Oracle用户管理(User|Privileges|Role)

一、用户管理：

SYS/CHANGE_ON_INSTALL | SYSTEM/MANAGER | SCOTT/TIGER | SYSMAN/OEM_TEMP | INTERNAL/ORACLE

NORMAL | SYSOPER | SYSDBA → SQL> SHOW USER.

SYSOPER: STARTUP、SHUTDOWN、ALTER DATABASE MOUNT|OPEN、ALTER TABLESPACE BEGIN|END BACKUP、ALTER DATABASE BACKUP CONTROLFILE、RECOVER DATABASE、ALTER DATABASE ARCHIVELOG、RESTRICTED SESSION.

SYSDBA: SYSOPER WITH ADMIN OPTION、CREATE DATABASE、RECOVER DATABASE UNTIL.

1.USER:

SQL> CREATE/ALTER USER <User_Name> IDENTIFIED BY <Password>
DEFAULT TABLESPACE <Tablespace_Name>
TEMPORARY TABLESPACE <Tablespace_Name>
QUOTA UNLIMITED/<n> [K|M|G] ON <Tablespace_Name>
ACCOUNT LOCK/UNLOCK PROFILE <Profile_Name>;

SQL> DROP USER <User_Name> [CASCADE];

SQL> DESC DBA_USERS [ALL_USERS/USER_USERS]

Name Null? Type
----------------------------------------- -------- ----------------------------
USERNAME NOT NULL VARCHAR2(30)
USER_ID NOT NULL NUMBER
PASSWORD VARCHAR2(30)
ACCOUNT_STATUS NOT NULL VARCHAR2(32)
LOCK_DATE DATE
EXPIRY_DATE DATE
DEFAULT_TABLESPACE NOT NULL VARCHAR2(30)
TEMPORARY_TABLESPACE NOT NULL VARCHAR2(30)
CREATED NOT NULL DATE
PROFILE NOT NULL VARCHAR2(30)
INITIAL_RSRC_CONSUMER_GROUP VARCHAR2(30)
EXTERNAL_NAME VARCHAR2(4000)

SQL> ALTER DATABASE DEFAULT [TEMPORARY] TABLESPACE <Tablespace_Name>;

SQL> SELECT * FROM DBA_PROFILES WHERE RESOURCE_NAME = 'FAILED_LOGIN_ATTEMPTS';

PROFILE RESOURCE_NAME RESOURCE_TYPE LIMIT
-------------------- ---------------------- ------------- ---------------------
DEFAULT FAILED_LOGIN_ATTEMPTS PASSWORD 10
MONITORING_PROFILE FAILED_LOGIN_ATTEMPTS PASSWORD UNLIMITED

SQL> DESC DBA_PROFILES

Name Null? Type
----------------------------------------- -------- ----------------------------
PROFILE NOT NULL VARCHAR2(30)
RESOURCE_NAME NOT NULL VARCHAR2(32)
RESOURCE_TYPE VARCHAR2(8)
LIMIT VARCHAR2(40)

SQL> ALTER USER User_Name PROFILE Profile_Name;

SQL> DROP USER User_Name;

ERROR at line 1:
ORA-01940: cannot drop a user that is currently connected
SQL> SELECT SID,SERIAL# FROM V$SESSION; → SQL> ALTER SYSTEM KILL SESSION 'SID,SERIAL#';

--显示用户表空间配额：
SQL> SELECT tablespace_name,username,bytes,max_bytes FROM DBA_TS_QUOTAS;

SQL> SELECT * FROM V$PWDFILE_USERS; --Password_File.

USERNAME SYSDBA SYSOPER
------------------------------ ------- --------
SYS TRUE TRUE

# 远程客户端通过操作系统验证：

SQL> show parameter os_authent_prefix

NAME TYPE VALUE
------------------------------------ --------------------------------- ------------------------
os_authent_prefix string ops$

SQL> ALTER SYSETM SET REMOTE_OS_AUTHENT = TRUE scope = spfile;

SQL> CREATE USER "OPS$ORACLE" PROFILE "DEFAULT"
IDENTIFIED EXTERNALLY DEFAULT TABLESPACE "USERS"
TEMPORARY TABLESPACE "TEMP";

SQL> GRANT connect TO ops$oracle; [OS_AUTHENT_PREFIX + OS_Username(Oracle)]

2.Privileges:

System Privilege: Enables users to perform particular actions in the database.

SQL> GRANT Privilege[|Role_Name] TO User_Name[Role_Name|PUBLIC] [WITH ADMIN|GRANT OPTION];

Object Privilege: Enables users to access and manipulate a specific object.

SQL> GRANT {Object Privilege: 1.ALTER;2.EXECUTE;3.INDEX;
4.REFERENCES;5.INSERT/UPDATE/REFERENCES(Column_Name)|ALL}
ON Object_Name TO User_name;

# WITH ADMIN OPTION:
Enables the grantee to grant the system privilege or role to other users or roles.

# WITH GRANT OPTION:
Enables the grantee to grant the object privilege to other users or roles.

SQL> SELECT * FROM DBA_SYS_PRIVS; --用户/角色的系统权限（USER_SYS_PRIVS）.

SQL> SELECT * FROM DBA_TAB_PRIVS; --用户的对象权限（USER_/ALL_TAB_PRIVS）.

SQL> SELECT * FROM SYSTEM_PRIVILEGE_MAP; --显示所有系统权限.

SQL> SELECT * FROM SESSION_PRIVS; --显示当前会话所具有的系统权限.

SQL> SELECT * FROM USER_TAB_PRIVS_MADE; --显示用户授出的对象权限(USER_COL_PRIVS_MADE).

SQL> SELECT * FROM USER_TAB_PRIVS_RECD; --显示用户拥有的对象权限(USER_COL_PRIVS_RECD).

--显示所有对象权限：
SQL> SELECT * FROM TABLE_PRIVILEGES;

SQL> SELECT * FROM DBA_COL_PRIVS; → SQL> GRANT UPDATE(SAL) ON SCOTT.EMP TO GDCSDB;

SQL> REVOKE Privilege[|Role_Name] FROM User_Name[Role_Name|PUBLIC];

3.ROLE:

SQL> CREATE/DROP ROLE Role_Name; → SQL> GRANT Role_Name TO User_Name;

SQL> SELECT * FROM DBA_ROLES; --Oracle中的角色信息.

SQL> SELECT * FROM DBA_ROLE_PRIVS; --用户/角色所有拥有的角色（USER_ROLE_PRIVS）.

SQL> SELECT * FROM ROLE_SYS_PRIVS; --显示角色所拥有的系统/对象权限(ROLE_TAB_PRIVS).

SQL> SELECT * FROM ROLE_ROLE_PRIVS; --显示角色所被赋予的其他角色.

SQL> CREATE/ALTER ROLE Role_Name [NOT IDENTIFIED|IDENTIFIED BY Password];

ERROR at line 1:
ORA-01955: DEFAULT ROLE 'ROLE_1' not granted to user
SQL> GRANT ROLE_1 TO SCOTT;

SQL> ALTER USER User_Name DEFAULT ROLE Role_Name_1[,Role_Name_2,...|ALL <EXCEPT Role_Name>|NONE];

SQL> SET ROLE Role_Name; ==> SQL> EXEC DBMS_SESSION.SET_ROLE('Role_Name INDENTIFIED BY Password');

SQL> SET ROLE Role_Name IDENTIFIED BY Password;
==> SQL> EXEC DBMS_SESSION.SET_ROLE('Role_Name');

SQL> SELECT * FROM SESSION_ROLES; | SQL> SET ROLE NONE;

DEFAULT ROLE: <1>.CREATE/ALTER ROLE ... IDENTIFIED BY Password; → NOT IDENTIFIED;<2>.GRANT Role_1,Role_2,Role_3 TO User_Name; → DEFAULT ROLE(Role_1,Only) → SET ROLE Role_2|Role_3;

# Others：

Database Schema: (1)A schema is a named collection of object.(2)A user is created,and a corresponding schema is created.(3)A user can be associated with only one schema.(4)Username and Schema are often used interchangeably.

需要注意，当初始化参数O7_DICTIONARY_ACCESSIBILITY被设置为FALSE时，除了SYSDBA和DBA用户之外，即使用户具有SELECT ANY TABLE权限，也不能访问数据字典基表和数据字典视图DBA_*。

Unlimited Tablespace(System Privilege)和With Grant Option(Object Privilege)不能授予ROLE。不能在同一条GRANT语句中同时授予System Privilege和Object Privilege。

With Admin/Grant Option → System/Object Privileges → Revoke NoCascade/Cascade.

Privileges → Roles → Users. | 预定义角色是在创建数据库时，Oracle执行如下脚本时建立的。
SQL.BSQ(CONNECT、RESOURCE、DBA、EXECUTE_CATALOG_ROLE、SELECT_CATALOG_ROLE、DELETE_CATALOG_ROLE);
CATEXP.SQL(EXP_FULL_DATABASE、IMP_FULL_DATABASE)、CATALOG.SQL(RECOVERY_CATALOG_OWNER).

EXECUTE_CATALOG_ROLE: PL/SQL Package(DBMS_*)的Execute权限;SELECT_CATALOG_ROLE: Data Dictionary(DBA_*)的SELECT权限;DELETE_CATALOG_ROLE: SYS.AUD$上的DELETE权限.