Home » RDBMS Server » Security » Grant DBA role using procedure doesn't work (Oracle 19c Windows )
Grant DBA role using procedure doesn't work [message #689631] Mon, 04 March 2024 02:52 Go to next message
Andrey_R
Messages: 441
Registered: January 2012
Location: Israel
Senior Member
Hi DBAs,
I am trying, and so far failing to understand why when I grant direct DBA role to user I can access views such as DBA_TABLES,
while when granted using a procedure it doesn't.

Direct Grant:

SQL> show user
USER is "SYS"
SQL> create user t identified by t;

User created.

SQL> grant dba to t;

Grant succeeded.

SQL> conn t/t
Connected.
SQL>
SQL> show user
USER is "T"
SQL> select count(*) from DBA_TABLES;

  COUNT(*)
----------
      2216

SQL>
Grant using procedure:

SQL> show user
USER is "SYS"
SQL>
SQL> create user t identified by t;

User created.

SQL> grant connect,resource to t;

Grant succeeded.

SQL>
SQL> CREATE OR REPLACE PROCEDURE SYS.TEMPORARILY_ELAVATE_PRIVS
  2  AUTHID DEFINER
  3  is
  4  --
  5  V_CMD1 VARCHAR2(1000);
  6  BEGIN
  7  V_CMD1 := 'grant DBA to t';
  8  --
  9  EXECUTE IMMEDIATE V_CMD1;
 10  end;
 11  /

Procedure created.

SQL> grant execute on SYS.TEMPORARILY_ELAVATE_PRIVS to t;

Grant succeeded.

SQL>
SQL> CONN t/t
Connected.
SQL>
SQL> show user
USER is "T"
SQL>
SQL>
SQL>
SQL> exec SYS.TEMPORARILY_ELAVATE_PRIVS;

PL/SQL procedure successfully completed.

SQL> select count(*) from dba_tables;
select count(*) from dba_tables
                     *
ERROR at line 1:
ORA-00942: table or view does not exist

What am I missing here?

Thanks in advance
Andrey
Re: Grant DBA role using procedure doesn't work [message #689632 is a reply to message #689631] Mon, 04 March 2024 03:00 Go to previous messageGo to next message
John Watson
Messages: 8931
Registered: January 2010
Location: Global Village
Senior Member
Your user t will need to reconnect before the role comes into effect.
Re: Grant DBA role using procedure doesn't work [message #689633 is a reply to message #689632] Mon, 04 March 2024 03:07 Go to previous messageGo to next message
Andrey_R
Messages: 441
Registered: January 2012
Location: Israel
Senior Member
John Watson wrote on Mon, 04 March 2024 11:00
Your user t will need to reconnect before the role comes into effect.
Thank you! much appreciated
Re: Grant DBA role using procedure doesn't work [message #689634 is a reply to message #689633] Mon, 04 March 2024 03:20 Go to previous messageGo to next message
cookiemonster
Messages: 13920
Registered: September 2008
Location: Rainy Manchester
Senior Member
Also don't create procedures (or any other object type) in sys. Sys is for oracles own internal stuff, leave it alone.
Re: Grant DBA role using procedure doesn't work [message #689635 is a reply to message #689634] Mon, 04 March 2024 04:12 Go to previous message
Michel Cadot
Messages: 68647
Registered: March 2007
Location: Nanterre, France, http://...
Senior Member
Account Moderator

In addition, read SYS/SYSDBA is special.

Previous Topic: Audit retention period
Next Topic: Max string size for regular users
Goto Forum:
  


Current Time: Sat Apr 27 10:30:12 CDT 2024