Implementing security using

Roles and Privileges

Shabeerali, A.V.
Shab-pg5@iiitmk.ac.in
Roll No: M0508036
My Goal
• Privileges
• Roles
• Usage
• Demo
Privileges Roles Usage Demo

Privileges
System Privileges
Database system privileges let you execute
specific set of commands.

CREATE TABLE --to create table

CREATE SESSION– to create session
GRANT ANY PRIVILEGE --allows you to grant any
system privilege.
Privileges Roles Usage Demo

Object Privileges
  To perform some operations on various
objects.

DELETE --to delete rows form tables or views.

SELECT --to query with a select from tables, views,
sequences, snapshots.
Privileges Roles Usage Demo

Roles
An Oracle role is set of privileges (or type of access that
each user needs, depending on his or her status and
responsibilities).
 Three standard roles
•CONNECT
•RESOURCE
•DBA
Privileges Roles Usage Demo

 
The CONNECT Role
 Gives users to log in and do basic functions
Access to specific tables belonging to other users.
--Create tables, views, sequences, clusters, synonyms,
and links to other database.
 The RESOURCE Role
 Gives additional rights create their own tables,
sequences, procedures ,triggers, data types, operators,
index types, indexes and clusters.
 
Privileges Roles Usage Demo

The DBA role

The database administrator role has
•All system privileges including unlimited space
quotas.
•The ability to grant all the privileges to other users.
Privileges Roles Usage Demo

Grant
Format for the grant command
Grant {system privilege | role | all
[privileges] }[, {system privilege | role
| all [privileges]}……]
to {user | role }[,{user | role }]…
[identified by password ][with admin
option];
create user july identified by july;
grant CONNECT to july;
grant CONNECT,RESOURCE to user;
Privileges Roles Usage Demo

What users can grant

 Object Privilege
 To give others access to your table
 grant {object privilege | all [privileges]}
[(column [,column]…)]
[,{object privilege | role | all
[privileges] }
[(column [,column]…)]]…
on object to {user | role }
[with grant option];

 
Privileges Roles Usage Demo
Creating a role
create role CLERK
Granting privileges to a role
grant select on TABLENAME to CLERK;
 Granting role to another role
 grant CLERK to MANGER ;
Granting role to users
grant CLERK to Bob;
 Grant with admin option
grant MANAGER to Bob with admin option;
Privileges Roles Usage Demo

Enabling or Disabling role

 When a user’s account is altered , a list of default roles for that
user can be created via the default role clause of the alter user
command.
alter user username default role
{[role1,role2][all | all except
role1,role2][NONE]};

alter user bob default role clerk;

Privileges Roles Usage Demo

To enable a non default role use set role command

 set role CLERK;
 set role all;
set role all except CLERK;
 If role has a password .
set role MANAGER identified by manager;
 To disable role use the set role none;
 set role none – this will disable are
role in current session.
 
Privileges Roles Usage Demo

Adding password to a role

By default roles do not have passwords associated with
them. To enable security for a role, use the identified by
clause of the alter role command to specify a password.
alter role manager identified by
manager;
Any time the user tries to activate the role, the password
will be required. If that role is setup as a default role for the
user, then no password is required.
Privileges Roles Usage Demo

Removing Password from a role

alter role manager not identified by
manager;
Revoking Privileges from a role
 Revoke SELECT on TABLENAME from CLERK;
 Dropping role
 drop role MANAGER;
Privileges Roles Usage Demo

Revoking the system privileges

revoke {system privilege | role |all
[privileges]}[,{system privilege | role |
[all privileges] }…]from {user | role }
[,{user | role}]…
Privileges Roles Usage Demo

Revoking Object Privileges

revoke {object privilege | all
[privileges]} [(column
[,column]…)]
[,{object privilege | role |
all [privileges] }
[(column [,column]…)]]…
on object from {user | role }
[cascade constraints] [force];
 
Privileges Roles Usage Demo

 
Granting access to the public
 
Grant select on TABLENAME to public;
  
Granting limited resource
 
Alter user bob quota 100M on USERS;
Privileges Roles Usage Demo

DEMO
REFERENCE

Oracle 9i The Complete Reference

By
Kevin Loney, George Koch