Using SET CURRENT_SCHEMA for DDL and DCL
- From: Hemant K Chitale <hemantkchitale@xxxxxxxxx>
- To: ORACLE-L <oracle-l@xxxxxxxxxxxxx>
- Date: Sun, 16 Nov 2014 23:23:10 +0800
I am familiar with ALTER SESSION SET CURRENT_SCHEMA to define the scope for
all queries and DML in a current session. Thus schema "OWNER" can grant
privileges to account "USER" and account "USER" can login as himself and
invoke ALTER SESSION SET CURRENT_SCHEMA to define the scope for
object-resolution without using Synonyms.
Have you seen or would you condone this :
CONNECT / AS SYSDBA
ALTER SESSION SET CURRENT_SCHEMA = 'HEMANT'
CREATE TABLE XYZ
GRANT SELECT ON XYZ TO 'CHITALE'
Such that
a. The DBA does not need the password for 'HEMANT'
b. The DBA expects the table XYZ to be created in the 'HEMANT' schema
c. The DBA expects HEMANT to grant SELECT privilege to CHITALE
Frankly, I am uncomfortable with this as it doesn't seem proper. I would
rather have the DBA get the password for the 'HEMANT' account from the
password vault and login as HEMANT to execute the CREATE and GRANT commands.
What is your opinion ?
--
Hemant K Chitale
http://hemantoracledba.blogspot.com
http://hemantscribbles.blogspot.com
Other related posts:
