管理Oracle的用戶、權限ppt課件

1、管理用戶、權限.權限的分類管理系統(tǒng)權限：在系統(tǒng)級控制數據庫的存取和運用機制，它普通是針對某一類方案對象或非方案對象某種操作的全局性才干。對象權限：指在對象級控制數據庫的存取和運用機制，即訪問其他用戶的方案對象才干。DBMS實現數據庫平安維護的過程： 1、DBA或對象的創(chuàng)建者經過授權語句，把授予/回收權限的定義通知DBMS 2、DBMS把授予/回收權限的結果保管在數據字典中 3、當用戶提出操作懇求時，DBMS根據數據字典中保管的權限定義進展檢查，來決議能否允許用戶執(zhí)行該操作.系統(tǒng)權限的分類CategoryExamples INDEXCREATE ANY INDEXALTER ANY INDEXD

2、ROP ANY INDEX TABLE CREATE TABLECREATE ANY TABLEALTER ANY TABLEDROP ANY TABLESELECT ANY TABLEUPDATE ANY TABLEDELETE ANY TABLESESSIONCREATE SESSIONALTER SESSIONRESTRICTED SESSIONTABLESPACECREATE TABLESPACEALTER TABLESPACEDROP TABLESPACEUNLIMITED TABLESPACE每種系統(tǒng)權限都為用戶提供類執(zhí)行某一種或某一類系統(tǒng)級的數據庫操作權益，數據字典視圖syste

3、m_privilege_map中包括了Oracle數據庫的一切系統(tǒng)權限.授予/回收系統(tǒng)權限REVOKE CREATE TABLE FROM emi;GRANT CREATE SESSION TO emi;GRANT CREATE SESSION TO emi WITH ADMIN OPTION;DBAGRANTREVOKEJeffEmiJeffEmiDBA.對象權限Oracle數據庫的方案對象主要有：表、索引、視圖、序列、同義詞、過程、函數包和觸發(fā)器創(chuàng)建對象的用戶擁有該對象的一切對象權限，不需求授予。所以，對象權限的設置實踐上是為對象的一切者給其他用戶提供操作該對象的某種權益才干GRANT o

4、bject_privilege (column_list) , object_privilege (column_list) .|ALL PRIVILEGESONschema.objectTOuser|role|PUBLIC, user|role|PUBLIC .WITH GRANT OPTIONGRANT EXECUTE ON dbms_output TO jeff;GRANT UPDATE ON emi.customers TO jeff WITH GRANT OPTION;.回收對象權限REVOKE object_privilege, object_privilege .| ALL PR

5、IVILEGES ONschema.objectFROM user|role|PUBLIC, user|role|PUBLIC .CASCADE CONSTRAINTSGRANTREVOKEBobJeffEmiEmiJeffBobREVOKE SELECT ON emi.orders FROM jeff;.數據庫權限審計Parameter file Specify audit optionsDatabaseAudit trailAudit optionsEnable database auditingDBAUserExecute commandGenerate audit trailRevie

6、w audit informationServerprocessOS audit trail.管理角色UsersPrivilegesRolesUPDATE ON JOBSINSERT ONJOBS SELECT ONJOBS CREATE TABLECREATE SESSIONHR_CLERKHR_MGRABC.創(chuàng)建/修正角色CREATE ROLE oe_clerk;CREATE ROLE hr_clerk IDENTIFIED BY bonus;CREATE ROLE hr_managerIDENTIFIED EXTERNALLY;ALTER ROLE hr_clerkIDENTIFIED

7、EXTERNALLY;ALTER ROLE hr_managerNOT IDENTIFIED;ALTER ROLE oe_clerk IDENTIFIED BY order;GRANT hr_clerk TO hr_manager;GRANT oe_clerk TO scott;GRANT hr_manager TO scott WITH ADMIN OPTION;.角色分類人事管理工資管理HR_MANAGERHR_CLERKPAY_CLERKUserrolesApplicationrolesApplicationprivilegesUsers管理工資權限管理人事權限.管理用戶Accountl

8、ockingTablespacequotasTemporarytablespaceDefaulttablespaceRoleprivilegesResourcelimitsSecuritydomainDirectprivilegesAuthenticationmechanism方案對象TablesTriggersConstraintsIndexesViewsSequencesStored program unitsSynonymsUser-defined data typesDatabase links.創(chuàng)建用戶CREATE USER aaronIDENTIFIED BY soccerDEFAULT TABLESPACE dataTEMPORARY TABLESPACE tempAccount unlockQUOTA 15m ON dataPASSWORD EXPIRE;ALTER USER aa