用户A将存储过程P_LS的execute权限赋给用户B，P_LS中包含了一些用户B没有权限的DML操作，那么用户B能成功地执行存储过程P_LS吗？其实就这涉及到了create procedure时invoker_rights_clause的两个选项：

1、AUTHID CURRENT_USER

2、AUTHID DEFINER（默认）

有时赋权时，倒是要注意下这个问题。

举例说明下这两个选项的使用：

SQL> conn a/a
Connected to Oracle9i Enterprise Edition Release 9.2.0.1.0
Connected as a

SQL> create or replace procedure p_ls is
2 begin
3 insert into a.t_a values('a');
4 commit;
5 end p_ls;
6 /

Procedure created

SQL> select * from t_a;

A
----------

SQL> grant execute on p_ls to b;

Grant succeeded

SQL> conn b/b
Connected to Oracle9i Enterprise Edition Release 9.2.0.1.0
Connected as b

SQL> exec a.p_ls;

PL/SQL procedure successfully completed

SQL> select * from a.t_a;

select * from a.t_a

ORA-00942: 表或视图不存在

SQL> conn a/a
Connected to Oracle9i Enterprise Edition Release 9.2.0.1.0
Connected as a

SQL> select * from a.t_a;

A
----------
a

SQL>

从以上可以看出，默认情况下，用户B虽对a.t_a没有insert权限，但仍可以成功执行p_ls。

下面修改下p_ls为

create or replace procedure p_ls authid current_user is
begin
insert into a.t_a values('a');
commit;
end p_ls;

SQL> conn b/b
Connected to Oracle9i Enterprise Edition Release 9.2.0.1.0
Connected as b

SQL> exec a.p_ls;

begin a.p_ls; end;

ORA-00942: 表或视图不存在
ORA-06512: 在"A.P_LS", line 3
ORA-06512: 在line 1

SQL>

此时就是以用户B的权限来执行存储过程B，所以执行失败。

摘录文档上对这两个选项的描述：

invoker_rights_clause

The invoker_rights_clause lets you specify whether the procedure executes with the privileges and in the schema of the user who owns it or with the privileges and in the schema of CURRENT_USER.

This clause also determines how Oracle resolves external names in queries, DML operations, and dynamic SQL statements in the procedure.

AUTHID CURRENT_USER

Specify CURRENT_USER to indicate that the procedure executes with the privileges of CURRENT_USER. This clause creates an invoker-rights procedure.

This clause also specifies that external names in queries, DML operations, and dynamic SQL statements resolve in the schema of CURRENT_USER. External names in all other statements resolve in the schema in which the procedure resides.

AUTHID DEFINER

Specify DEFINER to indicate that the procedure executes with the privileges of the owner of the schema in which the procedure resides, and that external names resolve in the schema where the procedure resides. This is the default and creates a definer-rights procedure.