ORACLE SQL 管理用户
第十三章:管理用户
用户的管理体现在两方面：
1.资源
2.权限
管理员才可以创建用户:
conn / as sysdba
conn system/oracle
创建数据库审核的用户:
create user test
identified by test --初始口令
default tablespace users --存储对象的默认表空间
temporary tablespace temp --用户作排序时使用的表空间
quota 10m on users --test用户在users表空间的空间限额
password expire; --初始口令过期，会提示用户重置口令
创建操作系统审核的用户:
SQL> show parameter os_authent_prefix
NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
os_authent_prefix string ops$
SQL> select osuser from v$session where username is not null;
OSUSER
------------------------------
oracle
create user ops$oracle
identified externally;
本地匿名，远程带口令
create user ops$oracle
identified by pwd123;
对用户授予系统权限:
grant create session,create table to u1;
查看用户被授予的系统权限:
conn / as sysdba
select * from DBA_SYS_PRIVS where GRANTEE='U1';
conn u1/u1
select * from session_privs;
对用户授予对象权限:
conn scott/tiger
grant select on emp to u1;
查看用户被授予的对象权限:
col GRANTEE for a15
col PRIVILEGE for a20
col owner for a15
SELECT GRANTEE,PRIVILEGE,OWNER,TABLE_NAME
FROM DBA_TAB_PRIVS
WHERE GRANTEE='U1';
select OWNER,TABLE_NAME,PRIVILEGE,COLUMN_NAME from dba_col_privs where GRANTEE='U1';
授权动作的扩展选项:
create user u2 identified by u2;
conn / as sysdba
grant create session to u1 with admin option;
grant select on scott.emp to u1 with grant option;
conn u1/u1
grant create session to u2;
grant select on scott.emp to u2;
with admin option VS with grant option
权限回收无级联 VS 权限回收有级联
查看用户的空间使用份额:
select * from dba_ts_quotas where username='U1';
修改用户的空间使用份额:
alter user U1 quota 20m on users;
alter user U1 quota 0 on users;
修改用户口令:
alter user u1 identified by pwd123;
权限的回收:
revoke create session,create table from test;
revoke select on scott.emp from test;
角色:一组权限的逻辑集合
create role r1;
grant create session to r1;
create role r2;
grant create table to r2;
grant r2 to r1;
create role r3;
grant create view to r3;
将角色授予用户:
grant r1,r3 to u1;
用户被授予的角色:
SELECT * FROM DBA_ROLE_PRIVS WHERE GRANTEE='U1';
角色被授予的角色:
SELECT * FROM ROLE_ROLE_PRIVS WHERE ROLE='R1';
角色被授予的系统权限:
select * from ROLE_SYS_PRIVS WHERE ROLE='CONNECT';
角色被授予的对象权限:
select * from ROLE_TAB_PRIVS WHERE ROLE='R1';
conn / as sysdba
alter user u1 default role all except r3;
conn u1/u1
set role all;
删除用户:
drop user u1 cascade;