oracle回收ddl权限,oracle禁止指定用户DDL操作触发器

出于安全性或避免影响性能的考虑，在产品数据库中有时候会禁止或者在一定时间段内限制DDL语句的发生。Oracle也提高了很多方法来实现这个功能，这个简单介绍一下。

这篇介绍利用触发器来限制DDL语句。

我们用3个用户举例，test 用户不受触发器限制，test2用户和test3 用户受触发器限制，不允许DDL操作

SQL> create user

test identified by test;

User created.

SQL> create user

test2 identified by test2;

User created.

SQL> create user

test3 identified by test3;

User created.

SQL> grant

connect,resource to test,test2,test3;

Grant succeeded.

分别在3个用户下创建一个表

SYS@test>conn

test/test

Connected.

TEST@test>create

table t (id int);

Table created.

TEST@test>conn

test2/test2

Connected.

TEST2@test>create

table t (id int);

Table created.

TEST2@test>conn

test3/test3

Connected.

TEST3@test>create

table t (id int);

Table created.

试下看看能不能做ddl操作

TEST3@test>conn

test/test

Connected.

TEST@test>alter

table t add (name int);

Table altered.

TEST@test>conn

test2/test2

Connected.

TEST2@test>alter

table t add (name int);

Table altered.

TEST2@test>conn

test3/test3

Connected.

TEST3@test>alter

table t add (name int);

Table altered.

由此看出3个用户目前都能做DDL操作

下面创建触发器。使当test做DDL操作时候数据不报错。test2，test3做DDL操作数据库报错，不允许做ddl操作

创建触发器

TEST3@test>conn /

as sysdba

Connected.

SYS@test>CREATE

or  replace TRIGGER ddl_trigger

2

before ddl on database

3

declare

4  n

number;

5

l_trace  number;

6

BEGIN

7  if

ora_dict_obj_owner() = 'TEST2'  then

8

raise_application_error(-20001,'You can not execute ddl  on

'|| ora_dict_obj_name );

9

elsif ora_dict_obj_owner() = 'TEST3' then

10

raise_application_error(-20001,'You can not execute ddl  on

'|| ora_dict_obj_name );

11  end

if ;

12  END;

13  /

Trigger created.

下面分别在3个用户做测试。

SYS@test>conn

test/test

Connected.

TEST@test>alter

table t add (com int);

Table altered.

在test用户下没有问题

在test2.test3，用户下数据库都报错，禁止DDL操作

TEST@test>conn

test2/test2

Connected.

TEST2@test>alter

table t add (com int);

alter table t add

(com int)

*

ERROR at line 1:

ORA-00604: error

occurred at recursive SQL level 1

ORA-20001: You can

not execute ddl  on    T

ORA-06512: at line 6

TEST2@test>conn

test3/test3

Connected.

TEST3@test>alter

table t add (com int);

alter table t add

(com int)

*

ERROR at line 1:

ORA-00604: error

occurred at recursive SQL level 1

ORA-20001: You can

not execute ddl  on    T

ORA-06512: at line 8

以下是触发器全部内容，供大家参考

CREATE or  replace TRIGGER ddl_trigger

before ddl on

database

declare

n number;

l_trace  number;

BEGIN

if

ora_dict_obj_owner() = 'TEST2'  then

raise_application_error(-20001,'You

can not execute ddl  on    '|| ora_dict_obj_name );

elsif

ora_dict_obj_owner() = 'TEST3'

then

raise_application_error(-20001,'You

can not execute ddl  on    '|| ora_dict_obj_name );

end if ;

END;

/