Using Invoker's Rights Versus Definer's Rights (AUTHID Clause)

CREATE DATABASE LINK link_name CONNECT TO CURRENT_USER

USING connect_string;

A current-user link lets you connect to a remote database as another user, with that user's privileges. To connect, Oracle uses the username of the current user (who must be a global user). Suppose an invoker's rights subprogram owned by user BLAKE references the database link below. If global user SCOTT calls the subprogram, it connects to the Dallas database as user SCOTT, who is the current user.

CREATE DATABASE LINK dallas CONNECT TO CURRENT_USER USING ...

If it were a definer's rights subprogram, the current user would be BLAKE, and the subprogram would connect to the Dallas database as global user BLAKE.

Using Object Types with Invoker's Rights Subprograms

To define object types for use in any schema, specify the AUTHID CURRENT_USER clause. (For more information about object types, see Chapter 12, "Using PL/SQL Object Types".) Suppose user BLAKE creates the following object type:

CREATE TYPE Num AUTHID CURRENT_USER AS OBJECT ( x NUMBER,

STATIC PROCEDURE new_num (

n NUMBER, schema_name VARCHAR2, table_name VARCHAR2)

);

/

CREATE TYPE BODY Num AS STATIC PROCEDURE new_num (

n NUMBER, schema_name VARCHAR2, table_name VARCHAR2) IS sql_stmt VARCHAR2(200);

BEGIN

sql_stmt := 'INSERT INTO ' || schema_name || '.' || table_name || ' VALUES (blake.Num(:1))';

EXECUTE IMMEDIATE sql_stmt USING n; END;

END;

/

Then, user BLAKE grants the EXECUTE privilege on object type Num to user SCOTT:

GRANT EXECUTE ON Num TO scott;

Finally, user SCOTT creates an object table to store objects of type Num, then calls procedure new_num to populate the table:

CONNECT scott/tiger;

CREATE TABLE num_tab OF blake.Num;

/

BEGIN

blake.Num.new_num(1001, 'scott', 'num_tab'); blake.Num.new_num(1002, 'scott', 'num_tab'); blake.Num.new_num(1003, 'scott', 'num_tab');

END;

/

The calls succeed because the procedure executes with the privileges of its current user (SCOTT), not its owner (BLAKE).

For subtypes in an object type hierarchy, the following rules apply:

Using PL/SQL Subprograms 8-19