Re: how to stop user from altering schema

From: Mark C. Stock <mcstockX_at_Xenquery>
Date: Thu, 9 Jun 2005 11:29:37 -0400
Message-ID: <0cGdnYAEouP4_TXfRVn-qQ@comcast.com>

"Mark D Powell" <Mark.Powell_at_eds.com> wrote in message news:1118330358.991512.242930_at_f14g2000cwb.googlegroups.com...
> Or in other words, you cannot restrict an ower's access to their own
> objects unless you can prevent the owner from logging on.
>

.... unless you use database event triggers (to prevent DDL) and perhaps combined VPD policies (to restrict DML... haven't tried the latter, but I got a hunch it could work, if necessary)

but a more typical solution would be ...

> Generally you create objects under one id then issue object privileges
> to a role and grant the role to the user(s) that need the object
> privileges but the role does not include any DDL privileges. Access to
> the owner id is restricted to DBA and/or a few key people.
>
> HTH -- Mark D Powell --
>

++ mcs Received on Thu Jun 09 2005 - 10:29:37 CDT