I have a stored procedure FOO
belonging to user A
. User B
has EXECUTE
permission on FOO
.
One of the procedures in FOO
uses a DB Link to retrieve data from BARTABLE@REMOTEDB
. A
has a DB Link to REMOTEDB
connecting as user AREMOTE
while B
has a DBLink with the same name connecting 开发者_如何转开发to REMOTEDB
but as user BREMOTE
.
When B
executes FOO
, will it use A
's DB Link (connecting as AREMOTE
) or B
's DB Link (Connecting as BREMOTE
)?
I ask because I assumed a procedure belonging to a particular user would only have access to that user's dblinks even if another user had EXECUTE
on that procedure. But somehow this procedure is working properly even though the user AREMOTE
does not have SELECT
on BARTABLE@REMOTEDB
, so I'm confused.
The procedure should use the dblink that is defined for A's link. Any oracle procedure uses the rights of the owner to process, except where that procedure has been defined with "Invoker's Rights". Invoker's Rights
Invoker's rights defined for a procedure tells the code to use the rights and objects local to the calling user, and not the code owner. The reason that this is not done by default is typically an end user will have no rights to any hard objects for direct update, but be given proper access through an API, which would apply the correct business logic to updates, inserts and deletes, and then these objects would be exposed as accessible to the end user.
精彩评论