Re: add new user to oracle ??

From: Daniel Morgan <damorgan_at_x.washington.edu>
Date: Fri, 30 Jan 2004 21:48:06 -0800
Message-ID: <1075528027.949964@yasure>

Thomas Kellerer wrote:
> Daniel Morgan schrieb:
>

>> Do not grant the CONNECT, RESOURCE, OR DBA roles. 

>
>
> Why is that?
>
> If we should not use those roles, why do they exist in the first place?
>
> Thomas

In addition to Howard's comments which are spot on ... even the DBA role is nothing if not dangerous. It gives away privileges that have no business being given to every DBA on the system ... starting with the ability to change the passwords for SYS and SYSTEM.

Roles should be named and customized to match employee positions in your organization. They should have names like REPORT_WRITER, AP_CLERK, IT_MANAGER. The sooner we stop using these three abominations the sooner Oracle can get rid of them and we will all benefit.

-- 
Daniel Morgan
http://www.outreach.washington.edu/ext/certificates/oad/oad_crs.asp
http://www.outreach.washington.edu/ext/certificates/aoa/aoa_crs.asp
damorgan_at_x.washington.edu
(replace 'x' with a 'u' to reply)

Received on Fri Jan 30 2004 - 23:48:06 CST