oracle 用户管理

系统权限： 回收时不会产生级联回收

conn / as sysdba;
create user t1 identified by t1;
create user t2 identified by t2;
grant connect to t1,t2;
grant create table, create view to t1 with admin option;
conn t1/t1
grant create table to t2;
conn / as sysdba;
select * from dba_sys_privs where grantee in('T1', 'T2');
GRANTEE PRIVILEGE ADM
------------------------------ ---------------------------------------- ---
T1 CREATE TABLE YES
T1 CREATE VIEW YES
T2 CREATE TABLE NO
with admin option 可使被授予权限者有权转授其他人。

revoke create table, create view from t1;
select * from dba_sys_privs where grantee in('T1', 'T2');
GRANTEE PRIVILEGE ADM
------------------------------ ---------------------------------------- ---
T2 CREATE TABLE NO
不会级联删除已经授予的系统权限。

 

    

对象权限：级联回收所有权限
conn test/test
grant select on t to t1 with grant option;
conn t1/t1
grant select on test.t to t2;
conn test/test
select * from dba_tab_privs where grantee in('T1', 'T2');
GRANTEE OWNER TABLE_NAME GRANTOR PRIVILEGE
------------------------------ ------------------------------ ------------------------------ ------- --------------------------------
T2 TEST T T1 SELECT
T1 TEST T TEST SELECT
revoke select on t from t1;
select * from dba_tab_privs where grantee in('T1', 'T2');
SQL> select * from dba_tab_privs where grantee in('T1', 'T2');
　　
级联删除已经授予的对象权限。

角色权限：级联回收所有权限

create role ttt;
grant create table, create user, create session to ttt with admin option;
grant select on test.t to ttt with grant option;
SQL> grant select on test.t to ttt with grant option;
grant select on test.t to ttt with grant option
ORA-01926:

 

无法使用with grant option选项给角色授权。

grant select on test.t to ttt;
create user d identified by d;
create user e identified by e;
grant ttt to d with admin option;
conn d/d
grant ttt to e;
select * from test.t;
SQL> select * from test.t;

conn / as sysdba
select * from dba_role_privs where grantee in('D', 'E');

GRANTEE GRANTED_ROLE ADM DEF
------------------------------ ------------------------------ --- ---
E TTT NO YES
D TTT YES YES
drop role ttt;  --级联回收。
select * from dba_role_privs where grantee in('D', 'E');
SQL> select * from dba_role_privs where grantee in('D', 'E');

conn d/d
SQL> conn d/d
ERROR: