Sec_P1 创建和授予角色

Sec_P1 创建和授予角色

SQL>connect system/oracle

#创建两个角色

SQL>createrole  usr_role;

SQL>createrole mgr_role;

#为这些角色授予一些权限，并将usr_role授予mgr_role;

SQL>grantcreate session to usr_role;

SQL>grantselect on sales.t1 on usr_role;

SQL>grantusr_role to mgr_role with admin option;

SQL>grantall on sales.t1 to mgr_role;

SQL>connsystem/oracle

SQL>grantmgr_role to webapp;

SQL>connwebapp/oracle;

SQL>grantusr_role to accounts ;

SQL>insertinto sales.t1 values(sysdate);

SQL>commit;

#拥有查询权限，但是没有插入权限。

SQL>connaccounts/oracle

SQL>Select* from sales.t1;

SQL>insertinto sales.t1 values(sysdate);

--ORA-01031:insufficient privileges

#对accounts的权限进行调整，使其可以在默认情况下登录，但无其他权限。

SQL>connsystem/oracle

SQL>grantconnect to accounts;

SQL>alteruser default role  connect;

#演示角色的启用和禁用

SQL>connaccounts/oracle

SQL>select* from sales.t1;

--ORA-00942:table or veiw does not exist

SQL>setrole usr_role;

SQL>select* from sales.t1;  --It's OK;

#查看两个新角色对于的查看权限

SQL>select * from dba_role_privs

Wheregranted_role in ('USR_ROLE', 'MGR_ROLE');

SQL>selectgrantee,owner, table_name,privilege,grantable

Fromdba_tab_privs where grantee in ( ' USR_ROLE', 'MGR_ROLE')

Union all

Selectgrantee, to_char(null), to_char(null),privilege,admin_option

Fromdba_sys_privs  where grantee in ('USR_ROLE', 'MGR_ROLE')

Order bygrantee;