Oracle11g温习-第十八章：role管理

Posted 2020-10-07 ORACLE-fans

2013年4月27日 星期六

10:52

 

role 的功能：简化用户的权限管理 建立角色——给角色授权——将角色授予用户/角色

2、查看系统建立的role

SYS @ prod >  select * from dba_roles;                                                                                                      ROLE                           PASSWORD ------------------------------ -------- CONNECT                        NO RESOURCE                       NO DBA                            NO SELECT_CATALOG_ROLE            NO EXECUTE_CATALOG_ROLE           NO DELETE_CATALOG_ROLE            NO EXP_FULL_DATABASE              NO IMP_FULL_DATABASE              NO RECOVERY_CATALOG_OWNER         NO GATHER_SYSTEM_STATISTICS       NO LOGSTDBY_ADMINISTRATOR         NO AQ_ADMINISTRATOR_ROLE          NO AQ_USER_ROLE                   NO GLOBAL_AQ_USER_ROLE            GLOBAL SCHEDULER_ADMIN                NO HS_ADMIN_ROLE                  NO AUTHENTICATEDUSER              NO OEM_ADVISOR                    NO OEM_MONITOR                    NO WM_ADMIN_ROLE                  NO JAVAUSERPRIV                   NO JAVAIDPRIV                     NO JAVASYSPRIV                    NO JAVADEBUGPRIV                  NO EJBCLIENT                      NO JAVA_ADMIN                     NO JAVA_DEPLOY                    NO CTXAPP                         NO XDBADMIN                       NO XDBWEBSERVICES                 NO OLAP_DBA                       NO OLAP_USER                      NO MGMT_USER                      NO PLUSTRACE                      NO

3、建立角色（ create role）

SYS @ prod > create role pub_role;   Role created.   SYS @ prod > create role prv_role identified    by    oralce;【带口令的，一般非默认角色都应该加上口令，便于分配和管理】   Role created.

4、给角色授权

SYS @ prod > grant create session,create table to pub_role;   Grant succeeded.   SYS @ prod > grant select on scott.emp to prv_role;   Grant succeeded.

5、查看role 拥有的权限

——SYSTEM PRIVILEGE SYS @ prod > select * from role_sys_privs where role=‘&name‘;   Enter value for name: DBA   old   1: select * from role_sys_privs where role=‘&name‘ new   1: select * from role_sys_privs where role=‘DBA‘   ROLE                           PRIVILEGE                                ADM ------------------------------ ---------------------------------------- --- DBA                            CREATE SESSION                           YES DBA                            ALTER SESSION                            YES DBA                            DROP TABLESPACE                          YES DBA                            BECOME USER                              YES DBA                            DROP ROLLBACK SEGMENT                    YES DBA                            SELECT ANY TABLE                         YES DBA                            INSERT ANY TABLE                         YES DBA                            UPDATE ANY TABLE                         YES DBA                            READ ANY FILE GROUP                      YES DBA                            CREATE EXTERNAL JOB                      YES   SYS @ prod > select * from role_sys_privs where role=‘&name‘;   Enter value for name: CONNECT old   1: select * from role_sys_privs where role=‘&name‘ new   1: select * from role_sys_privs where role=‘CONNECT‘   ROLE                           PRIVILEGE                                ADM ------------------------------ ---------------------------------------- --- CONNECT                        CREATE SESSION                           NO   SYS @ prod > select * from role_sys_privs where role=‘&name‘;   Enter value for name: RESOURCE old   1: select * from role_sys_privs where role=‘&name‘ new   1: select * from role_sys_privs where role=‘RESOURCE‘   【隐含unlimited tablespace 权限（可以在任何一个表空间上拥有配额）       如果将该角色分配给用户，一般都会将该权限收回，再进行表空间配额的分配】   ROLE                 PRIVILEGE                      ADMIN_OPT -------------------- ------------------------------ --------- RESOURCE             CREATE SEQUENCE                NO RESOURCE             CREATE TRIGGER                 NO RESOURCE             CREATE CLUSTER                 NO RESOURCE             CREATE PROCEDURE               NO RESOURCE             CREATE TYPE                    NO RESOURCE             CREATE OPERATOR                NO RESOURCE             CREATE TABLE                   NO RESOURCE             CREATE INDEXTYPE               NO   8 rows selected.   SYS @ prod > select * from role_sys_privs where role=‘&name‘;   Enter value for name: PUB_ROLE old   1: select * from role_sys_privs where role=‘&name‘ new   1: select * from role_sys_privs where role=‘PUB_ROLE‘   ROLE                 PRIVILEGE                      ADMIN_OPT -------------------- ------------------------------ --------- PUB_ROLE             CREATE TABLE                   NO PUB_ROLE             CREATE SESSION                 NO   ——OBJECT PRIVILEGE SYS @ prod > select * from role_tab_privs where role=‘&name‘;   Enter value for name: PRV_ROLE old   1: select * from role_tab_privs where role=‘&name‘ new   1: select * from role_tab_privs where role=‘PRV_ROLE‘   ROLE                 OWNER           TABLE_NAME      COLUMN_NAME     PRIVILEGE            GRANTABLE -------------------- --------------- --------------- --------------- -------------------- --------------- PRV_ROLE             SCOTT           EMP                             SELECT               NO

6、将role 分配给用户

——【default role：当用户建立session 时，用户所分配的role 上的权限会立刻生效。 （如果不显式指定，用户所分配的role都是该用户的default role，默认角色分配的权限一般都很少）】   SYS @ prod > create user tom identified by tom;                                                                                          User created.   SYS @ prod > create user rose identified by rose;                                                                                      User created.   SYS @ prod > alter user tom quota 10m on users;                                                                                         User altered.   SYS @ prod > alter user rose quota 10m on users;                                                                                        User altered.   SYS @ prod > grant pub_role,prv_role to tom,rose; ——【with admin option 用户有权将role 分配给其他用户】  Grant succeeded.   ——【role 可以分配给用户，也可以分配其他role，不能分配给自己。 SYS @ prod > select * from user_role_privs;        ——【默认情况下，pub_role 和 prv_role 都是tom的 default role】   USERNAME        GRANTED_ROLE                   ADMIN_OPTION    DEFAULT_ROLE    OS_GRANTE --------------- ------------------------------ --------------- --------------- --------- TOM             PRV_ROLE                       NO              YES             NO TOM             PUB_ROLE                       NO              YES             NO TOM             RESOURCE                       NO              YES             NO     SYS @ prod > select * from scott.emp;  【tom 继承了prv_role的object privilege】                                                                                                        EMPNO ENAME      JOB              MGR HIREDATE         SAL       COMM     DEPTNO ---------- ---------- --------- ---------- --------- ---------- ---------- ----------       7369 SMITH      CLERK           7902 17-DEC-80        800                    20       7499 ALLEN      SALESMAN        7698 20-FEB-81       1600        300         30       7521 WARD       SALESMAN        7698 22-FEB-81       1250        500         30       7566 JONES      MANAGER         7839 02-APR-81       2975                    20       7654 MARTIN     SALESMAN        7698 28-SEP-81       1250       1400         30       7698 BLAKE      MANAGER         7839 01-MAY-81       2850                    30       7782 CLARK      MANAGER         7839 09-JUN-81       2450                    10       7788 SCOTT      ANALYST         7566 19-APR-87       3000        100         40       7839 KING       PRESIDENT            17-NOV-81       5000                    10       7844 TURNER     SALESMAN        7698 08-SEP-81       1500          0         30       7876 ADAMS      CLERK           7788 23-MAY-87       1100                    20       7900 JAMES      CLERK           7698 03-DEC-81        950                    30       7902 FORD       ANALYST         7566 03-DEC-81       3000                    20       7934 MILLER     CLERK           7782 23-JAN-82       1300                    10                                                                                                                     SYS @ prod > create table emp as select * from scott.emp;  ——【tom 继承了pub_role的system privilege】                                                                             Table created. 【显式指定默认 role（对于非default role 必须在启用后，用户才能继承role 所具有的权限）】   SYS @ prod > conn /as sysdba Connected.   SYS @ prod > alter user tom default role pub_role; User altered.   SYS @ prod > conn tom/tom Connected.   TOM @ prod > select * from user_role_privs;   USERNAME        GRANTED_ROLE                   ADMIN_OPTION    DEFAULT_ROLE    OS_GRANTE --------------- ------------------------------ --------------- --------------- --------- TOM             PRV_ROLE                       NO              NO              NO TOM             PUB_ROLE                       NO              YES             NO TOM             RESOURCE                       NO              NO              NO   TOM @ prod > select * from scott.emp;   select * from scott.emp                     * ERROR at line 1: ORA-01031: insufficient privileges 【因为prv_role 是非 default role，所以tom 在建立session 不具有prv_role 的权限】   TOM @ prod > create table t1 (id int);                                                                                                 Table created. TOM @ prod > set role prv_role;                                                                                                          set role prv_role * ERROR at line 1: ORA-01979: missing or invalid password for role ‘PRV_ROLE‘   SYS @ prod > set role    prv_role   identified   by   oracle;   ——【启用非默认角色，如果有口令，需通过password 启用】                                                                                  Role set. USERNAME        GRANTED_ROLE                   ADMIN_OPTION    DEFAULT_ROLE    OS_GRANTE --------------- ------------------------------ --------------- --------------- --------- TOM             ANNY_ROLE                      NO              NO              NO TOM             PRV_ROLE                       NO              NO              NO TOM             PUB_ROLE                       NO              YES             NO TOM             RESOURCE                       NO              NO              N   SYS @ prod >  select * from scott.emp;                                                                                                         EMPNO ENAME      JOB              MGR HIREDATE         SAL       COMM     DEPTNO ---------- ---------- --------- ---------- --------- ---------- ---------- ----------       7369 SMITH      CLERK           7902 17-DEC-80        800                    20       7499 ALLEN      SALESMAN        7698 20-FEB-81       1600        300         30       7521 WARD       SALESMAN        7698 22-FEB-81       1250        500         30       7566 JONES      MANAGER         7839 02-APR-81       2975                    20       7654 MARTIN     SALESMAN        7698 28-SEP-81       1250       1400         30       7698 BLAKE      MANAGER         7839 01-MAY-81       2850                    30       7782 CLARK      MANAGER         7839 09-JUN-81       2450                    10       7788 SCOTT      ANALYST         7566 19-APR-87       3000        100         40       7839 KING       PRESIDENT            17-NOV-81       5000                    10       7844 TURNER     SALESMAN        7698 08-SEP-81       1500          0         30       7876 ADAMS      CLERK           7788 23-MAY-87       1100                    20       7900 JAMES      CLERK           7698 03-DEC-81        950                    30       7902 FORD       ANALYST         7566 03-DEC-81       3000                    20       7934 MILLER     CLERK           7782 23-JAN-82       1300                    10   【启用非 default role 后，用户就具有了非default role 的权限】

7、角色回收（revoke）

SYS @ prod > revoke pub_role ,prv_role from tom,rose;                                                                                      Revoke succeeded.

8、删除角色（drop）

SYS @ prod > drop role pub_role;                                                                                                         Role dropped.   SYS @ prod > drop role prv_role;                                                                                                       Role dropped.

9、与角色有关的视图

DBA_ROLES: DBA_ROLE_PRIVS: ROLE_ROLE_PRIVS: DBA_SYS_PRIVS: ROLE_SYS_PRIVS: ROLE_TAB_PRIVS: SESSION_ROLES: