在数据库服务器不同的计算机上(AIDU)

cmd

sqlplus

SQL>CONN SYS/SYSTEM@AIDU2008 AS SYSDBA

SQL>CREATE USER AIDU PROFILE "DAFAULT" IDENTIFIED BY "AIDU" DEFAULT TABLESPACE "USERS" TEMPORARY TABLESPACE "TEMP" ACCOUNT UNLOCK;

SQL>GRANT CONNECT TO AIDU;

SQL>CREATE USER AIDU2 PROFILE "DEFAULT" IDENTIFIED BY "AIDU2" DEFAULT TABLESPACE "USERS" TEMPORARY TABLESPACE "TEMP" ACCOUNT UNLOCK;

SQL>GRANT CONNECT TO AIDU2;

SQL>GRANT SYSDBA TO AIDU WITH ADMIN OPTION;

SQL>CONN AIDU/AIDU@AIDU2008 AS SYSDBA;

SQL>GRANT SYSDBA TO AIDU2;

SQL>CONN AIDU2/AIDU2@AIDU2008 AS SYSDBA --OK

SQL>CONN SYS/SYSTEM@AIDU2008 AS SYSDBA

SQL>REVOKE SYSDBA FROM AIDU

SQL>CONN AIDU2/AIDU2@AIDU2008 AS SYSDBA --仍然可以使用SYSDBA身份进行登陆,不受AIDU被剥夺SYSDBA权限的影响

对象权限的传递,当回收中间链后,后续节点的对象权限也被回收.

在数据库服务器不同的计算机上(AIDU)

cmd

sqlplus

SQL>conn / as sysdba

SQL>create user aidu3 profile default indentified by "aidu3" default tablespace "USERS" temporary tablespace "TEMP";

SQL>grant connect to aidu3

SQL>grant resource to aidu3

SQL>conn aidu/aidu;

SQL>create tabel test01(id number not null,name varchar2(20),primary key(id));

SQL>grant select on test01 to aidu2 with grant option;

SQL>conn aidu2/aidu2

SQL>grant select on aidu.test01 to aidu3

SQL>conn aidu3/aidu3

SQL>select count(1) from aidu.test01;

显示统计数为0,表明可以访问

SQL>conn aidu/aidu

SQL>revoke select on test01 from aidu2 --从中间用户回收SELECT 权限

SQL>conn aidu3/aidu3

SQL>select count(1) from aidu.test01;

报错: 找不到表或视图. 说明当中间者aidu2被 剥夺SELECT ON AIDU.TEST01表权限时,通过它建立的aidu3对AIDU.TEST01表的权限也被同时剥夺.