Verificar grant’s de um usuário

Muitas vezes necessitamos verificar os grants concedidos a determinados usuários, para auditoria de privilégios, necessidade de aplicá-los a outros usuários ou propriamente recriá-lo.

Podemos então utilizar o select abaixo para verificar os grants de sistema, objetos e roles concedidas.

select * from (
select 'GRANT '||privilege||' TO '||grantee||';' from dba_sys_privs
where grantee in ('USUARIO1','USUARIO2')
union all
select 'grant '||privilege||' on '||grantor||'.'||table_name||' to '||grantee||';' from dba_tab_privs
where grantee in ('USUARIO1','USUARIO2')
union all
select 'GRANT '||GRANTED_ROLE||' TO '||grantee||';' from dba_role_privs
where grantee in ('USUARIO1','USUARIO2'));

Autor: Anderson Graf

Bacharel em Sistemas de Informação e MBA em Gestão de Banco de Dados Oracle. Entusiasta da tecnologia Oracle, ACE Associate ♠, autor em vários blogs e OTN. Consultor Oracle Senior na Exímio Soluções em TI

Envolvido em soluções de:
– Implementação, migração, gerenciamento e suporte a produtos Oracle, multiplataforma
– Monitoramento de ambientes 24×7
– Backup e Recovery
– Performance e Tuning
– Alta disponibilidade (HA) – RAC, Data Guard
– EM database/grid/cloud control
– Particionamento & Advanced Compression
– Oracle Engineered Systems – ODA, Exadata

Blog pessoal: http://www.andersondba.com.br
Articulista na Oracle Technology Network (OTN) – https://goo.gl/99R6yW
ACE Associate – https://goo.gl/MBB51b
Articulista GPO – http://profissionaloracle.com.br

Publicado

02/09/2011

Scripts, Segurança

por

Anderson Graf (Admin)

Tags:

grant, owner, privilegio, replicação, segurança

Comentários

3 respostas a “Verificar grant’s de um usuário”

Leandro Lana

13/09/2011

Obrigado.

hahaha achei bem útil e mais eficaz do que o que eu tinha =]

Responder
Quintela Carvalho

17/11/2018

Muito bom mesmo kkkk eu tinha um, mas o seu é bem melhor. aí eu fiz uma alteração para ele pegar todos os usuários que não são padrão do Oracle.

select * from (
select ‘GRANT ‘||privilege||’ TO ‘||grantee||’;’ from dba_sys_privs
where grantee in (SELECT USERNAME FROM DBA_USERS WHERE USERNAME NOT IN(‘QS_CB’,’DIP’,’PERFSTAT’,’QS_ADM’,’PM’,’SH’,’HR’,’OE’,’ODM_MTR’,’WKPROXY’,’ANONYMOUS’,’OWNER’,’SYS’,’SYSTEM’,’SCOTT’,’SYSMAN’,’XDB’,’DBSNMP’,’EXFSYS’,’OLAPSYS’,’MDSYS’,’WMSYS’,’WKSYS’,’DMSYS’,’ODM’,’EXFSYS’,’CTXSYS’,’LBACSYS’,’ORDPLUGINS’,’SQLTXPLAIN’,’OUTLN’,’TSMSYS’,’XS$NULL’,’TOAD’,’STREAM’,’SPATIAL_CSW_ADMIN’,’SPATIAL_WFS_ADMIN’,’SI_INFORMTN_SCHEMA’,’QS’,’QS_CBADM’,’QS_CS’,’QS_ES’,’QS_OS’,’QS_WS’,’PA_AWR_USER’,’OWBSYS_AUDIT’,’OWBSYS’,’ORDSYS’,’ORDDATA’,’ORACLE_OCM’,’SPATIAL_CSW_ADMIN_USR’,’SPATIAL_WFS_ADMIN_USR’,’MGMT_VIEW’,’MDDATA’,’FLOWS_FILES’,’FLASHBACK’,’AWRUSER’,’APPQOSSYS’,’APEX_PUBLIC_USER’,’APEX_030200′,’FLOWS_020100′))
union all
select ‘grant ‘||privilege||’ on ‘||grantor||’.’||table_name||’ to ‘||grantee||’;’ from dba_tab_privs
where grantee in (SELECT USERNAME FROM DBA_USERS WHERE USERNAME NOT IN(‘QS_CB’,’DIP’,’PERFSTAT’,’QS_ADM’,’PM’,’SH’,’HR’,’OE’,’ODM_MTR’,’WKPROXY’,’ANONYMOUS’,’OWNER’,’SYS’,’SYSTEM’,’SCOTT’,’SYSMAN’,’XDB’,’DBSNMP’,’EXFSYS’,’OLAPSYS’,’MDSYS’,’WMSYS’,’WKSYS’,’DMSYS’,’ODM’,’EXFSYS’,’CTXSYS’,’LBACSYS’,’ORDPLUGINS’,’SQLTXPLAIN’,’OUTLN’,’TSMSYS’,’XS$NULL’,’TOAD’,’STREAM’,’SPATIAL_CSW_ADMIN’,’SPATIAL_WFS_ADMIN’,’SI_INFORMTN_SCHEMA’,’QS’,’QS_CBADM’,’QS_CS’,’QS_ES’,’QS_OS’,’QS_WS’,’PA_AWR_USER’,’OWBSYS_AUDIT’,’OWBSYS’,’ORDSYS’,’ORDDATA’,’ORACLE_OCM’,’SPATIAL_CSW_ADMIN_USR’,’SPATIAL_WFS_ADMIN_USR’,’MGMT_VIEW’,’MDDATA’,’FLOWS_FILES’,’FLASHBACK’,’AWRUSER’,’APPQOSSYS’,’APEX_PUBLIC_USER’,’APEX_030200′,’FLOWS_020100′))
union all
select ‘GRANT ‘||GRANTED_ROLE||’ TO ‘||grantee||’;’ from dba_role_privs
where grantee in (SELECT USERNAME FROM DBA_USERS WHERE USERNAME NOT IN(‘QS_CB’,’DIP’,’PERFSTAT’,’QS_ADM’,’PM’,’SH’,’HR’,’OE’,’ODM_MTR’,’WKPROXY’,’ANONYMOUS’,’OWNER’,’SYS’,’SYSTEM’,’SCOTT’,’SYSMAN’,’XDB’,’DBSNMP’,’EXFSYS’,’OLAPSYS’,’MDSYS’,’WMSYS’,’WKSYS’,’DMSYS’,’ODM’,’EXFSYS’,’CTXSYS’,’LBACSYS’,’ORDPLUGINS’,’SQLTXPLAIN’,’OUTLN’,’TSMSYS’,’XS$NULL’,’TOAD’,’STREAM’,’SPATIAL_CSW_ADMIN’,’SPATIAL_WFS_ADMIN’,’SI_INFORMTN_SCHEMA’,’QS’,’QS_CBADM’,’QS_CS’,’QS_ES’,’QS_OS’,’QS_WS’,’PA_AWR_USER’,’OWBSYS_AUDIT’,’OWBSYS’,’ORDSYS’,’ORDDATA’,’ORACLE_OCM’,’SPATIAL_CSW_ADMIN_USR’,’SPATIAL_WFS_ADMIN_USR’,’MGMT_VIEW’,’MDDATA’,’FLOWS_FILES’,’FLASHBACK’,’AWRUSER’,’APPQOSSYS’,’APEX_PUBLIC_USER’,’APEX_030200′,’FLOWS_020100′)));

Responder
Rahul Shah

24/05/2020

Nice script for finding out privileges of users. We can use following too…
set heading off
set pages 0
set long 9999999
select dbms_metadata.get_granted_ddl(‘ROLE_GRANT’, user)
from dual;
select dbms_metadata.get_granted_ddl(‘SYSTEM_GRANT’, user)
from dual;
select dbms_metadata.get_granted_ddl(‘OBJECT_GRANT’, user)
from dual;

Responder

Verificar grant’s de um usuário

Autor: Anderson Graf

Comentários

3 respostas a “Verificar grant’s de um usuário”

Deixe um comentário Cancelar resposta