11_les_10_role数据库安全审计.pptVIP

Using Privileges and Roles Objectives After completing this lesson, you should be able to do the following: Implement roles Implement enterprise roles Implement the securing of objects through procedures Describe how secure application roles work Manage roles and users by using secure application roles Authorization Authorization determines the privileges that the user has in the database. User privileges are set in the database by: System privileges Object privileges Roles Privileges There are two types of user privileges: System: Enables users to perform particular actions in the database Object: Enables users to access and manipulate a specific object Roles Benefits of Roles Easier privilege management Dynamic privilege management Selective availability of privileges Can be granted through the operating system Predefined Roles CONNECT Role Change The CONNECT role has no privileges except CREATE SESSION. A script is provided to restore privileges for backward compatibility. It is recommended that customers create a new role if they are presently using the CONNECT role privileges other than CREATE SESSION. The CONNECT role is secure by default. Using Proxy Authentication with Roles Specify roles that the proxy is allowed to activate: Prevent any roles from being activated by the proxy: Using Enterprise Roles Enterprise roles can be used like job descriptions. Define the application or database roles required. Assign the database roles to an enterprise role. Creating an Enterprise Role Assigning an Enterprise Userto an Enterprise Role Securing Objects with Procedures Object access can be strictly controlled through procedures. The object owner creates procedures and functions to access the object. Users are granted the EXECUTE privileges on program units. Users do not have direct access to objects. Secure Application Role The secure application role solves the problem of preventing unauthorized access to data through other client programs. It is better than the