The UNLIMITED TABLESPACE privileges cannot be granted to a role
今天在做role测试的时候,遇到一个问题,当把unlimited tablespace privileges grant to role的时候,遇到错误:
ORA-01931: cannot grant UNLIMITED TABLESPACE to a role
情景重现:
1.创建role-> HELLO
SQL> conn / as sysdba
Connected.
SQL> show parameter instance_name
NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
instance_name string devdb1
SQL> CREATE ROLE "HELLO" NOT IDENTIFIED;
Role created.
2.给角色授权-> UNLIMITED TABLESPACE
SQL> GRANT UNLIMITED TABLESPACE TO "HELLO";
GRANT UNLIMITED TABLESPACE TO "HELLO"
*
ERROR at line 1:
ORA-01931: cannot grant UNLIMITED TABLESPACE to a role
3.原因
Text: cannot grant UNLIMITED TABLESPACE, REFERENCES, or INDEX to a role
Cause: The UNLIMITED TABLESPACE, REFERENCES, or INDEX or SYSDBA or SYSOPER privileges cannot be granted to a role.
Action: Grant these privileges directly to the user.
4.授权给用户成功
SQL> grant unlimited tablespace to ecc_view;
Grant succeeded.
把问题进一步深入分析:
如果把resource 赋予一个role,然后把这个role授权给用户,用户仍然没有UNLIMITED TABLESPACE的权限
原因为:
When the RESOURCE role is granted directly to a user, the UNLIMITED TABLESPACE system privilege is included in the role. However, the UNLIMITED TABLESPACE privilege actually gives the user unlimited QUOTA on all tablespaces, which is a user attribute.
If the RESOURCE role is granted to another role, and that role granted to users,there is no way to propagate user attributes. Thus, the users will not have quota on any tablespaces. Unlimited tablespace system privilege cannot be granted directly to a role
(ORA-1931).
1.创建角色hello,授予resource权限
SQL> conn / as sysdba
Connected.
SQL> create role hello;
Role created.
SQL> grant resource to hello;
Grant succeeded.
2.创建普通用户test
SQL> create user test identified by ecc ;
User created.
3.普通用户test授予connect, hello角色
SQL> grant connect , hello to test;
Grant succeeded.
4.test连接,在表空间无权限创建对象,因为系统权限没有继承resource的权限
SQL> conn test/ecc@devdb1
Connected.
SQL> create table t1 (id varchar(10));
create table t1 (id varchar(10))
*
ERROR at line 1:
ORA-01950: no privileges on tablespace 'USERS'
5.把resources直接授权给用户test
SQL> conn / as sysdba;
Connected.
SQL> grant resource to test;
Grant succeeded.
6. UNLIMITED TABLESPACE被授予用户
SQL> conn test/ecc@devdb1
Connected.
SQL> create table t1 (id varchar(10));
Table created.
Subject: OERR: ORA 1931 cannot grant UNLIMITED TABLESPACE, REFERENCES, or INDEX to a role
Doc ID: 19219.1 Type: REFERENCE
Modified Date : 10-JUN-1999 Status: PUBLISHED
Subject: ORA-1950 When Creating an Object and Resource Role is Granted to the User
Doc ID: 1005485.6 Type: PROBLEM
Modified Date : 30-MAR-2009 Status: PUBLISHED