300         30
      7521 WARD                           SALESMAN                          7698 22-FEB-81             1250        500         30
      7566 JONES                          MANAGER                           7839 02-APR-81             2975                    20
      7654 MARTIN                         SALESMAN                          7698 28-SEP-81             1250       1400         30
      7698 BLAKE                          MANAGER                           7839 01-MAY-81             2850                    30
      7782 CLARK                          MANAGER                           7839 09-JUN-81             2450                    10
      7788 SCOTT                          ANALYST                           7566 24-JAN-87             3000                    20
      7844 TURNER                         SALESMAN                          7698 08-SEP-81             1500          0         30
      7876 ADAMS                          CLERK                             7788 02-APR-87             1100                    20
      7900 JAMES                          CLERK                             7698 03-DEC-81              950                    30
      7902 FORD                           ANALYST                           7566 03-DEC-81             3000                    20
      7934 MILLER                         CLERK                             7782 23-JAN-82             1300                    10
      7839 KING                           PRESIDENT                         8000 17-NOV-81             5000          0         10

14 rows selected.

SQL> 

7.6.4 scott回收pandas对象权限

SQL> 
SQL> conn scott/tiger@PDB1;
Connected.
SQL> revoke select on emp from pandas;

Revoke succeeded.

SQL> 
SQL> 

7.6.5 max的对象权限也收回!

# 检查pandas和max都已不能访问scott.emp, 
# 权限回收

WITH ADMIN OPTION    # 覆水难收
WITH GRANT OPTION    # 株连九族
 

7.7 对象权限在存储过程中的使用

scott将存储过程proc1的execute权限赋给klaus,proc1中包含一些klaus没有权限的DML 操作,那么klaus是否你成功地执行存储过程proc1?这个问题涉及到了create procedure时invoker_rights_clause的两个选项:(知识点)
1、AUTHID CURRENT_USER //执行存储过程时,要检查用户是否有DML操作的对象权限.
2、AUTHID DEFINER(默认)

7.7.1 sys给scott建表

SQL> 
SQL> conn / as sysdba
Connected.
SQL> alter session set container=PDB1;

Session altered.

SQL> create table scott.a (d1 date);

Table created.

SQL> grant connect,resource to pandas identified by pandas;

Grant succeeded.

SQL> 

7.7.2 scott创建存储过程

SQL> show user;
USER is "SYS"
SQL> alter session set container=PDB1;

Session altered.

SQL> conn scott/tiger@PDB1;
Connected.
SQL> 
SQL> create or replace procedure proc1 as
  2  begin
  3  insert into scott.a values(sysdate);
  4  commit;
  5  end;
  6  /

Procedure created.

SQL> 

7.7.3 赋予pandas proc1的execute权限

SQL> 
SQL> grant execute on proc1 to pandas;

Grant succeeded.

SQL>

7.7.4 登陆pandas可以执行procedure

SQL> -- 有执行存储过程的权限,但没有 insert 对象权限,竟然也能执行成功.
SQL> conn pandas/pandas@PDB1;
Connected.
SQL> exec scott.proc1;

PL/SQL procedure successfully completed.

SQL> 


7.7.5 使用invoker_rights_clause加入AUTHID CURRENT_USER 参数再试试.

SQL> 
SQL> conn scott/tiger@PDB1;
Connected.
SQL> create or replace procedure proc1 AUTHID CURRENT_USER as
  2  begin
  3  insert into scott.a values(sysdate);
  4  commit;
  5  end;
  6  /

Procedure created.

SQL> conn pandas/pandas@PDB1;
Connected.
SQL>

7.7.6 执行报错

SQL> 
SQL> conn pandas/pandas@PDB1;
Connected.
SQL> exec scott.proc1;
BEGIN scott.proc1; END;

*
ERROR at line 1:
ORA-00942: table or view does not exist
ORA-06512: at "SCOTT.PROC1", line 3
ORA-06512: at line 1


SQL> 

7.7.7 赋权

SQL> conn scott/tiger@PDB1;
Connected.
SQL> grant all on a to pandas;

Grant succeeded.

SQL> conn pandas/pandas@PDB1;
Connected.
SQL> 

7.7.8 执行成功

SQL> 
SQL> exec scott.proc1;

PL/SQL procedure successfully completed.

SQL> -- 在 execute 权限和 insert 权限都具备的情况下使操作成功,这可能是我们想要的.
SQL> 

7.8 与权限有关的数据字典

7.8.1 权限相关数据字典

SESSION_PRIVS    #用户当前会话拥有的系统权限
USER_ROLE_PRIVS    #用户被授予的角色
ROLE_SYS_PRIVS    #用户当前拥有的角色的系统权限
USER_SYS_PRIVS    #直接授予用户的系统权限
USER_TAB_PRIVS    #授予用户的对象权限
ROLE_TAB_PRIVS    #授予角色的表的权限
 

7.8.2 数据字典格式

dba_xxx_privs、all_xxx_privs、user_xxx_privs

其中 xxx
:role 表示角色,
:sys 表示系统权限,
:tab 表示对象权限. 从哪个角度看,非常重要

7.8.3 举例

三个用户sys,scott,和pandas,

sys:
1)建立myrole角色,把connect角色和create table 系统权限以及update on scott.emp 对象权限放进myrole.
2)把myrole角色授给pandas.
3)把create table 系统权限授予pandas.

scott:
1)把 select on emp表的对象权限授予pandas

如此pandas用户有了如下角色和权限:
myrole (connect, create table, update on scott.emp)	#role权限
create table										#系统权限
select on emp										#对象权限

7.8.3.1 建role

SQL> 
SQL> show user;
USER is "SYS"
SQL> show con_name;

CON_NAME
------------------------------
CDB$ROOT
SQL> 
SQL> alter session set container=PDB1;

Session altered.

SQL> drop user pandas cascade;

User dropped.

SQL> create user pandas identified by pandas;

User created.

SQL> create role myrole;

Role created.

SQL> 

7.8.3.2 赋予myrole权限

SQL> 
SQL> 
SQL> show user;
USER is "SYS"
SQL> grant connect,create table to myrole;

Grant succeeded.

SQL> grant update on scott.emp to myrole;

Grant succeeded.

SQL> 

7.8.3.3 将myrole赋予pandas

SQL> 
SQL> show user;
USER is "SYS"
SQL> grant myrole to pandas;

Grant succeeded.

SQL>

7.8.3.4 赋予create table对象权限

SQL> 
SQL> show user;
USER is "SYS"
SQL> grant create table to pandas;

Grant succeeded.

SQL>

7.8.3.5 scott授予klaus对象权限

SQL> 
SQL> conn scott/tiger@PDB1;
Connected.
SQL> grant select on emp to pandas;

Grant succeeded.

SQL> 

7.8.4 根据数据字典验证例中的权限和角色

从三个角度分析如何在数据字典里查看klaus拥有的角色和权限信息.

7.8.4.1 从dba角度看系统权限:

[oracle@oracle-db-19c ~]$ sqlplus / as sysdba

SQL*Plus: Release 19.0.0.0.0 - Production on Mon Mar 20 15:31:08 2023
Version 19.3.0.0.0

Copyright (c) 1982, 2019, Oracle.  All rights reserved.


Connected to:
Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production
Version 19.3.0.0.0

SQL> show user;
USER is "SYS"
SQL> show con_name;

CON_NAME
------------------------------
CDB$ROOT
SQL> alter session set container=PDB1;

Session altered.

SQL> select * from dba_sys_privs where grantee='PANDAS';

GRANTEE
------------------
PRIVILEGE
--------------------------------------------------------------------------------
ADMIN_OPT COMMON    INHERITED
--------- --------- ---------
PANDAS
CREATE TABLE
NO        NO        NO


SQL> col grantee format a10;
SQL> col owner format a10;
SQL> col table_name format a10;
SQL> col grantor format a10;
SQL> col privilege format a10;
SQL> select * from dba_tab_privs where grantee='PANDAS';

GRANTEE    OWNER      TABLE_NAME GRANTOR    PRIVILEGE  GRANTABLE HIERARCHY
---------- ---------- ---------- ---------- ---------- --------- ---------
COMMON
---------
TYPE
------------------------------------------------------------------------
INHERITED
---------
PANDAS     SCOTT      EMP        SCOTT      SELECT     NO        NO
NO
TABLE
NO


SQL> -- 拥有的角色(不包含角色里的角色)
SQL> col granted_role format a10;
SQL> select * from dba_role_privs where grantee='PANDAS';

GRANTEE    GRANTED_RO ADMIN_OPT DELEGATE_ DEFAULT_R COMMON    INHERITED
---------- ---------- --------- --------- --------- --------- ---------
PANDAS     MYROLE     NO        NO        YES       NO        NO

SQL> -- 查看这个角色里包含的角色
SQL> select * from dba_role_privs where grantee='MYROLE';

GRANTEE    GRANTED_RO ADMIN_OPT DELEGATE_ DEFAULT_R COMMON    INHERITED
---------- ---------- --------- --------- --------- --------- ---------
MYROLE     CONNECT    NO        NO        YES       NO        NO

SQL> -- 查看这个角色里包含的系统权限
SQL> select * from dba_sys_privs where grantee='MYROLE';

GRANTEE    PRIVILEGE  ADMIN_OPT COMMON    INHERITED
---------- ---------- --------- --------- ---------
MYROLE     CREATE TAB NO        NO        NO
           LE


SQL> -- 查看这个角色里包含的对象权限
SQL> select * from dba_tab_privs where grantee='MYROLE';

GRANTEE    OWNER      TABLE_NAME GRANTOR    PRIVILEGE  GRANTABLE HIERARCHY
---------- ---------- ---------- ---------- ---------- --------- ---------
COMMON
---------
TYPE
------------------------------------------------------------------------
INHERITED
---------
MYROLE     SCOTT      EMP        SCOTT      UPDATE     NO        NO
NO
TABLE
NO


SQL> 

7.8.4.2 从当前用户角度看:

SQL> conn pandas/pandas@PDB1;
Connected.
SQL> -- 查看和自己有关的角色(不含角色中含有的角色)
SQL> col username format a10;
SQL> select * from user_role_privs;

USERNAME   GRANTED_RO ADMIN_OPT DELEGATE_ DEFAULT_R OS_GRANTE COMMON
---------- ---------- --------- --------- --------- --------- ---------
INHERITED
---------
PANDAS     MYROLE     NO        NO        YES       NO        NO
NO


SQL> -- 查看和自己有关的系统权限(不含角色中的系统权限)
SQL> select * from user_sys_privs;

USERNAME   PRIVILEGE  ADMIN_OPT COMMON    INHERITED
---------- ---------- --------- --------- ---------
PANDAS     CREATE TAB NO        NO        NO
           LE


SQL> -- 查看和自己有关的对象权限(不含角色中的对象权限)
SQL> col privilege format a20;
SQL> select * from user_tab_privs;

GRANTEE    OWNER      TABLE_NAME GRANTOR    PRIVILEGE            GRANTABLE
---------- ---------- ---------- ---------- -------------------- ---------
HIERARCHY COMMON
--------- ---------
TYPE
------------------------------------------------------------------------
INHERITED
---------
PANDAS     SCOTT      EMP        SCOTT      SELECT               NO
NO        NO
TABLE
NO


GRANTEE    OWNER      TABLE_NAME GRANTOR    PRIVILEGE            GRANTABLE
---------- ---------- ---------- ---------- -------------------- ---------
HIERARCHY COMMON
--------- ---------
TYPE
------------------------------------------------------------------------
INHERITED
---------
PUBLIC     SYS        PANDAS     PANDAS     INHERIT PRIVILEGES   NO
NO        NO
USER
NO


SQL> -- 角色里包含的角色
SQL> select * from role_role_privs;

ROLE
--------------------------------------------------------------------------------
GRANTED_RO ADMIN_OPT COMMON    INHERITED
---------- --------- --------- ---------
MYROLE
CONNECT    NO        NO        NO


SQL> -- 角色里包括的系统权限
SQL> select * from role_sys_privs;

ROLE
--------------------------------------------------------------------------------
PRIVILEGE            ADMIN_OPT COMMON    INHERITED
-------------------- --------- --------- ---------
MYROLE
CREATE TABLE         NO        NO        NO

CONNECT
CREATE SESSION       NO        YES       YES

CONNECT
SET CONTAINER        NO        YES       YES


SQL> -- 角色里包括的对象权限
SQL> col column_name format a10;
SQL> select * from role_tab_privs;

ROLE
--------------------------------------------------------------------------------
OWNER      TABLE_NAME COLUMN_NAM PRIVILEGE            GRANTABLE COMMON
---------- ---------- ---------- -------------------- --------- ---------
INHERITED
---------
MYROLE
SCOTT      EMP                   UPDATE               NO        NO
NO


SQL> -- 查看和自己有关的系统权限(包括角色里的权限)
SQL> select * from session_privs;

PRIVILEGE
--------------------
CREATE SESSION
CREATE TABLE
SET CONTAINER

SQL> 

7.8.4.3从scott用户查看

SQL> 
SQL> conn scott/tiger@PDB1;
Connected.
SQL> col tab_schema format a10;
SQL> select * from all_tab_privs where grantee='PANDAS';

GRANTOR    GRANTEE
---------- ----------
TABLE_SCHEMA
--------------------------------------------------------------------------------
TABLE_NAME PRIVILEGE            GRANTABLE HIERARCHY COMMON
---------- -------------------- --------- --------- ---------
TYPE
------------------------------------------------------------------------
INHERITED
---------
SCOTT      PANDAS
SCOTT
EMP        SELECT               NO        NO        NO

GRANTOR    GRANTEE
---------- ----------
TABLE_SCHEMA
--------------------------------------------------------------------------------
TABLE_NAME PRIVILEGE            GRANTABLE HIERARCHY COMMON
---------- -------------------- --------- --------- ---------
TYPE
------------------------------------------------------------------------
INHERITED
---------
TABLE
NO


SQL> 


SQL> select * from all_tab_privs where table_name='EMP';

GRANTOR    GRANTEE
---------- ----------
TABLE_SCHEMA
--------------------------------------------------------------------------------
TABLE_NAME PRIVILEGE            GRANTABLE HIERARCHY COMMON
---------- -------------------- --------- --------- ---------
TYPE
------------------------------------------------------------------------
INHERITED
---------
SCOTT      PANDAS
SCOTT
EMP        SELECT               NO        NO        NO

GRANTOR    GRANTEE
---------- ----------
TABLE_SCHEMA
--------------------------------------------------------------------------------
TABLE_NAME PRIVILEGE            GRANTABLE HIERARCHY COMMON
---------- -------------------- --------- --------- ---------
TYPE
------------------------------------------------------------------------
INHERITED
---------
TABLE
NO


GRANTOR    GRANTEE
---------- ----------
TABLE_SCHEMA
--------------------------------------------------------------------------------
TABLE_NAME PRIVILEGE            GRANTABLE HIERARCHY COMMON
---------- -------------------- --------- --------- ---------
TYPE
------------------------------------------------------------------------
INHERITED
---------
SCOTT      MYROLE
SCOTT
EMP        UPDATE               NO        NO        NO

GRANTOR    GRANTEE
---------- ----------
TABLE_SCHEMA
--------------------------------------------------------------------------------
TABLE_NAME PRIVILEGE            GRANTABLE HIERARCHY COMMON
---------- -------------------- --------- --------- ---------
TYPE
------------------------------------------------------------------------
INHERITED
---------
TABLE
NO


SQL> 

7.9 更改密码

sys 建立用户时设置的用户密码保存在数据字典中,用户登录再更改密码.这些密码是加密形式存在的,DBA也无法知晓.

sys不知道用户密码,又想登录该账户,但不想打扰用户.怎样做?

SQL> 
SQL> conn / as sysdba
Connected.
SQL> select name,password from user$ where name='SCOTT';

no rows selected

SQL> alter session set container=PDB1;

Session altered.

SQL> select name,password from user$ where name='SCOTT';

NAME
--------------------------------------------------------------------------------
PASSWORD
--------------------------------------------------------------------------------
SCOTT
F894844C34402B67


SQL> show user;
USER is "SYS"
SQL> alter user scott identified by scott;

User altered.

SQL> conn scott/scott@PDB1;
Connected.
SQL> 
SQL> conn / as sysdba
Connected.
SQL> alter session set container=PDB1;

Session altered.

SQL> alter user scott identified by values 'F894844C34402B67';

User altered.

SQL> conn scott/scott@PDB1;
ERROR:
ORA-01017: invalid username/password; logon denied


Warning: You are no longer connected to ORACLE.
SQL> conn scott/tiger@PDB1;
Connected.
SQL> show user;
USER is "SCOTT"
SQL> 




评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值