Re: How to allow updates by programs by not by sqlplus.

Varad Acharya wrote:
>
> Kenneth Denny wrote:
> >
> > Hello,
> > I need to implement a way to allow users to run sqlplus for query
> > purposes, but not allow them to update. At the same time I want them to
> > be able to run application programs which update the database.
> >
> > I'm sure there is a way this can be done. Can someone tell me how?
> > Please reply by email.
> >
> > Thanks
> > Ken Denny
> > email: kdenny_at_interpath.com
>
> You can use the Product_user_profile to table to do this. The set up &
> use of this table is described in SqlPlus Manual.

Kenny:

The method described above will work fine provided your users "ONLY" connect via your application or sqlplus. If a user were to connect using another tool (MS Access for example) they could delete all your data if they have delete access to the table. A more appropriate method would be to give the users a default role that gives them read only access to the tables the need for ad-hoc reporting. But also create a password protected role that is granted to each user. Have your application program set this role before beginning with that password "Hidden" in a system table (it could even be encrypted). Then you can relatively safely let users have access to the data via a tool like ms-access, excel, etc without danger to your valuable data or even more important your job.

Hope this helps,

John Hough Received on Wed May 28 1997 - 00:00:00 CDT