Re: Preventing SQLPLUS access?

Atul Ashar <aashar_at_usccmail.bms.com> writes:

>Hi Aram,
 

>I have had a similar situation. You are right about all non-oracle tools
>do not check User Product Profile.
 

>However, in your suggestion, user can start a session the way you are
>suggesting and then when you grant that role to the user, role is
>granted not just for the session. So, user can still connect to database
>using MS-Query with a different session before they disconnect from the
>session which granted them the role.
 

>How do you take care of that?

The User is granted one role as the default role - usually a db_login type role that has only create session and alter session privs. Any other roles granted are NON default roles (and password protected). The applicatino enables the role (and passes the password, which the User knows nothign about), thus enabling the access.

When the User logs in via SQL*Plus/Access/etc., they only get the privs granted to their default role - nothing.

-- 
/(o\ Nathan D. Hughes
\o)/ nhughes_at_umich.edu