ORA-01720:grant option does not exist for '%s.%s'

这是什么问题?

01720, 00000, "grant option does not exist for '%s.%s'"

// *Cause:  A grant was being performed on a view or a view was being replaced

//          and the grant option was not present for an underlying object.

// *Action: Obtain the grant option on all underlying objects of the view or

//          revoke existing grants on the view.

翻译Cause部分:在对视图执行授权时,视图访问的基础对象没有指定grant option,就会出现ORA-01720错误。

什么时候会出问题?

查看Oracle 11g Release2官方文档路径:

Oracle Database Online Documentation 11g Release 2 (11.2)->Database Administration->Security->Security Guide->4 Configuring Privilege and Role Authorization->Managing Object Privileges->"Managing View Privileges"->Privileges Required to Create Views

翻译截图最后一段:在你授予其他用户访问视图的权限之前,必须对视图的基础对象使用GRANT OPTION子句或合适的系统权限并使用ADMIN OPTION子句。如果没有这些权限,则无法授予其他用户访问视图。如果尝试授予权限,则会引发ORA-01720: grant option does not exist for object_name错误,而object_name就是没有足够权限访问的视图底层对象。

重现问题

1)查看OE用户下的表,以OE用户下的表为基础对象

SYS@PROD>conn oe/oe

Connected.

OE@PROD>select table_name from user_tables;

TABLE_NAME

------------------------------

PRODUCT_INFORMATION

ORDERS

WAREHOUSES

PROMOTIONS

ORDER_ITEMS

SUBCATEGORY_REF_LIST_NESTEDTAB

PRODUCT_REF_LIST_NESTEDTAB

PRODUCT_DESCRIPTIONS

INVENTORIES

CUSTOMERS

10 rows selected.

2)为hr用户赋予访问oe.orders表的权限

OE@PROD>grant select on oe.orders to hr;

Grant succeeded.

3)在hr用户下创建一个视图orders,用于访问oe.orders

SYS@PROD>conn hr/hr

Connected.

HR@PROD>create view orders as select * from oe.orders;

View created.

(4)这里引入第三个用户sh,赋予sh用户访问视图orders的权限

HR@PROD>grant select on orders to sh;

grant select on orders to sh

                *

ERROR at line 1:

ORA-01720: grant option does not exist for 'OE.ORDERS'

至此,问题已经重现。这里引入了3个用户oehrsh,以oe.orders表为基表,在hr用户下创建视图orders,用于查询oe.orders表。当赋予sh用户访问视图hr.orders的时候,出现了ORA-01720错误。

解决问题

引用官方文档的说法:

before you can grant other users access to you view, you must have object privileges to the base objects with the GRANT OPTION clause or appropriate system privileges with the ADMIN OPTION clause

所以,只要对视图所在的用户赋予访问基础对象权限时,加上GRANT OPTION或者ADMIN OPTION子句,就可以解决问题。这里两个子句的区别如下:

- with admin option 只能在赋予 system privilege 的时使用

- with grant option 只能在赋予 object privilege 的时使用

我们这里测试的是object privilege,所以使用with grant option子句即可。

这里继续上面出现ORA-01720错误之后的操作:

(5)切换到oe用户,为hr用户赋予访问oe.orders表的权限,加上GRANT OPTION子句

HR@PROD>conn oe/oe

Connected.

OE@PROD>grant select on oe.orders to hr with grant option;   (解决问题的关键性语句

Grant succeeded.

(6)切换到hr用户,赋予sh用户访问视图orders的权限

OE@PROD>conn hr/hr

Connected.

HR@PROD>grant select on orders to sh;

Grant succeeded.

显然,赋权限操作成功执行。

(7)切换到sh用户,执行一次查询操作,验证权限的可用性。

HR@PROD>conn sh/sh

Connected.

SH@PROD>select count(*) from hr.orders;

  COUNT(*)

----------

105

所以,一般情况下,只要在创建视图之前赋权限的语句中加上with grant option子句,就可以避免出现ORA-01720错误;如果是系统权限,在创建视图之前赋权限的语句中加上with admin option子句,就可以避免出现ORA-01720错误。

猜你喜欢

转载自www.linuxidc.com/Linux/2017-10/147439.htm