Re: Access to LOB columns

You should only be able to update the LOB if you can lock the row - i.e. select for update.

You might try creating a view on the table with the clause:

    WITH READ ONLY and grant select rights on this to users, it may stop them from being able to
select rows for update. But that's just a guess.

--

Jonathan Lewis
Yet another Oracle-related web site:  http://www.jlcomp.demon.co.uk

puffinry_at_my-deja.com wrote in message <8qvkja$334$1_at_nnrp1.deja.com>...


>I have a database with two users, "admin" and

>"client".

>I have a table called DATA, owned by "admin".

>I want "client" to be able to read the data, so:

>

>CREATE SYNONYM client.DATA for admin.DATA;

>GRANT SELECT ON admin.DATA to client;

>

>For ordinary datatypes this approach works very

>well.

>However for any LOB (BLOB or CLOB), the client can

>SELECT the locator, and then use the locator to

>update

>the data (via OCI, JDBC, PL/SQL etc)

>

>That isn't what I wanted :-)

>Is there any way to allow some user to read from

>the locator,

>but not write to it?

>

> .robin.

>

>

>ps. As a workaround, I have a package owned by

>"admin",

>which can be executed by "client". I then only

>allow the client to SELECT from a restricted VIEW

>which excludes the LOB columns.  The client must

>use this package to read the LOB data. This is

>cumbersome, to say the least ;)

>

>

>Sent via Deja.com http://www.deja.com/

>Before you buy.