Re: Who can grant Object Permissions ?

From: Howard J. Rogers <dba_at_hjrdba.com>
Date: Thu, 21 Mar 2002 06:33:01 +1100
Message-ID: <a7ao6p$1v3$1@lust.ihug.co.nz>

Your understanding is correct. Only the user owning an object can grant permissions on that object, unless s/he grants a permission 'with grant option'... in which case, the grantee can then grant that permission on to others.

How do you therefore grant those permissions without knowing the User's password? Strictly speaking, you can't, and you shouldn't. So what follows is considered extremely bad form, and rather rude DBAing... but occasionally the need arises.

SQL>select password from dba_users where username='SCOTT';

PASSWORD

---

F894844C34402B67

(Copy that hashed version of the original password somewhere safe).

SQL>connect system/manager
SQL> alter user scott identified by newpassword;
SQL>connect scott/newpassword
SQL> grant select on emp to howard;

(and now to set things back the way the were....)

SQL>connect system/manager
SQL> alter user scott identified by values 'F894844C34402B67';

(and as proof.....)

SQL>connect scott/tiger
Connected.

Regards
HJR

--
----------------------------------------------
Resources for Oracle: http://www.hjrdba.com
===============================


"mdlbikes" <marcelo_at_nickonline.com> wrote in message
news:94881926.0203201122.2a4d6ac_at_posting.google.com...


> I am supporting a few Oracle servers and trying to understand how

> Oracle manages object permissions. My experience is with Sybase and

> the "sa" account is able to grant any permissions.

>

> On Oracle, I login as SYS, but cannot grant permission on a table

> because I have "insuffitient permission" or something like.

>

> I read through the manuals, and as I understood, only the schema that

> owns the object can grant permissions. If understood this correctly,

> how do you grant permissions on objects if you don't have the user's

> password ( the one that owns the object)

>

> Thank You

Received on Wed Mar 20 2002 - 13:33:01 CST