SQL> select * from v$version; BANNER -------------------------------------------------------------------------------- Oracle?Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production PL/SQL Release 11.2.0.4.0 - Production CORE ? ? ?11.2.0.4.0 ? ? Production TNS for 64-bit?Windows: Version 11.2.0.4.0 - Production NLSRTL Version 11.2.0.4.0 – Production 創(chuàng)建對應(yīng)Schema和數(shù)據(jù)表。 SQL> create user a identified by a; User created SQL> create user b identified by b; User created SQL> grant connect, resource to a,b; Grant succeeded SQL> grant create procedure to a,b; Grant succeeded SQL> grant create synonym to a,b; Grant succeeded
在Schema A下面創(chuàng)建數(shù)據(jù)表和對應(yīng)操作存儲過程。
SQL> conn a/a@sicsdb Connected to Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 Connected as a SQL> create table a(col varchar2(10)); Table created SQL> create or replace procedure Proc(i_vc_name varchar2) is 2 ?begin 3 ? ?insert into a values (i_vc_name); 4 ? ?commit; 5 ?end Proc; 6 ?/ Procedure created
從Schema A進行調(diào)用動作:
SQL> exec proc('iii'); PL/SQL procedure successfully completed SQL> select * from a; COL ---------------------------------------- Iii SQL> grant execute on proc to b; Grant succeeded
另外創(chuàng)建Schema B數(shù)據(jù)表對象,并且包括同義詞對象。 SQL> conn b/b@sicsdb Connected to Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 Connected as b SQL> create table a(col varchar2(10)); Table created SQL> create synonym proc for a.proc; Synonym created 進行默認(rèn)情況測試,在Schema B中調(diào)用存儲過程proc,看操作數(shù)據(jù)表是哪張:
SQL> conn b/b@sicsdb Connected to Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 Connected as b SQL> exec proc('JJJ'); PL/SQL procedure successfully completed SQL> select * from a; COL ----------------------------------------
Schema B中數(shù)據(jù)表a沒有數(shù)據(jù),查看Schema A中數(shù)據(jù)表情況: SQL> select * from a.a; COL -------------------- JJJ Iii 實驗說明:在默認(rèn)情況下,不同Schema對象調(diào)用相同存儲過程,其中涉及到的對象都是相同的。也就是Oracle存儲過程中的“所有者權(quán)限”。一旦用戶擁有執(zhí)行存儲過程的權(quán)限,就意味著在執(zhí)行體中,使用的是執(zhí)行體所有者的權(quán)限體系。 那么這個問題似乎是沒有辦法。執(zhí)行體指向的是Schema A的數(shù)據(jù)表a。 3、測試實驗二 與所有者權(quán)限對應(yīng)的另一種模式是“調(diào)用者權(quán)限”。也就說,對用戶是否可以執(zhí)行該程序體中的對象,完全取決于執(zhí)行調(diào)用用戶系統(tǒng)權(quán)限和對象權(quán)限(注意:非角色權(quán)限)。 筆者一種猜想,如果應(yīng)用調(diào)用者權(quán)限,從執(zhí)行用戶權(quán)限角度看,是不是可以直接訪問自己Schema中的對象了。下面通過實驗進行證明。
SQL> conn a/a@sicsdb Connected to Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 Connected as a SQL> SQL> create or replace procedure Proc(i_vc_name varchar2) AUTHID CURRENT_USER is 2 ?begin 3 ? ?insert into a values (i_vc_name); 4 ? ?commit; 5 ?end Proc; 6 ?/ Procedure created
SQL> select * from v$version; BANNER -------------------------------------------------------------------------------- Oracle?Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production PL/SQL Release 11.2.0.4.0 - Production CORE ? ? ?11.2.0.4.0 ? ? Production TNS for 64-bit?Windows: Version 11.2.0.4.0 - Production NLSRTL Version 11.2.0.4.0 – Production 創(chuàng)建對應(yīng)Schema和數(shù)據(jù)表。 SQL> create user a identified by a; User created SQL> create user b identified by b; User created SQL> grant connect, resource to a,b; Grant succeeded SQL> grant create procedure to a,b; Grant succeeded SQL> grant create synonym to a,b; Grant succeeded
在Schema A下面創(chuàng)建數(shù)據(jù)表和對應(yīng)操作存儲過程。
SQL> conn a/a@sicsdb Connected to Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 Connected as a SQL> create table a(col varchar2(10)); Table created SQL> create or replace procedure Proc(i_vc_name varchar2) is 2 ?begin 3 ? ?insert into a values (i_vc_name); 4 ? ?commit; 5 ?end Proc; 6 ?/ Procedure created