About with admin option and with grant option

Hello, friends of Tencent cloud community .

Studying recently SQL, About WITH ADMIN OPTION and WITH GRANT OPTION What's the difference .

Follow me!

1. Database permission concept

jurisdiction Privileges Is the permission to execute specific statements .

Database security includes system security and data security .

System permissions ： Gain access to the database , And can perform specific DDL operation （ System security ）.

Object permissions ： Dealing with the contents of database objects such as SELECT UPDATE INSERT.....（ Data security ）.

programme / Pattern （SCHEMA）： A collection of objects , Such as table 、 View 、 A collection of sequences and synonyms . also SCHEMA and USER It's the same name .

By using DCL Language empowers users (GRANT), And revoke permissions (REVOKE)

User's system permissions ：

CREATE SESSION Create a session

CREATE TABLE Create table

CREATE SEQUENCE Create sequence

CREATE VIEW Create view

CREATE PROCEDURE Create stored procedure

WITH ADMIN OPTION Used for system permission authorization ,WITH GRANT OPTION Used for object permission authorization .

Next, we will thoroughly understand the difference between the two authorizations through a small experiment .

2. The experiment

a. Environmental preparation

-- Create two users and assign passwords to ensure that the user is not locked , And view the user's system permissions 
CREATE USER a IDENTIFIED BY oracle ACCOUNT UNLOCK;
CREATE USER b IDENTIFIED BY oracle ACCOUNT UNLOCK;
-- View user permissions 
[email protected]:1521/ORCLPDB>select GRANTEE,PRIVILEGE from dba_sys_privs where GRANTEE='A';
no rows selected
[email protected]:1521/ORCLPDB>select GRANTEE,PRIVILEGE from dba_sys_privs where GRANTEE='B';
no rows selected
-- The newly created user does not have any permissions 

b.WITH ADMIN OPTION Authority experiment

-- Grant create session permission to A user 
[email protected]:1521/ORCLPDB>GRANT CREATE SESSION TO a WITH ADMIN OPTION;
Grant succeeded.
[email protected]:1521/ORCLPDB>select GRANTEE,PRIVILEGE from dba_sys_privs where GRANTEE='A';
G PRIVILEGE
- ----------------------------------------
A CREATE SESSION

-- Even on A Users will CREATE SESSION Authority granted to B user 
[email protected]:1521/ORCLPDB>conn a/[email protected]:1521/ORCLPDB
Connected.
[email protected]:1521/ORCLPDB>GRANT CREATE SESSION TO b;
Grant succeeded.

-- At this point to see A and B User's rights （ In possession of DBA Query under authorized users , I am here sys user ）
[email protected]:1521/ORCLPDB>select GRANTEE,PRIVILEGE from dba_sys_privs where GRANTEE in ('A','B');
GRANT PRIVILEGE
----- ----------------------------------------
A     CREATE SESSION
B     CREATE SESSION

-- here A and B Have the permission to create a session , Test whether you can log in 
[email protected]:1521/ORCLPDB>conn a/[email protected]:1521/ORCLPDB
Connected.
[email protected]:1521/ORCLPDB>show user
USER is "A"
[email protected]:1521/ORCLPDB>conn b/[email protected]:1521/ORCLPDB
Connected.
[email protected]:1521/ORCLPDB>show user
USER is "B"

--A and B Users can log in normally , At this time will be A Withdrawal of authority 
[email protected]:1521/ORCLPDB>REVOKE CREATE SESSION FROM A;
Revoke succeeded.
[email protected]:1521/ORCLPDB>select GRANTEE,PRIVILEGE from dba_sys_privs where GRANTEE in ('A','B');
GRANT PRIVILEGE
----- ----------------------------------------
B     CREATE SESSION

-- here A Your permission has been revoked ,B Your permission is still . Test it A,B Login status of 
[email protected]:1521/ORCLPDB>conn a/[email protected]:1521/ORCLPDB
ERROR:
ORA-01045: user A lacks CREATE SESSION privilege; logon denied
Warning: You are no longer connected to ORACLE.
@>conn b/[email protected]:1521/ORCLPDB
Connected.
[email protected]:1521/ORCLPDB>

We found that A User CREATE SESSION System permission is revoked , however B User CREATE SESSION The system permission has not been revoked

c.WITH GRAT OPTION Authority experiment

-- grant A user CREATE SESSION
[email protected]:1521/ORCLPDB>GRANT CREATE SESSION TO a;
Grant succeeded.
[email protected]:1521/ORCLPDB>select GRANTEE,PRIVILEGE from dba_sys_privs where GRANTEE in ('A','B');
GRANT PRIVILEGE
----- ----------------------------------------
A     CREATE SESSION
B     CREATE SESSION

-- Sign in HR user , take EMPLOYEES Tabular SELECT Authority granted to A user , Additionally endowed WITH GRANT OPTION
[email protected]:1521/ORCLPDB>conn hr/[email protected]:1521/ORCLPDB
Connected.
[email protected]:1521/ORCLPDB>GRANT SELECT ON  EMPLOYEES TO a WITH GRANT OPTION;
Grant succeeded.
[email protected]:1521/ORCLPDB>select GRANTOR,OWNER,TABLE_NAME,PRIVILEGE from user_tab_privs where GRANTOR ='A';

GRANTOR    OWNER      TABLE_NAME           PRIVILEGE
---------- ---------- -------------------- ----------------------------------------
A          HR         EMPLOYEES            SELECT

-- Log in to A Users will EMPLOYEES Of SELECT Authority granted to B user , And query A,B The user rights of 
[email protected]:1521/ORCLPDB>GRANT SELECT ON HR.EMPLOYEES TO b;
Grant succeeded.

-- Log in to B The user query authorizer is A The entry of 
[email protected]:1521/ORCLPDB>conn b/[email protected]:1521/ORCLPDB
Connected.
[email protected]:1521/ORCLPDB>select GRANTOR,OWNER,TABLE_NAME,PRIVILEGE from user_tab_privs where GRANTOR ='A';

GRANTOR    OWNER      TABLE_NAME           PRIVILEGE
---------- ---------- -------------------- ----------------------------------------
A          HR         EMPLOYEES            SELECT

-- Here it is B I saw a message on the website that the authorizer is A, The object is HR.EMPLOYEES The table of SELECT jurisdiction . There is nothing wrong with testing permissions .
[email protected]:1521/ORCLPDB>select * from hr.employees;

-- Sign in HR The user withdraws HR.EMPLOYEES Of SELECT jurisdiction 
[email protected]:1521/ORCLPDB>REVOKE SELECT ON EMPLOYEES FROM a;
Revoke succeeded.

-- Re examination A.B Authority 
[email protected]:1521/ORCLPDB>select GRANTOR,OWNER,TABLE_NAME,PRIVILEGE from user_tab_privs where GRANTOR ='A';
no rows selected
[email protected]:1521/ORCLPDB>select GRANTOR,OWNER,TABLE_NAME,PRIVILEGE from user_tab_privs where GRANTOR ='B';
no rows

We found that A and B Of SELECT ON HR.EMPLOYEES All permissions of are revoked

d. Come to the conclusion ：

By WITH ADMIN OPTION System permissions granted by permissions , When the system permission given to the account is recycled , By WITH ADMIN OPTION System permissions granted by permissions are not recycled .

WITH GRANT OPTION Object permissions granted by permissions , When the permission granted to the user is recycled , By WITH GRANT OPTION The object permissions granted to the user are also cascaded back .

?END！