Re: Schema management

I like to have a project owner and a project user account for all projects. Of course if I can convince the project developer that it's ok to have several projects in the same schema I will since it saves me the hassle of managing more unnescessary accounts. In your situation you could easily set up another account that has select,insert, update, and delete privileges on the two schemas then create public or private synonyms to the tables and the developers will be able to access all the tables from one account. I also like having a read only account and suggest you set it up for the people that you want to allow on but don't want them changing data.

I'm interested in seeing any docs on this too.

Dave Turner

On Fri, Oct 06, 2000 at 11:35:41AM -0800, Bill Becker wrote:
> Hello,
>
> I am seeking advice on how to organize schema security
> within an Oracle instance. Currently, we tend to divide
> schemas by application usage (all of appA's objects are
> owned by appA_owner, appB's objects are owned by appB_owner,
> etc.) The main problem with this is that there is a frequent
> need to cross schema boundaries for applications or processes
> that affect data owned by several different owners.
>
> The suggestion has been made to have a single owner that
> owns everything, and to control access to developers and
> users entirely thru roles. System-wide processes/applications
> would be run under this owner's privs; other proceses/applications
> more narrow in scope would have their privileges determined
> entirely thru roles.
>
> I am wondering what other solutions exist. Is there an accepted
> practice which most people follow? Can anyone point me to some
> documentation describing a good solution for managing schemas?
>
> Oracle 8.1.6 on Solaris 2.7
>
> Thanks to any who respond.
> beckerb_at_dgabby.mfldclin.edu
> --
> Please see the official ORACLE-L FAQ: http://www.orafaq.com
> --
> Author: Bill Becker
> INET: beckerb_at_mfldclin.edu
>
> Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051
> San Diego, California -- Public Internet access / Mailing Lists
> --------------------------------------------------------------------
> To REMOVE yourself from this mailing list, send an E-Mail message
> to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
> the message BODY, include a line containing: UNSUB ORACLE-L
> (or the name of mailing list you want to be removed from). You may
> also send the HELP command for other information (like subscribing).
Received on Fri Oct 06 2000 - 16:20:34 CDT