Daniel Morgan wrote:
> Frank wrote:
>
>
>>Daniel Morgan wrote:
<major snip!>
>
> The roles to remove are CONNECT, RESOURCE, and DBA.
>
> The CONNECT role contains lots of privileges that have nothing to do with connecting
> to the database. The only privilege required to connect is CREATE SESSION.
>
> My suggestion is to create the following roles and others modeled upon them.
>
> READONLY --- with only create session
> DATA_ENTRY -- READONLY plus nothing but INSERT and maybe SELECT and UPDATE into
> specific tables
> SUPERVISOR
> MANAGER
> EXECUTIVE
> DEVELOPER
> SR_DEVELOPER
> DBA -- and with only those privileges required for the job. DBA does not need to be a
> clone of SYS
> --
I like the distinction between developer and sr_developer.
<g>
And agree on dba, but have never done that, nor seen it.
The opposite, actually: ran against an implementation,
where *all* users were given the DBA role.
Did not question why, as I know the answer: "it did not work
otherwise".
--
Regards, Frank van Bortel
Received on Tue Apr 29 2003 - 15:23:22 CDT
