Oracle FAQ Your Portal to the Oracle Knowledge Grid
HOME | ASK QUESTION | ADD INFO | SEARCH | E-MAIL US
 

Home -> Community -> Mailing Lists -> Oracle-L -> RE: Re[2]: What Sort of Privilege?

RE: Re[2]: What Sort of Privilege?

From: Mark W. Farnham <mwf_at_rsiz.com>
Date: Wed, 25 Aug 2004 08:22:55 -0400
Message-ID: <KNEIIDHFLNJDHOOCFCDKMEDGFEAA.mwf@rsiz.com> 





One log on for use has been in place for some time. So "apps" gets all the
synonyms, views, packages, and all important cross schema grants, but there
are still many schema owners so the purpose of various tables and the
architecture of individual product groups has some chance of being an
understandable total.



The big advance was from logging on, as, say PO, to use purchasing, and
therefore needing grants to PO for various other schema' objects. As the
number of schema owners grew, figuring out the required grants was a
nightmare and the number of dictionary entries to support the grants for
each applications schema grew on the order of some exponential or factorial
based on the number of schema owners and the number of tables and packages
in each schema needing access from other schemas. When it got bad enough,
creating a single log on user at least got the number of dictionary entries
down to linear growth based on the total number of tables.



(My apologies if you get cold sweats in remembrance of these exponential
number of grants nightmares, which you've likely suppressed as well as
you're able.)



Now, as for whether there is a move afoot to actually migrate to a single
schema, I'm guessing that would cause major heartburn in lieu of an alter
table clause that changed the schema of a table on the order of expense of
updating the dictionary and invalidating dependent security references as
needed. I don't think that exists. Too many pages in the manual to be sure,
but I scanned alter table and checked for the non-existance (to my ability
to search) of alter owner. I'm not sure what else it might get named.



Then again I may have missed a message on a direction.



mwf



-----Original Message-----



From: oracle-l-bounce_at_freelists.org


[mailto:oracle-l-bounce_at_freelists.org]On Behalf Of Cary Millsap
Sent: Tuesday, August 24, 2004 10:35 AM


To: oracle-l_at_freelists.org


Subject: RE: Re[2]: What Sort of Privilege?




Aren't the new Oracle E-Business applications moving to a
single-schema-for-everything model?




Cary Millsap


Hotsos Enterprises, Ltd.


http://www.hotsos.com


* Nullius in verba *



Upcoming events:


- Performance Diagnosis 101: 9/14 San Francisco, 10/5 Charlotte, 10/26
Toronto

- SQL Optimization 101: 8/16 Minneapolis, 9/20 Hartford, 10/18 New Orleans
- Hotsos Symposium 2005: March 6-10 Dallas
- Visit www.hotsos.com for schedule details...






-----Original Message-----



From: oracle-l-bounce_at_freelists.org [mailto:oracle-l-bounce_at_freelists.org]
On Behalf Of Goulet, Dick


Sent: Tuesday, August 24, 2004 8:50 AM


To: oracle-l_at_freelists.org


Subject: RE: Re[2]: What Sort of Privilege?



On this issue it would appear so!!  ;-)



Dick Goulet


Senior Oracle DBA


Oracle Certified 8i DBA



-----Original Message-----



From: Mercadante, Thomas F [mailto:thomas.mercadante_at_labor.state.ny.us]
Sent: Tuesday, August 24, 2004 9:16 AM


To: 'oracle-l_at_freelists.org'


Subject: RE: Re[2]: What Sort of Privilege?




Dick,



Am I 100% wrong?  :)



Tom Mercadante


Oracle Certified Professional




-----Original Message-----



From: Goulet, Dick [mailto:DGoulet_at_vicr.com]=20
Sent: Tuesday, August 24, 2004 9:12 AM


To: oracle-l_at_freelists.org


Subject: RE: Re[2]: What Sort of Privilege?




Tom,



        Sorry, but you are wrong.  I prefer the many schema method as well.



Dick Goulet


Senior Oracle DBA


Oracle Certified 8i DBA



-----Original Message-----



From: Mercadante, Thomas F [mailto:thomas.mercadante_at_labor.state.ny.us]
Sent: Tuesday, August 24, 2004 8:21 AM


To: 'oracle-l_at_freelists.org'


Subject: RE: Re[2]: What Sort of Privilege?




Jo,



Well,  The Oracle Apps applications have many schema's - much like what =
=3D


you described. I'm guessing that the majority of home-grown applications
have only one schema for all of the tables.  I could be wrong.  In my =
view,


it is =3D easier to manage.  Everything is in one place.  It prevents =
you from


creating =3D two database objects with the same name.  Managing security =
is


easier - =3D again, you can issue all your grants from one schema, =
rather than


needing to =3D keep re-logging in.



Maybe it's just me!



Tom Mercadante


Oracle Certified Professional




-----Original Message-----



From: jo_holvoet_at_amis.com [mailto:jo_holvoet_at_amis.com]=3D20
Sent: Tuesday, August 24, 2004 8:13 AM


To: oracle-l_at_freelists.org


Cc: 'oracle-l_at_freelists.org'; oracle-l-bounce_at_freelists.org
Subject: RE: Re[2]: What Sort of Privilege?




Hi Tom,



we (well, it was in place before I got here, but anyway) basically =
have=3D20


one schema per application. We also have one schema which houses =3D
"common"=3D20 data, i.e. data used in many different places/apps; e.g.
employees,=3D20 customers, products, plants, .... So we have many =
cross-schema


FKs to =3D the=3D20 "common" data but outside that everything is pretty =
well


partitioned.=3D20 Maybe that's why I've never really had any problems =
with it.



Is having what is basically a one-schema database common practice ?



mvg/regards



Jo








"Mercadante, Thomas F" <thomas.mercadante_at_labor.state.ny.us>
Sent by: oracle-l-bounce_at_freelists.org


08/24/2004 14:03


Please respond to oracle-l



=3D20

        To:     "'oracle-l_at_freelists.org'" <oracle-l_at_freelists.org>
        cc:=3D20
        Subject:        RE: Re[2]: What Sort of Privilege?






Jo,



I guess I should clarify.



If you made a consious decision to maintain multiple schema's within =3D =
your


database, then it is your choice.



I prefer one schema holding all of the database tables that make up the
corporate-wide application.



Tom Mercadante


Oracle Certified Professional




-----Original Message-----



From: jo_holvoet_at_amis.com [mailto:jo_holvoet_at_amis.com]=3D20
Sent: Tuesday, August 24, 2004 7:58 AM


To: oracle-l_at_freelists.org


Cc: 'oracle-l_at_freelists.org'; oracle-l-bounce_at_freelists.org
Subject: RE: Re[2]: What Sort of Privilege?




Not sure about that. We have for example an employee table that is=3D20
referenced just about everywhere (e.g. which salesperson is =
responsible=3D20


for this customer, which employee registered for this training =
course,=3D20


which operator filed this incident report, ...). These are all different =
=3D



apps/schemas referencing this table so I don't see how we can avoid=3D20
cross-schema FKs.



mvg/regards



Jo








"Mercadante, Thomas F" <thomas.mercadante_at_labor.state.ny.us>
Sent by: oracle-l-bounce_at_freelists.org


08/24/2004 13:49


Please respond to oracle-l



=3D20

        To:     "'oracle-l_at_freelists.org'" <oracle-l_at_freelists.org>
        cc:=3D20
        Subject:        RE: Re[2]: What Sort of Privilege?






Peter,



I totally agree with you.  Allowing Fk references from outside of =
the=3D20


schema is inviting confusion, duplication and disaster.  There is really =
no


=3D good reason for it.



Tom Mercadante


Oracle Certified Professional




-----Original Message-----



From: Peter Robson [mailto:pgro_at_bgs.ac.uk]=3D20
Sent: Tuesday, August 24, 2004 4:57 AM


To: Jackie Brock


Cc: oracle-l_at_freelists.org


Subject: Re[2]: What Sort of Privilege?




Whoa there everybody!



While the answer is quite correct, of course (I read the FM years =
ago),=3D20


what has not been raised is the danger of allowing reference to multiply
unhindered across numerous schemas.



Be very careful if you choose to do this, otherwise, without a =
little=3D20


care, you may manage to lock your entire database solid with conflicting
FKs!



We did, learned our lesson, and now reference is ONLY permitted within =
=3D the


one corporate schema.




peter


edinburgh


.............




JB> references




JB> All,



JB> what kind of privilege new for creating a FK constraint which=3D20=20
JB> reference table belongs to another schema.


JB> ALTER TABLE PAM.table1
JB>  ADD CONSTRAINT FKCONS1
JB>  FOREIGN KEY (ID)
JB>  REFERENCES schema1.table2 (ID2);





JB> I have grant select,insert,update,delete for table2 BUT still I=20
JB> get=3D20 insufficient privilege. any idea?




JB> Hamid Alavi




--=3D20


    mailto:pgro_at_bgs.ac.uk







This  e-mail  message,  and  any  files  transmitted  with  it, are
confidential  and intended  solely for the  use of the  addressee. If =
=3D this


message was not addressed to  you, you have received it in error and any
copying,  distribution  or  other use  of any part  of it is strictly
prohibited. Any views or opinions presented are solely those of the =3D =
sender


and do not necessarily represent  those of the British Geological  =3D =
Survey.


The  security of e-mail  communication  cannot be guaranteed and the BGS
accepts no liability  for claims arising as a result of the use of this
medium to  transmit messages from or to the

BGS. .                            http://www.bgs.ac.uk
*********************************************************************



----------------------------------------------------------------



Please see the official ORACLE-L FAQ: http://www.orafaq.com




To unsubscribe send email to:  oracle-l-request_at_freelists.org put
'unsubscribe' in the subject line.

--
Archives are at http://www.freelists.org/archives/oracle-l/
FAQ is at http://www.freelists.org/help/fom-serve/cache/1.html


-----------------------------------------------------------------

----------------------------------------------------------------

Please see the official ORACLE-L FAQ: http://www.orafaq.com


----------------------------------------------------------------

To unsubscribe send email to:  oracle-l-request_at_freelists.org put
'unsubscribe' in the subject line.
--
Archives are at http://www.freelists.org/archives/oracle-l/
FAQ is at http://www.freelists.org/help/fom-serve/cache/1.html


-----------------------------------------------------------------






----------------------------------------------------------------

Please see the official ORACLE-L FAQ: http://www.orafaq.com


----------------------------------------------------------------

To unsubscribe send email to:  oracle-l-request_at_freelists.org put
'unsubscribe' in the subject line.
--
Archives are at http://www.freelists.org/archives/oracle-l/
FAQ is at http://www.freelists.org/help/fom-serve/cache/1.html


-----------------------------------------------------------------

----------------------------------------------------------------

Please see the official ORACLE-L FAQ: http://www.orafaq.com


----------------------------------------------------------------

To unsubscribe send email to:  oracle-l-request_at_freelists.org put
'unsubscribe' in the subject line.
--
Archives are at http://www.freelists.org/archives/oracle-l/
FAQ is at http://www.freelists.org/help/fom-serve/cache/1.html


-----------------------------------------------------------------






----------------------------------------------------------------

Please see the official ORACLE-L FAQ: http://www.orafaq.com


----------------------------------------------------------------

To unsubscribe send email to:  oracle-l-request_at_freelists.org put
'unsubscribe' in the subject line.
--
Archives are at http://www.freelists.org/archives/oracle-l/
FAQ is at http://www.freelists.org/help/fom-serve/cache/1.html


-----------------------------------------------------------------

----------------------------------------------------------------

Please see the official ORACLE-L FAQ: http://www.orafaq.com


----------------------------------------------------------------

To unsubscribe send email to:  oracle-l-request_at_freelists.org put
'unsubscribe' in the subject line.
--
Archives are at http://www.freelists.org/archives/oracle-l/
FAQ is at http://www.freelists.org/help/fom-serve/cache/1.html


-----------------------------------------------------------------

----------------------------------------------------------------

Please see the official ORACLE-L FAQ: http://www.orafaq.com


----------------------------------------------------------------

To unsubscribe send email to:  oracle-l-request_at_freelists.org put
'unsubscribe' in the subject line.
--
Archives are at http://www.freelists.org/archives/oracle-l/
FAQ is at http://www.freelists.org/help/fom-serve/cache/1.html


-----------------------------------------------------------------

----------------------------------------------------------------

Please see the official ORACLE-L FAQ: http://www.orafaq.com


----------------------------------------------------------------

To unsubscribe send email to:  oracle-l-request_at_freelists.org
put 'unsubscribe' in the subject line.
--
Archives are at http://www.freelists.org/archives/oracle-l/
FAQ is at http://www.freelists.org/help/fom-serve/cache/1.html


-----------------------------------------------------------------

----------------------------------------------------------------

Please see the official ORACLE-L FAQ: http://www.orafaq.com


----------------------------------------------------------------

To unsubscribe send email to:  oracle-l-request_at_freelists.org
put 'unsubscribe' in the subject line.
--
Archives are at http://www.freelists.org/archives/oracle-l/
FAQ is at http://www.freelists.org/help/fom-serve/cache/1.html


-----------------------------------------------------------------




----------------------------------------------------------------

Please see the official ORACLE-L FAQ: http://www.orafaq.com


----------------------------------------------------------------

To unsubscribe send email to:  oracle-l-request_at_freelists.org
put 'unsubscribe' in the subject line.
--
Archives are at http://www.freelists.org/archives/oracle-l/
FAQ is at http://www.freelists.org/help/fom-serve/cache/1.html


-----------------------------------------------------------------





----------------------------------------------------------------

Please see the official ORACLE-L FAQ: http://www.orafaq.com


----------------------------------------------------------------

To unsubscribe send email to:  oracle-l-request_at_freelists.org
put 'unsubscribe' in the subject line.
--
Archives are at http://www.freelists.org/archives/oracle-l/
FAQ is at http://www.freelists.org/help/fom-serve/cache/1.html


-----------------------------------------------------------------



Received on Wed Aug 25 2004 - 07:20:45 CDT












Original text of this message













  HOME |
  ASK QUESTION |
  ADD INFO |
  SEARCH |
  E-MAIL US